ADMT Is Not “AI Regulation”: What California’s Rule Actually Covers

The headline is bigger than the rule

When California finalised its Automated Decisionmaking Technology (ADMT) regulations, the coverage read as if the state had decided to regulate AI itself. The actual text — title 11, Article 11, sections 7200–7222 — is much narrower than the headline. It says nothing about model quality or chatbots in general. It attaches duties to one specific combination of company, technology and decision.

That narrowness is good news for most businesses — and a trap for the few it catches, who assumed a rule with “AI” in the headlines could not be aimed at an ordinary tenant-screening score. The regulation tests the combination through three gates, in its own order.

Gate 1: is the company a CCPA “business” at all?

The ADMT duties fall only on a “business” under the CCPA: a for-profit entity doing business in California that collects consumers’ personal information and determines why and how it is processed. It must also meet any one of three thresholds (Civil Code § 1798.140(d)):

• Revenue: annual gross revenues over $26,625,000 — the CPI-adjusted figure in effect since January 1, 2025 (the statute’s base amount is $25 million, adjusted for inflation every odd-numbered year).
• Volume: it annually buys, sells or shares the personal information of 100,000 or more consumers or households.
• Revenue share: it derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information.

Any single prong is enough. Nonprofits and government agencies are generally not “businesses”. A company below all three thresholds is outside Article 11 — though other laws may still apply to the same tool.

Gate 2: is the decision on the list of five?

Article 11 applies only where ADMT is used to make a “significant decision” (§ 7001(ddd)): a decision that results in the provision or denial of one of five things — financial or lending services (extending credit or a loan, transmitting or exchanging funds, deposit or checking accounts, check cashing, installment payment plans); housing; education enrollment or opportunities (admission, credentials, suspension, expulsion); employment or independent-contracting opportunities or compensation (hiring, work allocation, pay, promotion, demotion, termination); or healthcare services (diagnosis, prevention, treatment, or assessment of a person’s health).

The list is closed, and the edges are instructive. Advertising is expressly excluded (§ 7001(ddd)(6)). A housing decision based solely on availability or vacancy, or on successful receipt of payment, is carved out. Dynamic pricing of ordinary goods is not on the list, though pricing that is part of extending credit belongs under financial services. Customer-service routing that decides nothing on the list is out.

Two cases deserve care rather than a confident answer. Insurance underwriting and pricing are not named in the five categories, and “financial or lending services” is defined by a list that does not mention insurance — so the honest result is “possibly in scope, needs legal review”, not an automatic yes. Healthcare triage counts only if it controls whether or what care a person receives; routing messages without affecting care does not.

Gate 3: does a human genuinely decide?

A listed decision is covered only if the technology is actually ADMT. The definition (§ 7001(e)) is any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace it — and “substantially replace” means the business uses the technology’s output to make the decision without human involvement (§ 7001(e)(1)). Human involvement is a three-part test: the reviewer must know how to interpret and use the output, must review and analyse it alongside other relevant information, and must have the authority to make or change the decision.

A rubber stamp fails that test: a reviewer who approves every score, cannot explain it and could not overturn it is not “involved” in the sense the regulation means. A genuine reviewer takes the tool outside “substantially replace” altogether. The definition also excludes everyday infrastructure — web hosting, networking, caching, data storage, firewalls, anti-virus, spam filtering, spellchecking, calculators, databases, spreadsheets — provided it does not replace human decisionmaking.

If all three gates close: what is owed, and by when

The regulations are final: adopted by the CPPA Board on July 24, 2025, approved and filed on September 22, 2025, effective January 1, 2026. A business already using ADMT for a significant decision before January 1, 2027 must comply with Article 11 no later than January 1, 2027 (§ 7200(b)); one that starts later must comply whenever it uses ADMT that way. The main duties:

Three narrow opt-out exceptions exist — a human appeal with authority to overturn, and ability assessments in hiring/admission and work-allocation/compensation decisions — each with its own conditions. Notices and access responses need not reveal trade secrets or security-compromising information. Risk assessments must be reviewed at least every three years, updated within 45 days of a material change, and retained for the longer of the processing duration or five years after it ends.

The honest answer is often “possibly”

Several steps above end in a judgement call: whether the pricing is really credit pricing, whether the triage tool controls care, whether the human reviewer is genuine. No checklist can settle those fact questions from the outside, which is why the checker below returns “possibly in scope — needs legal review” instead of collapsing them into a yes or a no. That is a result, not a failure — and exactly the answer to take to a California privacy lawyer. This guide is not legal advice.