Law / United States / 
California
CCPA Automated Decisionmaking Technology Regulations
Cal. Code Regs. tit. 11, Sections 7200 to 7222
In force since .
An AI risk obligations rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Data subject rights, DPIA, Disclosure
- Audit expectation
- none
What it requires
- If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about itNIST AI RMFMEASURE 2.8
- Let a consumer opt out of your use of ADMT to make a significant decision about them, unless you offer an appeal to a human reviewer with authority to overturn the decision or another exception listed in the regulation appliesNIST AI RMFMANAGE 4.1
- When a consumer requests access to your use of ADMT to make a significant decision, respond with a plain-language explanation of the specified information about that useNIST AI RMFMEASURE 2.9
- If you were already using ADMT for a significant decision before , come into compliance with these requirements by that date; if you begin such use on or after that date, be in compliance from the start
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Who enforces it
Enforcement body
Enforced by the California Privacy Protection Agency or the Attorney General under the CCPA's general enforcement authority (Civil Code Section 1798.185); this article states no ADMT-specific penalty amount of its own.
What it makes you log
Who may demand the log
Data subject
What the log must hold
Output reference, Decision basis, Human involvement
Logging duty
Section 7222 requires a business to respond to a consumer's request to access ADMT with information about the logic the ADMT applied and the specific output and outcome for that consumer. It never uses the words log, record, event recording, or audit trail, but a business cannot produce that consumer-specific information on demand unless it already kept it. Section 7221(b)(1)'s human-appeal exception separately requires a designated human reviewer to "review and analyze the output of the ADMT," which depends on the same underlying record.
- Kind
- Implicit
- As of
- Provision
- Section 7222
- Trigger
- automated_decisions
What this law does
Article 11 of the California Privacy Protection Agency's CCPA regulations, adopted by the Agency Board on , approved by the Office of Administrative Law and filed with the Secretary of State on , and effective per the Agency's own regulations page, governs a business's use of automated decisionmaking technology (ADMT) to make a 'significant decision' about a consumer, defined as a decision granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services.
A business using ADMT for a significant decision must give consumers a Pre-use Notice describing the use and the consumer's rights to opt out of and access information about that use (Section 7220), must let a consumer opt out of that use except where the business offers an appeal to a human reviewer empowered to overturn the decision or another listed exception applies (Section 7221), and must respond to a consumer's request to access ADMT with a plain-language explanation of the specified information about that use (Section 7222).
A business using ADMT for a significant decision before has until that date to come into compliance with this article; a business beginning such use on or after must already be in compliance. Confirmed against the Agency's own approved regulation text, which places the automated-decisionmaking-technology article at Sections 7200 to 7222, not the 7040-to-7057 range sometimes cited for it.
When LexLint raises it
When your app profile says your app makes credit decisions, makes education decisions, makes employment decisions, makes health care decisions or makes housing decisions.
Back to the example · Lint your app
Page updated .