Publications + Presentations

Summary

• On July 24, 2025, the CPPA Board unanimously approved regulations addressing the use of Automated Decisionmaking Technology (ADMT) in various sectors including lending, insurance, education, HR, and behavioral advertising.
• The ADMT regulations apply when a business uses ADMT to make a significant decision concerning a consumer. Significant decisions include those that result in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services.
• ADMT means any technology that processes personal information and uses computation to  replace  or substantially replace human decisionmaking.
• ADMT includes profiling.
• Businesses must provide pre-use notices, opt-out rights, access rights, and conduct risk assessments when using ADMT for a significant decision.
• A business that uses ADMT for a significant decision prior to January 1, 2027 must be in compliance with the requirements no later than January 1, 2027. A business that uses ADMT on or after January 1, 2027 must be in compliance with the requirements any time it is using ADMT for a significant decision.
• Additional requirements apply to ADMT trained using personal information.
• The regulations clarify that technologies like firewalls and spreadsheets are not ADMT, provided that they do not replace human decisionmaking.

---

On July 24th, the CPPA Board voted unanimously to adopt revised regulations related to the use of Automated Decisionmaking Technology (ADMT). Among other topics, these regulations, address requirements with respect to the use of ADMT in financial or lending services, education opportunities, and employment or independent contractor opportunities or compensation, or healthcare services.

What is Automated Decisionmaking Technology?

ADMT is technology that processes personal information and uses computation to: 

• Replace human decision making, or 
• Substantially replace human decisionmaking (let’s talk about what this means).

What Does "Substantially Replace Human Decisionmaking" Mean?

This occurs when a business uses the technology’s output to make a decision without human involvement. Human involvement requires the human reviewer to:

• Know how to interpret and use the technology’s output to make the decision,
• Review and analyze the output of the technology, and any other information that is relevant to make or change the decision, and
• Have the authority to make or change the decision based on that analysis.

If a business uses the technology’s output to make a decision without satisfying the above criteria, the decision is made without human involvement and such use substantially replaces human decisionmaking – the technology is ADMT.

However, it is important to note that not all technology and not all uses of ADMT subject a business to the ADMT requirements (the requirements found in Article 11 of the Regulations).

A business that uses ADMT to make a significant decision concerning a consumer must comply with the ADMT requirements.

Profiling is ADMT, but What is Profiling?

Profiling means any form of automated processing of personal information to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s intelligence, ability, aptitude, performance at work, economic situation, health, (including mental health), personal preferences, interests, reliability, predispositions, behavior, location, or movements.

And, yes. The regulations expressly clarify that profiling is ADMT.

Is All Profiling Subject to the ADMT Requirements?

No. A business that uses profiling or other ADMT to make a significant decision concerning a consumer must comply with the ADMT requirements – the business must use ADMT to make a significant decision concerning a consumer.

Could a Spreadsheet be ADMT or is AI ADMT?

The regulations define the concept of substantially replacing human decisionmaking and clarify that certain technologies (such as a spreadsheet) are not ADMT, but could be if they replace human decisionmaking.

The regulations do not use the words “artificial intelligence”, but although artificial intelligence can be ADMT, not all AI is ADMT and not all ADMT is AI. In other words, the ADMT requirements do not apply to all AI or all uses AI.

So, When Do ADMT Regulations Apply?

In general, these regulations will apply if there is ADMT and a business uses it to make a significant decision concerning a consumer.
Among others, “significant decisions” include a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services.

The regulations include additional granular detail with respect to the meaning of financial and lending services, housing, and certain opportunities.

By way of example, extension of credit or a loan, and transmitting or exchanging funds are expressly listed.

The regulations also clarify that the concept of employment and independent contracting opportunities or compensation is not limited to hiring decisions, but also includes the allocation or assignment of work, incentive compensation and other items.

What Do the ADMT Regulations Require?

The regulations include additional requirements, but in general a business that uses ADMT to make a significant decision must provide consumers with Pre-use Notice informing the consumer about the businesses’ use of ADMT and the consumer’s right to: (i) opt-out of ADMT and (ii) access ADMT.

1) Pre-Use Notice

The regulations include detailed requirements for the content and form of the Pre-use Notice, including options for consolidated Pre-use Notice in certain circumstances.

Timing

• New personal information: The Pre-use Notice must be provided at or before the point the business collects the consumer’s personal information that the business plans to process using ADMT.
• Existing personal information: If the business has already collected the consumer’s personal information for a different purpose, the business must provide a Pre-use Notice before processing the consumer’s personal information using ADMT for a significant decision.
• A business may provide a Pre-use Notice in the business's Notice at Collection, provided that the Notice at Collection complies with the ADMT requirements: At a high level, provided it is in plain language, made available at the proper time, and includes the required details.

2) Opt-out Right

A business must provide consumers with the ability to opt-out of the use of ADMT to make a significant decision concerning the consumer, unless an exception applies.

The regulations list several narrow exceptions. By way of example, provided the business provides the consumer with a method to appeal the decision to a human reviewer who has the authority to overturn the decision. Additional granular requirements apply to qualify for this exception.

Form

• Businesses that uses ADMT for a significant decision concerning a consumer must provide two or more designated methods for submitting requests to opt-out of ADMT. At least one method must reflect the manner in which the business primarily interacts with the consumers. The regulations include several detailed illustrative examples. The methods must be easy for the consumer to execute, require minimal steps, and comply with other prescribed requirements. A business may not require the creation of an account to submit a request to opt-out of ADMT, or require the provision of additional information beyond what is necessary to direct the business to opt-out the consumer.
• A business must provide a means by which the consumer can confirm that the business has processed their request to opt-out of ADMT.

3) Access Right

Consumers have a right to access ADMT when a business uses ADMT for a significant decision or extensive profiling. The regulations include detailed requirements related to what information a business must provide and how the business must make the right available and respond to consumers.

4) Risk Assessment

• Prior to using ADMT for a significant decision, a business must conduct a risk assessment and document certain items in a risk assessment report. The regulations include detailed requirements for the timing, retention, form and content of the risk assessment report, including a list of operational elements that must be identified, and required submissions to the CPPA.

• The regulations require the business to submit prescribed risk assessment information to the CPPA, including a written certification that the business conducted a risk assessment as set forth in the regulations, with an attestation that the information submitted is true and correct.  
  • The name and business title of the person submitting the risk assessment information must be submitted to the CPPA.

For further clarification on how these regulations impact your business or to discuss how to operationalize potential requirements, contact David Wilson at dwilson@keglerbrown.com.