California CCPA ADMT rules: the 1 January 2027 checklist for AI in hiring, lending and housing
Short answer: businesses covered by the CCPA that use automated decisionmaking technology (ADMT) to make significant decisions (financial or lending services, housing, education, employment or compensation, health care) must comply with the ADMT rules from 1 January 2027: a pre-use notice, opt-out and access rights. Risk-assessment duties began 1 January 2026, with the first submissions to the CPPA due 1 April 2028.
Checklist
- Confirm you are a CCPA "business" (thresholds in the statute).
- List tools that replace or substantially replace human decisionmaking for a significant decision. Employees and applicants count as consumers.
- Draft the pre-use notice (purpose, how it works, rights).
- Build the opt-out and access-request route, or document the exception you rely on.
- Run and document a risk assessment for ADMT use; existing processing must be assessed by 31 Dec 2027.
- Calendar: 1 Jan 2027 (ADMT) and 1 Apr 2028 (first risk-assessment submission).
Get it done this week
Free: list 1 AI system in the Unadhi AI Register and get a filled record you can show a customer or auditor. Paid: $190/yr for your whole AI inventory (compare: enterprise AI-governance suites are typically sold on custom annual contracts). Free sample first; no card needed to try.
Start the free register entry → or reply to any Unadhi email with "YES" for a free personalised gap note.
Why Unadhi exists: small teams deserve the same clear compliance paperwork big companies buy, at a price a startup can pay.