California AI Compliance — CCPA ADMT & CRD Employment Rules

The CCPA ADMT regulations were adopted by the CPPA under its CCPA rulemaking authority and focus on privacy rights related to automated decision-making, with ADMT compliance required from January 1, 2027. The Civil Rights Department's regulations, effective October 1, 2025, apply California's existing anti-discrimination law (FEHA) to automated-decision systems used in employment. The two frameworks have overlapping but not identical scopes.

The CCPA's employment data exemptions have narrowed significantly. ADMT regulations may apply to automated processing of California employees' data for HR decisions. Businesses should assess whether their workforce AI tools involve covered ADMT uses, regardless of whether the affected individuals are consumers or employees.

Risk assessments under the ADMT rules must evaluate the purpose and context of ADMT use, the potential risks to consumer rights and freedoms, the categories of personal information processed, and the mitigations implemented. Documentation must be maintained and made available to the CPPA upon request.

The California Privacy Protection Agency (CPPA) has exclusive authority to enforce the CCPA and ADMT regulations. The California AG has concurrent enforcement authority under some provisions. For data breaches, private plaintiffs may sue directly without any agency involvement. The CPPA has an active enforcement division and a formal investigative process.