GRCLibrary.ai

Annex

California CCPA Automated Decision-Making Technology (ADMT) Regulatory Requirements

This annex documents California's AI-specific regulatory limb for the AI-domain reader: the California Privacy Protection Agency's CCPA regulations on Automated Decisionmaking Technology (ADMT), which bind a business that uses ADMT to make a significant decision concerning a consumer. It is the ai/jurisdictions/ view of that limb, parallel to the Colorado and New York City AI annexes, and it adds the framework-alignment crosswalk (NIST AI RMF 1.0, ISO/IEC 42001:2023) for AI-governance adopters. This annex is the single canonical home for the CCPA ADMT limb: privacy/jurisdictions/annex-privacy-united-states.md touches ADMT only in a brief privacy-context summary that points here, and it retains the CCPA risk-assessment and cybersecurity-audit slices as its own privacy-domain obligations; on the shared ADMT obligation detail the enacted regulation governs.

Type
Annex
Version
0.0.6
Date
2026-10-27
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
AI Governance
Review frequency
Annual and upon material change to the CCPA ADMT regulations or their compliance dates
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Applicable law and regulatory authority
  • Transition timeline
  • Scope: covered actors and covered decisions
  • Core obligations
  • Consumer rights
  • Enforcement
  • Relationship to the California privacy layer
  • Limitations
  • Framework alignment

Frameworks it maps to

Related documents