사회 가이드

California ADMT Rules for Automated Decision-Making

4분 읽기
마지막 업데이트 2026년 9월 15일

이 페이지에서4분 읽기

개요
심층 분석
전략적 영향
The Future of California ADMT Rules for Automated Decision-Making
실제 구현
위험 및 가드레일
구현 로드맵
계속 탐색하세요
자주 묻는 질문

개요

Those businesses must give a pre-use notice, offer an opt-out or a human appeal, and answer access requests about how the technology was used. The rules sit under the California Consumer Privacy Act and were finalized in 2025, making California one of the first US jurisdictions with detailed rules for algorithmic decisions in hiring, lending, housing, education and healthcare.

심층 분석

The CCPA, as amended by the California Privacy Rights Act, directed the California Privacy Protection Agency (CPPA) to write rules on automated decisionmaking, risk assessments and cybersecurity audits. The CPPA board adopted the final package in July 2025; it was approved in September 2025 and took effect January 1, 2026, with later compliance dates for several duties. What counts as ADMT: technology that processes personal information and uses computation to replace, or substantially replace, human decision-making. "Substantially replace" means using the output to make a decision without meaningful human involvement. To count, a human reviewer must know how to interpret the output, actually review it alongside other relevant information, and have authority to change the decision. The final rules are narrower than earlier drafts, dropping behavioral advertising and some forms of extensive profiling from the ADMT obligations. Significant decisions: the ADMT duties apply to decisions that result in providing or denying financial or lending services, housing, education enrollment or opportunities, employment or contracting opportunities or compensation, or healthcare services. Consumer rights: Before use, businesses must give a pre-use notice describing the purpose, the rights to opt out and to access information, and how the ADMT works. Consumers can opt out unless an exception applies. The main exception is offering an appeal to a qualified human reviewer; narrower ones cover certain admission, hiring and work-allocation uses where the tool works as intended and does not discriminate. Access requests entitle consumers to information about the logic and the output. Businesses using ADMT for significant decisions must comply by January 1, 2027. Risk assessments: these apply more broadly, for example to selling or sharing personal information and processing sensitive data. Existing processing must be assessed by the end of 2027, with summaries submitted to the CPPA starting in 2028. A common misconception is that any use of AI triggers these rules. What matters is whether the tool replaces human judgment in a significant decision.

기술적 통찰력

Compliance starts with an inventory: list every model or rules engine that touches personal information, tag each by the decision it feeds, and ask whether a human genuinely reviews its output. A reviewer who rubber-stamps scores does not meet the human-involvement standard, so organizations document reviewer training, what information reviewers see, override rates, and who holds authority. For access requests, teams must explain the main factors, the output the consumer received, and how that output fed the decision. This does not require source code; a model card or factor summary for each system usually lets a business explain its logic without exposing trade secrets. Risk assessments generally record the purpose, data categories, logic, known risks such as discrimination, safeguards, and a benefit-versus-risk conclusion, and are updated when any of these change materially. Keeping vendor contracts and per-decision audit logs makes opt-out handling and assessments easier to defend.

전략적 영향

위험과 안전

치명적인 AI 피해와 일상적인 AI 피해는 누가 위험을 이해하고 누가 조치를 취할 수 있는지에 따라 달라집니다.

더 명확한 결정들

공공 및 전문 지식은 강력한 안전 정책이 정치적으로 가능한지 여부를 결정합니다.

과장된 과장을 뚫고 나가기

명확한 설명은 과대광고, 연구실 홍보, 모호한 윤리 연극에 의한 포착을 줄입니다.

The Future of California ADMT Rules for Automated Decision-Making

The practical questions are about enforcement: how strictly the CPPA reads "substantially replace", and which industries it examines first. Other states have passed or proposed their own laws on algorithmic decisions, and some are more stringent. Companies with national operations may therefore standardize on the strictest common practices. Further changes to the rules, and interaction with any federal AI legislation, remain possible. Businesses should treat the current compliance dates as fixed while keeping an eye on updates.

실제 구현

An employer uses software that automatically rejects job applicants below a score cutoff, with no human review. Before using it, the employer must give applicants a pre-use notice explaining the tool and their rights.

A staffing platform uses a model to decide which contractors are offered assignments. Instead of an opt-out, it can offer an appeal to a qualified human reviewer who has authority to overturn the decision.

A for-profit online education company uses an algorithm to screen applicants to its programs. It must document a risk assessment weighing the processing's privacy risks against its benefits.

A consumer denied an apartment asks the landlord's screening company for information. The company must explain the logic of its ADMT and how the output was used in the decision.

위험 및 가드레일

실존적 위험을 공상과학처럼 다루면서 능력을 합성합니다.
높은 자율성 하에서 정렬과 표면 제품 안전성을 혼동합니다.
영어가 아니거나 전문가가 아닌 청중에게는 품질이 낮은 소스만 남겨 둡니다.

구현 로드맵

제품 손상, 오용, 통제력 상실/잘못 정렬 위험을 분리합니다.
일정과 심각도에 대한 귀하의 견해를 바꿀 수 있는 증거가 무엇인지 물어보십시오.
마케팅 주장보다 기본 소스와 구체적인 평가를 선호하세요.
인식뿐만 아니라 경력, 정책, 자금 조달 또는 기술 등 하나의 행동 경로를 식별하십시오.

계속 탐색하세요

Free newsletter

Three verified AI stories every weekday morning, written in plain English. Free forever, no ads.

One email each weekday. Unsubscribe in one click. We never sell or share your address.

Test yourself

Take the California ADMT Rules for Automated Decision-Making quiz

Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.

퀴즈 시작

Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation

자주 묻는 질문

What is California ADMT Rules for Automated Decision-Making?

The California Privacy Protection Agency's automated decisionmaking technology (ADMT) regulations cover businesses that use technology to replace or substantially replace human decision-making in significant decisions about consumers. Those businesses must give a pre-use notice, offer an opt-out or a human appeal, and answer access requests about how the technology was used. The rules sit under the California Consumer Privacy Act and were finalized in 2025, making California one of the first US jurisdictions with detailed rules for algorithmic decisions in hiring, lending, housing, education and healthcare.

What makes a technology ADMT under the CPPA rules?

The definition turns on replacing or substantially replacing human decision-making, not on whether the technology counts as AI.

Which of these is one of the significant decision areas under the rules?

Significant decisions cover financial or lending services, housing, education, employment and healthcare. Recommendations and advertising are not on the list.

What must a human reviewer be able to do for the review to count as human involvement?

The standard requires real understanding, actual review, and authority to change the outcome. A rubber stamp does not qualify.

By what date must businesses using ADMT for significant decisions comply with the ADMT requirements?

The regulations took effect January 1, 2026, and the ADMT duties apply from January 1, 2027.

What is the main exception that lets a business avoid offering an opt-out of ADMT?

A human appeal with real authority can replace the opt-out. Narrower exceptions exist for some admission, hiring and work-allocation uses.

계속 학습하세요