ADMT
mandatory
Risk assessment for automated decisions
Businesses using ADMT for significant decisions must conduct and document a risk assessment.
Regulation
CCPA/CPRA ADMT Regulations + AB 2013
California (USA) · California, USA · Law / Regulation
This page is a plain-English summary written by us, not legal advice — the official text is linked above. Our catalogue was last reviewed 2026-08-15; that is a review of the whole catalogue, not an independent legal verification of this entry.
Authority
California (USA)
Jurisdiction
California, USA
Type
Law / Regulation
Status
In force
Maximum penalty
CCPA penalties up to $7,500 per intentional violation
Catalogue reviewed
2026-08-15
Official source checked
2026-08-23 — unchanged since our last read
Official text
Status
CPPA ADMT & risk-assessment regs took legal effect 1 Jan 2026, but compliance is phased: ADMT compliance from 1 Jan 2027; pre-use notice & opt-out enforced 1 Apr 2027; risk assessments for pre-existing processing due 31 Dec 2027 (first CPPA submission 1 Apr 2028). AB 2013 training-data transparency in force since 1 Jan 2026
Requirements (3)
ADMT opt-out
mandatory
Pre-use notice & opt-out
Provide a pre-use notice and the right to opt out of ADMT for significant decisions (phasing in 2027).
AB 2013
mandatory
Training-data transparency
Developers of generative AI must publicly document the datasets used to train the system.
Dates that matter
Deadline
2026-01-01 · in force
California AB 2013 — training-data transparency
Generative-AI developers must publish documentation about the datasets used to train the system.
Action: Prepare a public training-data summary for any GenAI you develop.
Deadline
2026-01-01 · in force
California SB 53 — frontier AI transparency & incidents
Large frontier-model developers must publish a safety framework and transparency reports and report critical incidents to Cal OES within 15 days (24 hours if imminent risk).
Action: If you train frontier-scale models, stand up the safety framework and incident-report channel.
Deadline
2027-01-01 · in 130 days
California CPPA — ADMT compliance required
The CPPA ADMT and risk-assessment regulations took legal effect 1 Jan 2026, but businesses using automated decision-making technology for significant decisions must be compliant from 1 Jan 2027; risk assessments covering pre-existing processing are due 31 Dec 2027 (first submission to the CPPA 1 Apr 2028).
Action: Complete an ADMT risk assessment and ready significant-decision workflows for the 2027 compliance dates.
Deadline
2027-04-01 · in 220 days
California ADMT — opt-out & pre-use notice phase
Consumers gain opt-out and pre-use notice rights for covered automated decisions.
Action: Build opt-out handling and pre-use notices into the product.
Get told when this changes
Our agents re-read the official source every few hours and republish this page when it moves. Leave an email and you will hear about it — only when something actually changed.
Compare it with another regulation
The same obligation themes side by side — what both demand, what only one does, and which deadline lands first.