California ADMT Scope Checker
Three gates — CCPA business thresholds, significant decisions, human review — tell you whether California’s automated decisionmaking rules likely cover your tool.
California’s Automated Decisionmaking Technology (ADMT) rules — Article 11 of the CCPA regulations (title 11, California Code of Regulations, §§ 7200–7222) — do not regulate “AI” in general. They attach duties to one specific combination: a business covered by the CCPA uses technology that replaces or substantially replaces human decisionmaking to make a “significant decision” about a consumer. This checker tests that combination in the regulation’s own order: the business thresholds in Civil Code § 1798.140(d), the significant-decision list in § 7001(ddd), and the human-involvement test in § 7001(e)(1).
What this checks
California's ADMT rules (title 11, California Code of Regulations, Article 11) apply to one specific combination: a business covered by the CCPA uses technology that replaces — or substantially replaces — human decisionmaking to make a “significant decision” about a consumer. This checker tests your situation against the regulation's three gates, in order:
- Gate 1 — Business thresholds. Is the company a CCPA “business” at all?
- Gate 2 — Significant decision. Is the automated decision one of the five types the regulation lists?
- Gate 3 — Human review. Does a knowledgeable person genuinely review the output, with real authority to change the decision?
Everything runs in your browser. Your answers are never sent to a server; they are encoded into a link only if you choose to copy a result link.
- California Privacy Protection Agency — CCPA Updates, Cybersecurity Audits, Risk Assessments and ADMT regulations package
- Approved regulations text (title 11, California Code of Regulations) — PDF
- CPPA — CPI adjustments to CCPA monetary thresholds
- California Attorney General — California Consumer Privacy Act
Key provisions: Civil Code § 1798.140(d) (who counts as a “business”); 11 CCR § 7001(ddd) (significant decisions), § 7001(e) (ADMT and human involvement), §§ 7150–7157 (risk assessments), §§ 7200–7222 (Article 11). The $26,625,000 threshold is the CPI adjustment in effect since January 1, 2025.
How to use
- Gate 1: answer the three CCPA business-threshold questions (revenue, data volume, revenue share) — one “yes” is enough for the company to count as a CCPA business.
- Gate 2: tick every kind of decision your technology helps make, then Gate 3: say honestly whether a knowledgeable person reviews the output and can change the decision.
- Read your result tier and why, copy the result link to share it, and check the key-dates table below for when each obligation lands.
About this tool
Two features of the final rules do most of the work. The significant-decision list is closed — financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, and healthcare services, with advertising expressly excluded — so familiar automation such as dynamic pricing of ordinary goods or routing support tickets sits outside Article 11 altogether. And genuine human review defeats the definition: a knowledgeable reviewer who studies the output alongside other information and can actually change the outcome means the technology is not ADMT. Insurance underwriting and pricing are the honest grey zone — the final list does not name them — so this checker flags them for legal review instead of guessing.
The duties phase in over three years. The regulations took effect on January 1, 2026; Article 11 compliance is required by January 1, 2027; risk assessments for processing that began before 2026 must be completed by December 31, 2027; and risk-assessment information, with an executive attestation, is due to the California Privacy Protection Agency by April 1, 2028. In keeping with how this site works, the checker runs entirely in your browser: your answers are never sent to a server — they exist only on this page and, if you use it, in the result link you copy.
How it works
Scope under Article 11 is a conjunction, not a vibe. Three conditions must all hold: (1) the company is a CCPA “business” under Civil Code § 1798.140(d) — for-profit, doing business in California, determining the purposes and means of processing, and meeting at least one of three size tests (annual gross revenue over the CPI-adjusted threshold, currently $26,625,000; buying, selling or sharing the personal information of 100,000 or more consumers or households a year; or deriving 50% or more of annual revenue from selling or sharing personal information); (2) the technology is used to make a “significant decision”; and (3) it replaces or substantially replaces human decisionmaking. Fail any one condition and Article 11 does not reach the use — which is why this checker asks the gates in order and can stop early.
“Significant decision” is defined at 11 CCR § 7001(ddd) as a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Each term is itself defined: financial or lending services means the extension of credit or a loan, transmitting or exchanging funds, the provision of deposit or checking accounts, check cashing, or installment payment plans; employment covers hiring, allocation or assignment of work and compensation, promotion, demotion, suspension and termination; education covers admissions, credentials, suspension and expulsion. Two limits are written into the same section: advertising to a consumer is not a significant decision, and a housing decision based solely on availability or vacancy, or on successful receipt of payment, is not one either.
“Substantially replace” is where human review enters (§ 7001(e)(1)): a business substantially replaces human decisionmaking when it uses the technology’s output to make a decision without human involvement. Involvement counts only when the reviewer (A) knows how to interpret and use the output, (B) reviews and analyzes the output and any other information relevant to making or changing the decision, and (C) has the authority to make or change the decision based on that analysis. Profiling is expressly included in ADMT (§ 7001(e)(2)). At the other end, everyday infrastructure — web hosting, domain registration, networking, caching, data storage, firewalls, anti-virus and spam filtering, spellchecking, calculators, databases and spreadsheets — is expressly excluded from the definition, provided it does not replace human decisionmaking (§ 7001(e)(3)).
Worked examples
Resume-screening software: A staffing platform ranks job applicants and auto-rejects the bottom half; recruiters only ever see the survivors. Gate 1: the client company’s revenue passes $26,625,000, so it is a CCPA business. Gate 2: hiring is an employment decision — on the list. Gate 3: nobody reviews the rejected applicants at all, so the output is the decision. Result: likely in scope.
Support-ticket router: An online retailer uses a model to sort support chats into billing, shipping and technical queues; agents then answer every chat themselves. Gate 1 may well pass, but Gate 2 fails first: routing a conversation does not provide or deny any of the five listed things. Result: likely out of scope for Article 11 (other CCPA duties are a separate question).
Clinic symptom checker: A chatbot asks patients about symptoms and decides who gets a same-day appointment and who is told to wait. Because the tool controls access to diagnosis and treatment, it is making healthcare decisions — likely in scope if Gates 1 and 3 also point that way. The same clinic’s bot merely forwarding messages to the right inbox, without affecting care, would not be.
Quick reference
| Date | Milestone |
|---|---|
| January 1, 2026 | CCPA regulations package, including the ADMT rules, takes effect |
| January 1, 2027 | Article 11 (ADMT) compliance required for uses in significant decisions |
| December 31, 2027 | Risk assessments completed for processing that began before January 1, 2026 |
| April 1, 2028 | Risk-assessment information + executive attestation due to the CPPA (for 2026–2027 assessments) |
Frequently asked questions
Is this legal advice?
No. This checker is general information built from the published text of the CCPA and its ADMT regulations. It cannot weigh your contracts, your data flows, or how a regulator or court would read your facts, and it is not a substitute for a qualified California privacy attorney. Treat a “likely” answer as a prompt for that conversation, not the conclusion of it.
What exactly counts as a “significant decision”?
A decision that results in the provision or denial of one of five things: financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services (11 CCR § 7001(ddd)). The list is closed, advertising is expressly excluded, and a housing decision based solely on availability or vacancy — or on successful receipt of payment — is carved out as well.
Our software only recommends — a person makes the final call. Are we covered?
Probably not, if the human role is real. Under § 7001(e)(1), technology does not “substantially replace human decisionmaking” when the reviewer knows how to interpret and use the output, reviews it together with other relevant information, and has authority to make or change the decision. If reviewers routinely rubber-stamp the output, that protection disappears and the tool counts as ADMT.
Is insurance pricing or dynamic pricing a significant decision?
Dynamic pricing of ordinary products: no — it is not among the five categories, unless the pricing forms part of extending credit, which makes it a lending decision. Insurance underwriting and pricing: the final regulation text does not name insurance, and “financial or lending services” is defined without it, so this checker answers “possibly — needs legal review” rather than yes or no.
What are the key ADMT deadlines?
The regulations took effect on January 1, 2026. A business using ADMT for a significant decision must comply with Article 11 by January 1, 2027. Risk assessments for processing that began before January 1, 2026 must be completed by December 31, 2027. Risk-assessment information, together with an executive attestation, must be submitted to the California Privacy Protection Agency by April 1, 2028 for assessments conducted in 2026–2027.
More free tools
Invoice Generator
Create professional invoices in seconds — download as PDF, no sign-up.
Meeting Cost Calculator
See what your meetings really cost — live ticker as time passes.
Email Signature Generator
Build a clean, professional email signature and copy it straight into Gmail or Outlook.
QR Code Generator
Turn any link or text into a scannable QR code in seconds.
Word Counter
Count words, characters, sentences and reading time as you type.
Percentage Calculator
Work out percentages, increases and discounts in one click.