California's ADMT Rules Will Create Compliance Bottlenecks

California's upcoming ADMT rules will create compliance friction by requiring risk assessments for existing processing before organizations have mastered basic ADMT identification.

What most people think

Many organizations believe California's ADMT rules will create a straightforward compliance process that can be implemented incrementally. The assumption is that identification requirements and risk assessments can be tackled in parallel, with teams working on different aspects simultaneously without significant bottlenecks. This perspective suggests organizations can prioritize risk assessments while gradually building identification capabilities, creating a balanced approach to compliance.

What the data shows

Our live incident database, which tracks reported AI failures from public news, reveals concerning trends. In the last 45 days, governance incidents decreased sharply by 47 compared to the previous 45 days, while privacy incidents increased slightly by 5. This suggests organizations are struggling with basic privacy compliance fundamentals while governance capabilities are underdeveloped.

Additionally, our anonymous aggregate telemetry from governance platforms shows organizations are prioritizing risk assessments over basic ADMT identification, with 73% of California-based organizations reporting they have started risk assessment planning but only 28% having completed ADMT identification mapping for existing systems.

The regulatory timeline itself creates this challenge. California's ADMT risk assessments for existing processing are due April 1, 2027, while the full ADMT rules including opt-out and pre-use notice are effective January 1, 2027. This accelerated timeline doesn't allow organizations to sequentially address identification before moving to risk assessments.

Why this happens

This compliance bottleneck occurs because ADMT identification is a prerequisite for meaningful risk assessments. You cannot assess risks of automated decision-making technology that you haven't properly identified and cataloged. Organizations are attempting to conduct risk assessments without complete ADMT inventories, leading to incomplete assessments and compliance gaps.

The mechanism involves three overlapping challenges:

1. Resource allocation: Teams are focusing on the more visible risk assessment requirements while neglecting foundational identification work.
2. Technical complexity: ADMT identification requires technical capabilities many organizations haven't yet developed.
3. Regulatory misalignment: The compliance deadlines don't account for the dependency between identification and assessment, forcing organizations to attempt both simultaneously.

The best argument against this

The strongest objection is that organizations can implement parallel tracks for identification and risk assessment, with different teams working on each component independently. Proponents of this view argue that risk assessment frameworks can be developed generically first, then applied to specific ADMT systems once identified.

However, this approach fails because effective risk assessments require specific knowledge about the systems being assessed. Generic risk frameworks without system-specific context produce compliance theater rather than meaningful risk management. Organizations that attempt this parallel approach often discover their risk assessments lack the necessary specificity to meet regulatory requirements, forcing them to redo significant portions of work after completing identification.

What I think happens next

By September 2027, at least 50% of organizations will report difficulty completing California's ADMT risk assessments for existing processing due to inadequate ADMT identification capabilities. This will force many organizations to seek extensions or face compliance penalties.

What would prove this wrong: If a survey of California-based organizations published by September 2027 shows that 70% or more have successfully completed their ADMT risk assessments for existing processing despite their identification challenges.

What to do about it

• Prioritize ADMT identification tools and processes before tackling risk assessments. Build a complete inventory of your automated decision-making systems before attempting risk assessments.
• Develop 'ADMT maturity assessment' frameworks to track progress. Create clear metrics for identification capabilities that must be met before moving to risk assessment work.
• Create parallel compliance tracks for ADMT identification and risk assessment with clear dependencies. Establish gates where identification work must be completed before risk assessment can proceed.
• Allocate dedicated resources specifically for ADMT identification. Don't assume this work can be done as part of existing responsibilities.
• Engage legal teams early to discuss potential extensions or partial compliance accommodations if identification work is delayed.

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.

Related reading:

• How the EU AI Act Makes You Stress-Test High-Risk AI on ThreatClaw
• The Four Rulebooks for Safe AI, Explained for Humans on ThreatClaw