California's 2027 AI opt-out rule will push companies toward less transparent models

The 2027 California ADMT opt-out rule will push companies toward less transparent models. Not because anyone wants that, but because the law's language rewards opacity. A deep learning model whose logic no one can trace is easier to claim is 'not subject to ADMT' than a decision tree whose logic is provably automated.

What most people think

The common view is that California's ADMT Act will force companies toward more transparent, explainable AI. The logic seems sound: if you must tell consumers when a system makes automated decisions and let them opt out, you will want to understand what your system does. So governance teams invest in explainable AI, audit trails, and model documentation. They assume that transparency is the safe path.

What the data shows

Our live incident database, which tracks reported AI failures from public news, shows a market that does not reward transparency. In the last 180 days, we catalogued 869 stories. The top categories by volume: privacy leaks (87 stories), fraud and scams (66), security vulnerabilities (65), and multi-agent risks (63). Meanwhile, lack of capability or robustness got zero stories. Overreliance and unsafe use got zero. Environmental harm got zero. The news cycle rewards models that hide their limitations, not ones that expose them.

That is the backdrop for California. The CPPA has not yet published final definitions of what counts as 'meaningful human review' for the ADMT opt-out and pre-use notice phase that begins 2027-04-01. Without a clear definition, companies will argue that their model's output is merely a 'recommendation' reviewed by a human. For a black-box neural network, no one can prove the model's logic was deterministic. For a simple decision tree, you can. So the rational firm, facing legal ambiguity, will prefer the opaque model.

Why this happens

The mechanism is straightforward. The ADMT Act triggers obligations when a system makes an automated decision that significantly affects a consumer. If you can plausibly claim a human reviewed the output, you can argue the decision was not fully automated. With a rule-based system, the logic is auditable. A regulator or plaintiff can trace exactly how an input became an output. That makes it demonstrably automated and squarely within the opt-out requirement. With a deep learning model, the logic is not auditable. You cannot prove the model was deterministic. You can only assert that a human clicked 'approve' on the output. That assertion becomes your legal shield.

So a governance team that invests in explainable AI to satisfy ADMT may actually be creating more regulatory exposure. Your transparent system is easier to target. Your black-box vendor is harder to pin down. The law, as written, does not punish obfuscation. It rewards it.

The best argument against this

One could argue that the CPPA will close this loophole. The final ADMT regulations could explicitly state that any model that generates a decision affecting a consumer is subject to opt-out, regardless of human review. If they do, the incentive flips. Companies with black-box models would face the same obligations as those with transparent ones, and the opaque path loses its advantage.

That is possible. But it is not the current state. The CPPA has not published final definitions, and the rulemaking process is slow. Until they act, the ambiguity is real. And even if the CPPA does close the loophole, the period between now and 2027-04-01 is a window where rational firms will make procurement decisions based on the current ambiguity. Those decisions will be hard to reverse.

What I think happens next

By 2027-04-01, legal commentary and CPPA guidance will reveal a clear pattern. Companies with large language models will claim exemption from ADMT opt-out requirements by asserting 'human-in-the-loop review.' Companies with simpler automated scoring systems will be forced to comply. The ratio of ADMT exemption claims for neural models versus rule-based systems will be at least 3:1 in published compliance guidance.

What would prove me wrong: if the CPPA's final regulations explicitly state that any model that generates a decision affecting a consumer is subject to opt-out regardless of human review, and companies with black-box models are found to be complying at the same rate as those with transparent systems.

What to do about it

First, before 2027-04-01, pressure the CPPA rulemaking process to define 'meaningful human review' in a way that cannot be satisfied by a human clicking 'approve' on a model's output. Write a public comment. Get your legal team to draft one. The rule is not final yet.

Second, run a legal analysis of whether your current model's opacity is an asset or a liability under ADMT. Do this now, before you make procurement decisions. Build a decision framework that does not reward obfuscation. If you choose a black-box model, document why, and what your fallback is if the CPPA closes the loophole.

Third, set your own standard for what counts as meaningful human review, and document it. Do not wait for the regulator. If your standard is defensible, you are in a stronger position than a company that has no standard at all.

Fourth, watch what the security side is writing. Our sister platform ThreatClaw, which covers AI security, publishes on model provenance and the banking rules that can stop AI tools from turning rogue. The governance world and the security world are converging on the same problem: proving what your model actually does. That is the skill you need to build now.

Fifth, if the governance question is genuinely contested, get the strongest version of the other side. Xodexa runs structured debates on questions without settled answers. Use it to stress-test your legal position before a regulator does.

The 2027 ADMT rule is not a transparency mandate. It is an ambiguity mandate. The companies that thrive will be the ones that understand that and plan accordingly. A governance or risk programme can help you document your reasoning and defend it, but it cannot make you compliant with a rule that is still being written. So write the rule yourself, as best you can, and be ready to defend it.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.
• Xodexa (xodexa.com) runs 300 AI agents through structured, multi-round debates on the questions that do not have settled answers, and publishes the verdicts and the predictions that come out of them. Useful when the governance question is genuinely contested and you want the strongest version of the other side.

Related reading:

• The Banking Rule That Can Stop AI Security Tools From Turning Rogue on ThreatClaw
• Can You Prove Where Your AI Model Came From? Regulators Will Ask on ThreatClaw