CCPA automated decision making rules: does your firm use ADMT?

If your firm uses software to screen applicants, assign work or calculate bonuses for California employees, the CCPA automated decision making rules may reach you on January 1, 2027. For RIAs, broker-dealers and other financial firms, the exposure usually sits in HR rather than in client records, because client data handled under the Gramm-Leach-Bliley Act (GLBA) is exempt.

When do the CCPA automated decision making rules take effect?

January 1, 2027. The California Privacy Protection Agency (CPPA) finalized regulations in September 2025 covering automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits. The regulations took effect January 1, 2026, and the CPPA states that "businesses that use ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027."

That leaves less than three months. For most firms the work is an inventory: which tools already make or shape decisions about people, and whether a person meaningfully reviews the result.

What counts as ADMT under the regulations?

ADMT is defined in section 7001(e) of the approved regulations as "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking." Profiling that does the same is included.

The definition turns on human involvement. A business "substantially" replaces human decisionmaking when it uses a tool's output to make a decision without human involvement. To count as human involvement, the reviewer must:

• know how to interpret and use the technology's output to make the decision;
• review and analyze the output, plus any other relevant information, to make or change the decision; and
• have the authority to make or change the decision based on that analysis.

A manager who clicks "approve" on a ranked list without the training, information or authority to do otherwise does not meet that test. Routine tools such as spreadsheets, databases, firewalls, spam filters and spellcheckers are excluded, but only when they do not replace human decisionmaking.

Which decisions are "significant"?

Section 7001(ddd) defines a significant decision as one that "results in the provision or denial of" financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Advertising to a consumer is expressly excluded.

The employment category is the one most professional firms will recognize in their own operations. It covers hiring, allocation or assignment of work and compensation (including bonuses and benefits), promotion, and demotion, suspension or termination. The CPPA's Final Statement of Reasons clarifies that work allocation "applies only to employees."

Do the ADMT rules apply to a registered investment adviser?

They can, mainly through HR tools that use employee and applicant data, because client data handled under GLBA is exempt. Two threshold questions decide it.

First, the firm has to be a "business" under the CCPA. The CPPA's current monetary threshold is $26,625,000 in annual gross revenue, and the statute has separate tests tied to buying, selling or sharing personal information. Smaller advisory firms may fall below the revenue line and should confirm with counsel which tests, if any, they meet.

Second, the CCPA's GLBA exemption in Civil Code section 1798.145(e) says the law does not apply to "personal information collected, processed, sold, or disclosed subject to the federal Gramm-Leach-Bliley Act." Client data an adviser collects to provide financial services is usually handled under GLBA and Regulation S-P. The exemption is tied to the data itself, so it does not cover everything a financial firm collects.

That leaves employee and applicant data. An RIA, broker-dealer, insurance agency or family office that uses an applicant tracking system to screen or rank candidates, software that assigns work, or a tool that calculates bonuses could be using ADMT for significant employment decisions about California employees and applicants. The same analysis applies to accounting firms, law firms and AEC firms that meet the business definition.

What does a business have to do if it uses ADMT for a significant decision?

The regulations in Article 11 (sections 7200 through 7222) set out three consumer-facing obligations, plus related exceptions.

• Pre-use notice (section 7220). The business must tell consumers, before using ADMT, that it does so and how. The CPPA allows this to be combined with the existing Notice at Collection if that notice meets the ADMT content requirements. Trade secrets and certain security, fraud prevention and safety information do not have to be disclosed.
• Right to opt out (section 7221). Consumers generally can opt out of the business's use of ADMT for a significant decision. The regulations include exceptions, among them a "human appeal exception" and exceptions for certain admission, acceptance or hiring decisions and for work allocation and compensation decisions. Each exception has conditions the business must meet to rely on it.
• Right to access (section 7222). On request, the business must provide information about the logic of the ADMT and the outcome of the decisionmaking process for that consumer. The regulations set a 45-calendar-day response window for these requests, extendable to a maximum of 90 days with notice to the consumer.

The same rulemaking added risk assessment requirements that have applied since January 1, 2026, with the CPPA announcement stating that covered businesses must submit risk assessment information to the agency by April 1, 2028. Ask counsel whether your ADMT use is one of the processing activities that requires an assessment.

What is the exposure if a firm gets it wrong?

Administrative fines under the CCPA are assessed per violation. After the CPPA's CPI adjustment effective January 1, 2025, the maximum is $2,663 for each violation and $7,988 for each intentional violation. Because a notice or opt-out failure can affect every applicant or employee who went through the same process, the count can add up quickly.

There is a practical cost too: a recruiting process or HR tool that has to be paused or reworked mid-cycle because nobody checked it against the rules before January.

What should a firm do this quarter?

Use the remaining weeks of 2026 to answer two questions for every tool that touches people decisions: does it replace human judgment, and can you show how a person stays meaningfully involved?

• Confirm coverage. Have counsel confirm whether the firm is a "business" under the CCPA, and which of its data sets fall under the GLBA exemption.
• Inventory the tools. List every system used in recruiting, scheduling, performance review, compensation and discipline, including AI features inside platforms you already license.
• Map each tool to a decision. For each one, note whether its output is used for hiring, work allocation, compensation, promotion, or demotion, suspension or termination.
• Test the human involvement elements. For each decision, document who reviews the output, what training they have, what other information they consider, and whether they actually have authority to change the result.
• Ask vendors for documentation. Request a plain description of each tool's logic and outputs. You will need it to answer access requests.
• Draft the notice and request handling. Prepare the pre-use notice language, decide whether an opt-out or a qualifying exception applies, and set up a process to answer access requests within 45 days.
• Record the decisions. Keep a dated file of what you reviewed, what you concluded, and who signed off.

Is this legal advice?

No. This article summarizes the CPPA's published regulations and announcements. Whether a specific tool or decision at your firm falls under the ADMT rules depends on facts only you and your counsel can assess.

How s90 helps

s90 is a compliance-focused managed IT provider for firms in Los Angeles and Orange County. We help firms inventory the systems that handle employee and client data, document how each one is configured and who reviews its output, and produce the records your counsel needs to make the CCPA call. If you would like help building that inventory before January 1, we are glad to start the conversation.