CCPA Automated Decisions: Article 11 Notices, Metadata Evidence

Under the CPPA's final rules, any business that uses automated decision-making technology to make or substantially replace human decisions on significant matters must issue a pre-use notice under Article 11, Section 7220, and honor opt-out and access requests. ADMT obligations take effect January 1, 2027. Your first priorities are inventorying systems, drafting notices, and building opt-out, access, and logging workflows.

TL;DR:

• Map entire decision pipelines, including tools whose recommendations managers routinely accept, because a notice limited to one stage may not reflect consumers’ actual experience.
• Deliver notices at or before collection, with a specific purpose, affected data categories, output use, human role, opt out instructions, and an available alternative.
• Human review counts only when reviewers can interpret outputs, examine other relevant evidence, and override outcomes; record notes, training, authority, and override reasons.
• Choose fairness metrics tied to the decision’s specific harm and document tradeoffs; demographic parity and calibration may not be simultaneously achievable.
• Check CCPA applicability thresholds before investing in controls; businesses that do not qualify under the statute may fall outside these obligations.

Table of Contents

• 1. Which systems and decisions fall under the ADMT rules?
• 2. What must a pre-use notice say, and when?
• 3. What rights do consumers get, and how do you fulfill them?
• 4. How do you prove meaningful human involvement?
• 5. How should you test ADMT for fairness and bias?
• 6. What does an operational compliance checklist look like?
• 7. When do the ADMT rules take effect, and who is covered?
• 8. How does agentless, metadata-only evidence support ADMT documentation?
• 9. What would I tell a compliance lead starting today?
• 10. How can we help you prepare for ADMT obligations?
• FAQ
• Sources

1. Which systems and decisions fall under the ADMT rules?

Scoping is where most compliance programs succeed or fail. The CPPA's final rules removed references to "AI" and focus on what a system does. If a technology processes personal information to replace or substantially replace human decision-making, it is ADMT, regardless of whether anyone calls it machine learning, a scoring engine, or a rules-based workflow. Inventory systems by the decision power they exercise, not by branding.

The second test is the decision itself. The article describes "significant decisions" as decisions with substantial legal, economic, or similarly impactful consequences for consumers. Verify the scope against the official regulations. The covered categories are:

• Credit and lending
• Housing
• Insurance
• Education
• Employment
• Healthcare
• Essential goods or services

A resume-screening tool that ranks applicants and a loan model that sets approval thresholds both fit. A spam filter or a spreadsheet macro that formats invoices does not.

Use this checklist to decide whether Article 11 applies to a given system:

1. Does the system process personal information about California consumers?
2. Does its output determine, or heavily drive, an outcome rather than merely inform a person who decides independently?
3. Does that outcome fall into one of the significant decision categories above?
4. Would removing the system force a human to make the same call from scratch?
5. Is the human reviewer able to interpret, question, and override the output? If not, treat the review as absent for scoping purposes.

A "yes" to the first three and a "no" to the fifth means the system is in scope. Record the answer, the date, and the reviewer, because your scoping rationale is itself evidence. Practitioner commentary such as this detailed review of California ADMT burdens stresses that inventories, notices, risk assessments, and audits all depend on getting this first mapping right.

Edge cases deserve a written position. A tool that produces a recommendation a manager nearly always accepts is functionally substituting for judgment, and a regulator is likely to read it that way. Where a decision combines several systems, map the whole pipeline rather than the single most visible model, because a notice that describes only one stage will not match what the consumer actually experiences.

2. What must a pre-use notice say, and when?

The article's cited summary of Section 7220 describes a pre-use notice at or before the point of collection for planned ADMT use. Confirm the requirement in an official source. If you already hold the data and plan to repurpose it for ADMT, check the official regulations for any notice timing requirements before proceeding. Timing matters because the notice is meant to let a consumer decide whether to proceed, opt out, or ask questions before the technology touches their information.

The cited summary describes detailed notice contents. Check the official regulations to confirm what your notice should include:

• A plain-language, specific purpose for the ADMT use, not a generic statement. Skadden's summary notes that non-generic explanations of purpose are expected.
• Instructions for exercising the right to opt out and the right to access information about how the ADMT works.
• The categories of personal information that affect the output.
• The type of output the technology produces and how that output is used in the decision.
• A description of the human's role, if any, in the final decision.
• The alternative process available if the consumer opts out.
• A statement that you will not retaliate against consumers who exercise their rights.

The cited summary describes consolidated pre-use notices for multiple ADMT uses. Confirm this option in the official regulations. That helps when one consumer encounters several automated steps in a single journey, such as an application, an eligibility screen, and a pricing tier. Layering works the same way in practice: a short top layer states the headline purpose and rights, and linked detail layers carry the data categories, output descriptions, and process alternatives.

A short drafting checklist for layered or consolidated notices:

1. List every ADMT use that touches the same consumer interaction before deciding to consolidate.
2. Confirm each use has its own specific purpose statement, even inside one combined notice.
3. Place the notice at the collection point, in the same channel the consumer is using.
4. Test the language with someone outside legal. If they cannot say what the technology decides, rewrite it.
5. Version-control every notice and log the date each version went live, since you may need to show what a consumer saw on a given day.

3. What rights do consumers get, and how do you fulfill them?

The article's cited practitioner summary describes rights to opt out of ADMT use for significant decisions, access information about how the technology works, and avoid retaliation for exercising those rights. Verify the applicable rights in an official source. The cited practitioner summary describes access information about the technology's logic, the categories of personal information used, and how outputs feed the decision. Verify the scope of any access right in an official source. Skadden's practitioner summary lists these as the right to opt out, right to access, and right to information on ADMT logic.

The article does not have an official source establishing a human-appeal exception for hiring or work-assignment contexts. Check the official regulations before relying on an exception. Treat that exception as narrow and document why you rely on it. If the "human appeal" is a form that routes back to the same model, it will not hold up.

Operationalizing these rights comes down to a repeatable intake and fulfillment process:

1. Provide at least one clearly labeled request channel, referenced in every pre-use notice.
2. Verify the requester and log the request with a timestamp and a unique ID.
3. Route opt-outs to the owning team and confirm the alternative process is actually available before you promise it.
4. For access requests, assemble a response covering logic, data categories, and output use in language the consumer can follow, not an engineering schematic.
5. Route appeals to a trained reviewer with override authority, and record the outcome and reasoning.
6. Suppress any adverse treatment of consumers who exercise a right, and audit for it periodically.

Keep response records together. If a regulator asks how you handled requests last quarter, one exportable log answering what was asked, what we did, who decided, and when is far stronger than scattered emails and ticket notes.

4. How do you prove meaningful human involvement?

Many teams hope to avoid ADMT classification by keeping a person in the loop. The test for that is demanding. To assess whether human review is meaningful, consider whether the reviewer can interpret the technology's output, consider other relevant data, and change or override the decision. Mere rubber-stamping does not meet the standard.

Consider two contrasting cases. In the first, a loan officer receives a score, opens the full application, checks income documentation the model never saw, and has the authority and a documented pathway to approve a declined applicant. That review is plausibly meaningful. In the second, a reviewer clicks "approve" on a queue of model outputs at a pace that leaves no time to look at anything else, and overrides are discouraged or technically impossible. That is rubber-stamping, and it will read as such under scrutiny.

Design the workflow so the standard is observable, not asserted. Reviewers need training on what the output means and where it tends to fail. They need access to the additional data that justifies a different outcome. Their managers need to treat overrides as normal, not as exceptions to explain.

Retain documentation that proves the review happened:

• Reviewer notes describing what was examined beyond the model output
• Change logs showing overrides and the reasons given
• Dated approvals tied to a named, trained reviewer
• Training records and written override authority
• Periodic override-rate analysis, since a rate near zero invites questions

If a regulator or plaintiff later challenges a decision, this file is how you demonstrate that a human, and not the system, actually decided.

5. How should you test ADMT for fairness and bias?

Fairness testing falls into three categories, and most defensible programs use more than one:

• Input and dataset tests: examine training and operating data for representation gaps, proxy variables, and label problems. Use these before deployment and whenever data sources change.
• Model explainability and documentation: record what the model is for, what features drive it, and where it is known to underperform. Use these to support access responses and pre-use notices.
• Output or black-box testing: probe the live system with controlled inputs. Techniques include metamorphic testing (changing an attribute that should not matter and checking the output), sock-puppet testing (synthetic personas submitted through real channels), and differential testing across groups.

Fairness is not one number. As guidance on demographic parity explains, fairness is a family of mathematical criteria, and satisfying demographic parity, calibration, and the others at the same time is often impossible. The practical answer is to choose a small set of metrics tied to the harm of the specific decision, and write down why. A lender worried about unequal denial rates will weigh the trade-offs differently than an employer screening for interviews.

Selecting and justifying specific fairness metrics matched to the decision's harm is more defensible than attempting to meet every metric at once, as compliance-focused guidance puts it.

For tooling, Aequitas is an open-source bias and fairness audit toolkit that tests models against several metrics and generates bias reports across population sub-groups, usable by technical and non-technical staff alike. Pair it with a black-box testing taxonomy for output probing. Auditors generally expect to see the metric rationale, the test design, the results by sub-group, the remediation taken, and the retest date, kept together and dated.

6. What does an operational compliance checklist look like?

Work through these steps in order, assigning an owner and a service-level target to each:

1. Build the ADMT inventory and decision map. List every system that touches a significant decision, the data it uses, and the human role.
2. Draft and publish pre-use notices. Match each to the collection point and version-control it.
3. Stand up opt-out and access workflows. Include identity verification, routing, response templates, and appeal handling.
4. Instrument logging and evidence retention. Capture model versions, inputs by category, outputs, overrides, and notice versions.
5. Schedule fairness audits and risk assessments. Tie cadence to model change events, not only the calendar.
6. Assign owners and SLAs. Name a person accountable for each system and each request type.
7. Rehearse a regulator inquiry. Time how long it takes to produce the full evidence file for one decision.

Some evidence is more useful than others. Provenance-stamped logs show where each record came from and that it was not altered. Signed evidence packs let a third party verify integrity. Audit summaries translate technical findings for non-technical readers, and risk concentration reports show where one system or vendor carries disproportionate decision weight. Our guides on AI logging for compliance teams and decision pipeline evidence go deeper on what to capture without exposing customer data.

Pro Tip: Pair each legal narrative, such as your scoping rationale or pre-use notice, with a machine-readable evidence file that supports it, so an auditor can read the argument and verify the proof in the same sitting.

7. When do the ADMT rules take effect, and who is covered?

The regulatory package was approved in 2025 when the California Office of Administrative Law approved the updated CCPA regulations, which include the ADMT rules. Other regulatory updates took effect on January 1, 2026, while Perkins Coie reports that ADMT-specific obligations are not required until January 1, 2027 for businesses that use ADMT to make significant decisions.

To confirm coverage, first verify that you meet the CCPA's definition of a covered business by checking the applicability thresholds in the statute and regulations. Then confirm that at least one system meets the scoping checklist above. A business under the thresholds, or one with no significant-decision ADMT, may fall outside these obligations. Record that conclusion with its date and reasoning, and revisit it whenever you add a system.

A simple readiness planner:

• Through 2026: complete the inventory, draft notices, and select fairness metrics.
• First half of 2027 approach: finish opt-out and access workflows, logging, and a mock inquiry.
• January 1, 2027: obligations apply; notices must be live at collection points.

8. How does agentless, metadata-only evidence support ADMT documentation?

Regulators and auditors do not need to see your customers' raw data to judge whether you exercised oversight. They need credible proof that you knew what was running, who could change it, what it decided, and that your records were not altered after the fact. Tamper-evident provenance and metadata-only evidence let you show that without exposing the underlying data. Our guide on proving data minimization without raw data covers the design logic, and our piece on privacy-preserving AI agent audits extends it to audit practice.

Evidence types that map well to an agentless approach include audit logs, signed reports, and identity graphs showing which agents and automations exist and what they can reach. Here is what we offer, stated factually: our platform is agentless, integrates through metadata only, produces cryptographically signed evidence packs (HMAC-SHA256), and includes an Article 26 readiness audit offering. We built it for UK and EU regulatory frameworks, and the same inventory-and-evidence discipline applies to U.S. ADMT obligations. We do not claim it replaces legal analysis, notices, or fairness testing, which remain yours to complete.

9. What would I tell a compliance lead starting today?

Start with the inventory and the notices. Everything else, the logging, the audits, the request handling, depends on knowing which systems make which decisions and telling consumers plainly. Do not wait for perfect tooling to begin that mapping.

Bring legal, compliance, and engineering into the same room early. Legal alone cannot see which systems exist, and engineering alone will not know which decisions count as significant. Make evidence exportable from day one, because the question you will eventually face is not "did you comply" but "show me."

Finally, be honest about human review. If your reviewers cannot override and do not interpret outputs, say so and fix it rather than describing it as oversight. A rubber stamp documented as meaningful is worse than an admitted gap.

— Eleye

10. How can we help you prepare for ADMT obligations?

If you need audit-ready evidence without handing over customer data, we built our platform for exactly that. Our metadata-only, tamper-evident evidence packs give your team a clean record to put in front of an auditor or regulator, which reduces back-and-forth when an inquiry arrives. Our offerings include:

• Free, Pro, and Enterprise tiers, described on our product overview
• Design Partner and Production options for firms building a long-term governance program
• Article 26 readiness audit for teams that need a structured assessment of their oversight evidence

Current pricing details are on our pricing page. The best next step is to book a demo or request the readiness audit, and we will map your current AI agents and decision flows to the evidence your regulators are likely to ask for.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

What are the new CCPA requirements for 2026?

Most regulatory updates took effect on January 1, 2026, while the ADMT-specific obligations are not required until January 1, 2027, as Perkins Coie notes. Use 2026 to inventory systems and prepare notices and workflows.

What do California's CCPA regulations require for automated decision-making technology?

The cited summary of Section 7220 describes pre-use notices, consumer rights, and notice information such as purpose, data categories, output use, and alternative processes. Check the official regulations to confirm the requirements.

What is the difference between GDPR and CCPA on automated decisions?

The two regimes differ in structure, scope, and legal basis, so do not assume one program satisfies the other. California's rules center on notice, opt-out, and access for significant decisions, so map each obligation to its primary text before reusing any control across both.

What are the key guidelines for automated decision-making?

Scope systems by function rather than the "AI" label, and check official sources to determine whether advance notice, opt-out, access, or non-retaliation requirements apply. Document human review and retain fairness-test evidence tied to the decision's harms.

Sources

• View Document - California Code of Regulations
• “A New Era of Privacy Enforcement”: CPPA Signals Intensified Oversight while Advancing New Regulations | Perkins Coie
• Updated CCPA Regulations Approved By California Office Of Administrative Law - New Technology - United States
• Aisecurityandsafety

Recommended

• AI Logging for Compliance Teams: Audit Evidence Without Customer Data
• Map NIST to Evidence: Regulator Ready AI Reports for Compliance
• Prove AI Data Minimization Without Raw Data for Compliance Teams