← CCPA/CPRA · Regulations (2026+)

Regs (ADMT) — Automated decision-making technology for significant decisions

high data-subject-rights

Requirement

From 1 January 2027, a business that uses automated decision-making technology to make significant decisions about consumers (financial or lending, housing, education, employment or healthcare) must give a pre-use notice, offer a right to opt out (or a qualifying human appeal) and respond to requests for access to information about the ADMT's use.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of
automated decision…automated decisionmakingadmtautomated decision-making technologyalgorithmicalgorithmautomated scoringautomated underwriting
Required element 2 — any one of
pre-use noticenoticeopt outopt-outappealhuman reviewhuman revieweraccesssignificant decisionsignificant decisions
Supporting terms — specificity signals
january 1 2027employmentlendinghousinghealthcareeducation

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

FrameworkControlTitleShared topics
GDPR Art.15 Right of access data-subject-rights
GDPR Art.18 Right to restriction of processing data-subject-rights
GDPR Art.20 Right to data portability data-subject-rights
GDPR Art.22 Automated decision-making and profiling data-subject-rights
NDPA 2023 s.34(1)(a)-(c) Right of access and rectification data-subject-rights
NDPA 2023 s.38 Right to data portability data-subject-rights
NDPA 2023 s.36-37 Objection and automated decision-making data-subject-rights
GDPR Art.12 Transparent communication and handling of rights requests data-subject-rights