AI tool approval process: how to check for a CCPA risk assessment or ADMT notice

Someone on your team wants a new AI tool: a résumé screener, a meeting assistant that scores calls, a platform that ranks leads. Under California's CCPA regulations, some of those tools need a written risk assessment before they go live, and from January 1, 2027, some also need a pre-use notice and an opt-out. The cheapest time to find out is at intake, before the contract is signed. This checklist adds the right questions to your AI tool approval process.

Does every new AI tool need a CCPA risk assessment?

No. Only tools whose use falls into one of the processing activities the regulations list as significant risk need a risk assessment, and only ADMT used for significant decisions needs ADMT notices. Many AI tools, such as a drafting assistant that never touches personal information about California residents, need neither. Every request should still get a short written determination, so the decision is documented either way.

The CCPA reaches for-profit businesses that do business in California and meet a threshold, such as annual gross revenue above the inflation-adjusted figure of $26,625,000 under Civil Code section 1798.140(d), as adjusted in 2025. For financial firms there is a second filter: personal information collected under the Gramm-Leach-Bliley Act is exempt under section 1798.145(e). An RIA's client account data usually falls outside the CCPA, but its employee, applicant, website and marketing data generally does not. Our article on the CCPA GLBA exemption covers that boundary.

Step 1: Does the tool touch personal information about California residents?

Start with the data. Ask the requester and the vendor which personal information the tool will receive, from where, and about whom. Under the CCPA, "consumers" include employees, job applicants and contractors who are California residents, as well as clients and website visitors.

• If the tool receives no personal information, record that and stop here.
• If it receives only GLBA-covered client data at a financial firm, record the exemption and the reasoning.
• Otherwise, list the categories of personal information and move to Step 2.

Step 2: Does the tool trigger a CCPA risk assessment?

A tool triggers a risk assessment if its use falls into one of the six significant-risk categories in section 7150 of the CCPA regulations. Ask whether the tool will be used for any of these:

• Selling or sharing personal information, including sharing for cross-context behavioral advertising.
• Processing sensitive personal information, such as Social Security numbers, account log-ins, precise geolocation or health information. There are narrow exceptions for routine employment administration such as payroll and benefits.
• Using automated decisionmaking technology to make a significant decision about a person.
• Using automated processing to infer characteristics of job applicants, employees, contractors or students from systematic observation, such as productivity scoring or emotion analysis on recorded calls.
• Using automated processing to infer characteristics based on a person's presence at a sensitive location.
• Processing personal information the business intends to use to train ADMT for significant decisions, or to train facial recognition, emotion recognition or identity verification technology.

If any answer is yes, a risk assessment is required before the processing starts, under sections 7150 through 7157. The assessment documents the purpose, the personal information involved, the benefits, the negative impacts and the safeguards, and it names who approved going ahead. Employees who will actually run the tool must take part. Our guide to documenting significant-risk processing explains the contents and the April 1, 2028 attestation.

Step 3: Is the tool ADMT used for a significant decision?

A tool is ADMT if it processes personal information and uses computation to replace, or substantially replace, human decisionmaking, under section 7001 of the regulations. A significant decision is one that results in providing or denying financial or lending services, housing, education, employment or contracting opportunities or compensation, or healthcare services.

Ask two questions:

• What decision does the tool's output feed? If it screens, ranks or scores applicants, assigns work, sets pay, or approves or declines a financial service, the answer is likely a significant decision.
• How much does a person really review the output? A human involvement test applies: the reviewer must know how to interpret the output, must analyze it alongside other relevant information, and must have authority to change the decision. A manager who clicks approve on every recommendation does not meet it.

If the tool is ADMT used for a significant decision, the ADMT rules in sections 7200 through 7222 apply. Businesses already using such a tool must comply by January 1, 2027, and a tool adopted after that date must comply from the day it goes live. Using ADMT for a significant decision is also a risk assessment trigger, so the two obligations usually arrive together. Our overview of the CCPA automated decisionmaking rules covers the full scope.

Step 4: What has to be ready before go-live?

For an ADMT tool used for a significant decision, three things need to be in place before the first decision is made:

• A pre-use notice, presented at or before collection of the personal information, that states the specific purpose, the right to opt out (or the exception relied on), the right to access information about the ADMT, and how the technology works.
• An opt-out process with at least two methods, or a documented exception such as the human appeal route. Opt-outs received after processing starts must be honored within 15 business days.
• A process to answer ADMT access requests, which must be confirmed within 10 business days and answered within 45 calendar days under sections 7010 and 7021.

Our article on the ADMT pre-use notice and opt-out covers the wording and placement in detail. Counsel should review the notice and any exception you rely on.

Step 5: What goes in the intake record?

Every AI tool request should leave a one-page record, whatever the outcome:

• The tool, vendor, requester and business purpose.
• The personal information involved and whose it is.
• The answer to each Step 2 trigger and the Step 3 ADMT questions, with reasoning.
• Whether a risk assessment is required and who owns it.
• Whether ADMT notices are required, and the go-live date they must be ready by.
• The approver's name and date.

That record does double duty. It shows the California Privacy Protection Agency that out-of-scope tools were considered, and it gives you the inventory you need for the December 31, 2027 deadline for risk assessments on processing that began before 2026.

What should you do this quarter?

With the ADMT compliance date close, the practical order is:

• Add Steps 1 through 5 to your AI tool approval form so no new tool skips them.
• Run the same questions against AI tools already in use, starting with anything in HR, recruiting, compensation or client onboarding.
• For any existing ADMT used for a significant decision, confirm the notice, opt-out and access process will be ready by January 1, 2027.
• Schedule risk assessments for in-scope processing, and assign an executive owner for the 2028 attestation.

How does s90 help?

Intake is hard to enforce when nobody has a full list of the AI tools staff already use. s90 maintains that inventory as part of managed IT, with new-app alerts when someone signs up for an unapproved tool and AI guardrails that keep unreviewed tools away from client and employee data. Our CCPA compliance package turns the intake record into evidence your counsel and signing executive can rely on. If you want help adding these checks to your approval process before January, we are happy to talk.