Recent final regulations from the California Privacy Protection Agency (CPPA), under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), have established California as a national leader in AI governance for consumers and, significantly, for employees and job applicants. These stringent new rules, with compliance deadlines extending into 2027 and beyond, demand that employers immediately reassess their use of Automated Decision-Making Technology (ADMT) in the workplace.
What Qualifies as Automated Decision-Making Technology (ADMT)?
The CPPA has adopted a broad definition of ADMT, which is designed to capture a wide array of tools used in the employment life cycle.
- Broad Definition. ADMT is defined as any technology that processes personal information and uses computation to replace or substantially replace human decision-making.
- Explicit Inclusions. This definition explicitly covers “profiling” technologies that analyze or predict human characteristics such as:
- Intelligence
- Ability
- Aptitude
- Performance at work
- Beyond AI. While the regulations cover sophisticated AI and machine learning tools, they also apply to simpler, rule-based systems if they meet the “substantially replace” standard for making a “significant decision” about an individual.
Key Requirements for Employers Using ADMT
The new regulations impose three major requirements for businesses that use ADMT to make “significant decisions” concerning employees or job applicants. These “significant decisions” include application screening, performance evaluation, and tools influencing decisions on hiring, promotion, discipline, scheduling, compensation, or termination.
- New Rights for Employees and Applicants. Employers must now grant new rights to individuals when ADMT is used for a significant decision:
- Pre-Use Notice: Before the ADMT is used, a business must provide a clear and conspicuous notice explaining the specific purpose of the technology, how it makes the decision, the categories of personal information affecting the output, and the type of output generated.
- Right to Opt-Out (or Appeal): Individuals must generally be given the ability to opt out of the ADMT’s use for making a significant decision about them. The opt-out requirement can be avoided if the employer provides an appeal process to a qualified human reviewer who has the authority to overturn the ADMT’s decision.
- Right to Access. Individuals can request access to information about the ADMT’s use concerning them, including an explanation of its logic, the output, and how the business used that output in the decision.
- Mandatory Risk Assessments. Before using ADMT to make a significant decision or before using personal information to train ADMT for certain purposes, businesses must conduct and document detailed risk assessments.
- The assessment must weigh the privacy risks to consumers/employees (such as discrimination, economic harm, or reputational harm) against the benefits to the consumer, business, and other stakeholders.
- If risks outweigh the benefits, the business must take steps to sufficiently mitigate those risks or stop using the technology. This directly reinforces the need to proactively test ADMT for potential unlawful discrimination, an issue also addressed by the California Civil Rights Department (CRD) regulations under FEHA.
- Ensuring Meaningful Human Involvement. To remove technology from the ADMT regulations’ requirements (notice, opt-out, access), employers can ensure the decision is made with meaningful human involvement. This is a high bar, requiring the human reviewer to:
- Know how to interpret the ADMT’s output.
- Analyze the output and other relevant information.
- Have the authority to make or change the decision based on that analysis.
Next Steps for Employers
The overall impact of these regulations is a shift toward greater transparency, accountability, and demonstrable fairness when California employers use AI or automated tools.
- Inventorying and Auditing: Immediately identify and inventory all automated technologies used in employment decisions to determine which ones qualify as ADMT.
- New Policies and Procedures: Establish clear processes for providing the mandatory pre-use notices and for managing opt-out/access requests (or implement a fully compliant human appeal process).
- Mitigate Discrimination Risk: Conduct proactive anti-bias testing on all employment-related ADMT. The absence of this testing can be used as evidence against an employer in a discrimination claim.
- Seek Legal Counsel: Consult an attorney to address specific questions and ensure your ADMT practices are compliant with both the CCPA/CPRA and related CRD/FEHA requirements.
