Pre-Use Notice Requirements for ADMT

California law requires clear notice before using ADMT for significant decisions. You must inform consumers that you use automated technology. The notice must explain the decision-making process in plain language. Technical jargon violates the accessibility requirements.

Pre-use notices must include specific elements. They must state that automated technology makes or contributes to the decision. They must describe the logic used by the system in terms consumers understand. They must explain the role of human oversight if any exists. They must provide contact information for questions about the ADMT.

Notices require specific formatting for accessibility. You must provide large print upon request. You must ensure notices are readable by screen readers. You must offer alternative formats for consumers with disabilities. The law treats accessibility as a core compliance requirement, not an optional add-on.

Timing matters significantly. You must provide notice before collecting personal information used in the automated decision. You cannot notify consumers after the decision occurs. Job applicants must receive notice before you run their resumes through AI screening tools. Loan applicants must receive notice before AI evaluates their creditworthiness.

The regulations recognize layered notices for complex systems. You can provide a short initial notice with a link to detailed information. However, the short notice must contain the essential facts. It cannot bury critical information in links or footnotes. Consumers must understand that AI participates in decisions affecting their opportunities.

AB 2013 and Training Data Transparency

AB 2013 adds another layer of disclosure requirements specifically for AI developers. This law requires companies developing generative AI systems to document and disclose their training data sources. It takes effect January 1, 2026, the same day as the CCPA ADMT regulations.

The law targets companies building AI models, not businesses using third-party AI services. If you license AI tools from vendors, your vendor bears the training data disclosure burden. If you build proprietary AI systems in-house, you must comply directly. The distinction matters for determining your compliance obligations.

Documentation requirements include listing the types of sources used in training. Developers must identify whether they used publicly available datasets, purchased data, or scraped information. They must disclose whether personal information appeared in training data. They must reveal whether they filtered or modified datasets before training.

The law aims to prevent unauthorized use of copyrighted or private data in AI training. Developers face liability if they cannot demonstrate legitimate data sourcing. This creates new risks for companies building AI with unclear data provenance. Auditing training data sources becomes a legal necessity rather than a best practice.

For small businesses using AI tools, this law affects vendor selection. You should verify that your AI vendors comply with AB 2013. Your contracts should require vendors to indemnify you for data sourcing violations. You need documentation trails showing you selected compliant vendors. This protects you from secondary liability if vendors used unauthorized training data.

Risk Assessments and Consumer Rights

CCPA regulations require risk assessments for high-risk ADMT systems. You must evaluate whether the ADMT presents substantial risks to consumer privacy. The assessment examines data minimization practices. It reviews whether the system processes more personal information than necessary for the decision.

Assessments must occur before deploying new ADMT systems. They must also occur periodically for existing systems. The California Privacy Protection Agency recommends annual reviews. Documentation must be available for regulatory inspection. You cannot simply conduct the assessment and file it away.

Consumer rights under the new regulations include the right to opt out of ADMT processing in certain circumstances. Consumers can request human review of automated decisions. They can demand explanations of the logic behind AI-driven outcomes. They can request information about the data sources used in their specific evaluation.

Businesses must establish procedures for handling these consumer requests. You need systems to identify which data affected a specific decision. You must be able to explain how the AI reached its conclusion in understandable terms. You must provide mechanisms for human review when consumers request it.

The regulations require businesses to verify that third-party ADMT vendors comply with these consumer rights. Your contracts must ensure vendors can provide the necessary explanations and data access. You remain responsible for compliance even when using external AI services. This means selecting vendors with robust transparency features.

Preparing Your Business for January 2026

Compliance preparation starts with auditing your current AI usage. List every system that contributes to hiring, lending, housing, or healthcare decisions. Identify which systems meet the ADMT definition. Determine which consumer interactions trigger the significant decision requirements.

Document your current notice practices. Review whether you inform consumers about automated processing before it occurs. Check if your notices use plain language accessible to average readers. Verify that you provide alternative formats for consumers with disabilities. Identify gaps between current practices and legal requirements.

Review your vendor contracts for ADMT tools. Ensure contracts require vendors to support your disclosure obligations. Verify that vendors can provide explanations of AI logic when consumers request them. Confirm that vendors indemnify you for compliance failures related to their technology.

Develop opt-out procedures for consumers who object to automated processing. Design workflows for human review of AI decisions. Train staff to handle consumer questions about ADMT. Create template responses for common inquiries about automated decision-making.

Calendar your risk assessment schedule. Plan annual reviews of high-risk ADMT systems. Assign compliance responsibility to specific team members. Budget for potential legal consultation on complex AI deployments. The January 2026 deadline approaches quickly for businesses still mapping their AI usage.

The Myth vs The Reality

Common Questions About California AI Disclosure

Brief Summary

California’s CCPA automated decision-making technology regulations take effect January 1, 2026, requiring businesses exceeding $26.6 million revenue to provide pre-use notices when AI affects hiring, lending, housing, or healthcare decisions. Companies must explain AI logic in plain language, offer accessible formats, and establish opt-out procedures. AB 2013 separately requires AI developers to disclose training data sources beginning January 2026. Risk assessments are required for high-risk ADMT systems with documentation available for regulatory inspection. SB 1047 was vetoed in September 2024 and never became law, meaning businesses face transparency requirements rather than technical AI restrictions. Penalties reach $7,500 per intentional violation.