California ADMT for Employers: Notice and Risk Templates

Image: Pexels, used under the Pexels License.

TL;DR: If a CCPA-covered employer uses automated decisionmaking technology (ADMT) to make hiring, pay, promotion or termination decisions about California residents without real human involvement, it needs a pre-use notice and an opt-out (unless an exception applies) by January 1, 2027. Risk assessments for processing that began earlier are due by December 31, 2027, and the first submission to the California Privacy Protection Agency (CPPA) is due by April 1, 2028. Below: what counts as ADMT, a pre-use notice template, the opt-out rules, and a risk assessment template that follows the regulation's own list.

The CPPA Board adopted the ADMT, risk assessment and cybersecurity audit regulations on July 24, 2025. The Office of Administrative Law approved them on September 22, 2025, and they took effect on January 1, 2026. The ADMT article has its own compliance date: a business that already uses ADMT for a significant decision has until January 1, 2027, and a business that starts later must comply from day one.

The CPPA posts its Board meetings on its YouTube channel. This is the agency's own webcast of the July 24, 2025 meeting at which the Board adopted the regulations:

Video: California Privacy Protection Agency, Board meeting webcast, July 24, 2025.

This page gives you the templates, but each one is tied to the regulation text so you can see where every field comes from. We checked every requirement against the CPPA's approved text on October 10, 2026, and corrected several points in our July version (listed at the end).

What counts as ADMT under California law

The regulations define ADMT as "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking" (section 7001). The second half is the part that matters for most HR tools. A tool "substantially" replaces human decisionmaking when "a business uses the technology's output to make a decision without human involvement."

Human involvement has a specific meaning. The reviewer must:

• know how to interpret and use the tool's output to make the decision;
• review and analyze that output plus any other relevant information; and
• have the authority to make or change the decision based on that analysis.

A recruiter who clicks "advance" on whatever the tool ranks highest, without knowing what the score means or without authority to overrule it, probably does not meet that test. A recruiter who reads the full application, understands the score and can overrule it probably does.

ADMT obligations apply only to a "significant decision." For employers, that includes decisions about "employment or independent contracting opportunities or compensation," which the regulation breaks down as:

• hiring;
• allocation or assignment of work, and salary, hourly or per-assignment pay, bonuses and other benefits;
• promotion; and
• demotion, suspension and termination.

Typical hiring tools that can fall inside this, depending on how you use them: resume ranking, automated knock-out questions, video interview scoring and ATS rules that route candidates to reject or advance. The CPPA's own example of a covered use is a business that plans "to videotape job interviews, then use emotion-recognition technology without human involvement" to decide who to hire.

Which California employers must comply

The ADMT rules sit inside the California Consumer Privacy Act, so they apply only to businesses the CCPA covers. According to the CPPA, a for-profit business that does business in California is covered if it meets any one of these thresholds:

• gross annual revenue of $26.625 million or more for the preceding calendar year (the adjusted figure effective January 1, 2025);
• buys, sells or shares the personal information of 100,000 or more California residents or households; or
• derives 50% or more of annual revenue from selling or sharing California residents' personal information.

These dollar figures are not fixed. The CCPA tells the CPPA to adjust them "on January 1 of any odd-numbered year" to reflect any increase in the Consumer Price Index, so the next adjustment is due on January 1, 2027. Check the CPPA's adjustment page after that date before you rely on the $26.625 million figure.

The CPPA says CCPA rights cover California residents, and "it includes California residents that are employees or job applicants." The flip side, as Littler's employer guide puts it: "the CCPA applies only with respect to the personal information of California residents." A Texas company that meets a threshold and screens California applicants is covered for those applicants; its Texas applicants are not. Littler also notes that some data is exempt, for example information covered by HIPAA and, generally, data collected as part of the background check process.

Compliance deadlines, 2026 to 2028

The January 1, 2027 date is the one that changes your application flow, because the pre-use notice and the opt-out link have to live in your careers site or ATS. The April 1, 2028 submission is easy to forget because it falls more than a year later.

Pre-use notice: copy-paste template

The pre-use notice must be presented "at or before the point when the business collects the consumer's personal information that the business plans to process using ADMT" (section 7220). For hiring, that usually means on the job posting or application page, before the applicant submits anything the tool will process. It must be presented the way you primarily interact with the person, so an online application needs an online notice. You may include it in your existing notice at collection, as long as that notice contains everything below.

Screenshot: Text of regulations, sections 7200 and 7220, California Privacy Protection Agency.

The regulation requires the notice to include:

• a plain-language explanation of the specific purpose (not a generic phrase such as "to make a significant decision");
• the right to opt out and how to submit an opt-out request, or, if you rely on an exception, the appeal process or the name of the exception;
• the right to access information about your use of ADMT and how to request it;
• a statement that you will not retaliate against people who exercise their CCPA rights; and
• more detail on how the ADMT works, which can sit behind a layered notice or hyperlink: how it processes personal information and which categories of data affect the output, what output it produces and how that output is used (including whether it is the sole factor and what any human's role is), and the alternative process for people who opt out.

Text in brackets needs your input:

[COMPANY NAME] NOTICE OF AUTOMATED DECISIONMAKING TECHNOLOGY

We use automated decisionmaking technology (ADMT) when we decide [whom to invite to a first interview for the [Job Title] role]. This notice explains how it works and your rights under the California Consumer Privacy Act.

Why we use it: [State the specific purpose. Example: "To rank applications for [Job Title] against the minimum qualifications in the job posting, so that recruiters can contact the applicants who meet them first."]

Your right to opt out: You can opt out of our use of ADMT for this decision. If you opt out, [describe the alternative process. Example: "a recruiter will review your full application against the same posted qualifications, without the ranking score"]. To opt out:

1. Use our online form: [Opt-out of Automated Decisionmaking Technology] (link)
2. Or [second method, for example email [[email protected]] or call [toll-free number]]

You do not need to create an account to opt out. We will confirm when your request has been processed.

[If you rely on an exception instead of offering an opt-out, replace the section above. For the human appeal exception, explain how to appeal to a human reviewer and how to send information in support of the appeal. For any other exception, name it, for example: "We do not offer an opt-out for this use because we use the tool solely to assess ability to perform the job, under section 7221(b)(2)."]

Your right to access information: You can ask us for information about how we used ADMT in a decision about you. To make a request, [describe the method].

No retaliation: We will not retaliate against you for exercising your rights under the CCPA.

How the technology works: [Link to a layered page that explains:]

• [Tool name and vendor], and the categories of your personal information that affect its output, such as [resume text, answers to screening questions];
• the output it produces, such as [a ranking among applicants for this role];
• how we use the output: [for example, "it is one of three factors; a recruiter also reviews X and Y and makes the decision"]; and
• what happens if you opt out: [the alternative process].

Before you publish it, check it with counsel and check every bracket against how the tool is actually configured, not the vendor's marketing description. Littler notes that employers "may incorporate the pre-use notice into existing notices at collection or privacy policies," which saves you a second pop-up in the application flow.

Opt-out rules: what you must offer

The general rule is that people can opt out of ADMT used for a significant decision about them (section 7221). The final text has three exceptions:

1. Human appeal. You offer "a method to appeal the decision to a human reviewer who has the authority to overturn the decision." The reviewer must know how to read the ADMT output, consider what the person sends in, and be able to change the decision.
2. Hiring assessment. You use the ADMT "solely for the business's assessment of the consumer's ability to perform at work" to decide whether to hire, and "the ADMT works for the business's purpose and does not unlawfully discriminate based upon protected characteristics."
3. Work allocation and pay. The same two conditions, for ADMT used solely for allocation or assignment of work or compensation.

Screenshot: Text of regulations, section 7221(b), California Privacy Protection Agency.

As Littler summarizes it, the hiring, pay and work-assignment exceptions apply "only when the ADMT is used solely for one of these decisions and the ADMT is effective and nondiscriminatory." The regulation does not spell out a specific test for that, but its list of risk assessment safeguards includes "policies, procedures, and training to ensure that the business's ADMT works for the business's purpose and does not unlawfully discriminate." If you plan to rely on an exception, keep the evidence in your risk assessment file.

If you do offer an opt-out, the mechanics are specific:

• Two or more methods, and at least one must match how you primarily interact with the person.
• Online businesses must offer "an interactive form accessible via an opt-out link that is provided in the Pre-use Notice." The link title must say what the person is opting out of, such as "Opt-out of Automated Decisionmaking Technology." An email address plus a phone number is not enough on its own if you hire online.
• Other acceptable methods include a toll-free number, a designated email address and in-person or mailed forms. A cookie banner "is not by itself an acceptable method."
• No account creation and no verifiable consumer request. You may ask only for what you need to find the person's record.
• Give people a way to confirm the opt-out was processed.
• After an opt-out, wait at least 12 months before asking the person to consent to that ADMT use again.

Timing: if the opt-out arrives before processing starts, you must not start. If it arrives after processing began, stop "as soon as feasibly possible, but no later than 15 business days from the date the business receives the request," and tell every service provider or contractor processing that data for the ADMT to do the same.

Image: Pexels, used under the Pexels License.

California ADMT risk assessment template

Using ADMT for a significant decision is one of the processing activities that requires a risk assessment before you start (section 7150). So is using automated processing to infer things like ability, aptitude or performance at work from systematic observation of job applicants or employees. The template below follows the items section 7152 says the risk assessment report must document, in the same order.

Two points our earlier version got wrong. First, you do not need a separate assessment for every tool and use: "A business may conduct a single risk assessment for a comparable set of processing activities," meaning similar activities with similar risks (section 7156). Second, the assessment itself is approved by someone with authority to decide whether the processing goes ahead; the executive attestation belongs to the later submission to the CPPA.

CALIFORNIA RISK ASSESSMENT REPORT: ADMT FOR [DECISION]

Business name: ___________________________ Tool(s) and vendor(s): ___________________________ Decision covered: [Hiring / Work allocation and pay / Promotion / Demotion, suspension, termination] Report date: ________ Next scheduled review (at most three years): ________

Section 1: Purpose State the specific purpose. The regulation says the purpose "must not be identified or described in generic terms," and gives "to improve our services" as an example of what fails. Example: "Rank applications for [Job Title] against the posted minimum qualifications so recruiters review qualifying applicants first."

Section 2: Personal information processed List each category, mark any sensitive personal information, and state the minimum personal information needed for the purpose.

• Resume and work history
• Answers to screening questions
• Video or audio interview recordings
• Assessment or test results
• Other: ___________________________

Section 3: Operational elements

• How you collect, use, disclose and retain the information, and its sources (applicant, ATS, third party)
• Retention period for each category, or the criteria you use to set it
• How you interact with the people affected (careers site, app, in person) and why
• Approximate number of people whose information you will process
• What you have told or will tell them, and how (pre-use notice, notice at collection)
• Service providers, contractors or third parties that receive the information, and why
• The logic of the ADMT, including any assumptions or limitations
• The output of the ADMT and how you will use it to make the decision

Section 4: Benefits Name specific benefits to the business, the people affected, other stakeholders and the public. Generic benefits such as "improving our service" do not count.

Section 5: Negative impacts Identify the negative impacts and their sources and causes. The regulation lists examples a business "may consider," including:

• unauthorized access to, or loss of, applicant data;
• discrimination based on protected characteristics that would violate federal or state law;
• impaired control over personal information (for example, too little information to make an informed choice);
• coercion, such as conditioning an application on unnecessary data;
• economic harm, such as losing a job opportunity;
• physical, reputational and psychological harms.

Section 6: Safeguards For each impact, the safeguard you will use, who owns it and how you check it. Examples from the regulation: encryption and access controls, privacy-enhancing technologies, consulting external parties, and policies, procedures and training to make sure the ADMT works for its purpose and does not unlawfully discriminate. Example entry: "Adverse impact review by [role] every [period], comparing selection rates by [groups]. Vendor test documentation on file: [Yes/No, date]."

Section 7: Decision Will we start (or continue) this processing? [Yes / No / Yes with changes listed here]

Section 8: People who provided information Names and roles (legal counsel giving legal advice may be left out).

Section 9: Review and approval Date reviewed and approved: ________ Names and positions of reviewers and approvers: ________ At least one approver must have authority to take part in deciding whether the business will start the processing.

Keeping it current. Review the assessment at least once every three years, and update it within 45 calendar days of a material change, for example a new purpose, more data, or a wave of complaints about the tool. Keep every version "for as long as the processing continues or for five years after the completion of the risk assessment, whichever is later."

Submitting to the CPPA. For assessments conducted in 2026 and 2027, the submission is due by April 1, 2028, through the CPPA website. It is not the full report. It covers your business name and a contact, the period covered, the number of assessments conducted or updated (in total and by activity), whether they involved each listed category of personal information, and an attestation signed "under penalty of perjury." The person submitting must be "a member of the business's executive management team" who is directly responsible for risk-assessment compliance. The CPPA or the Attorney General can demand the full reports at any time, and you then have 30 calendar days to hand them over.

Penalties

The CPPA's inflation-adjusted amounts, effective January 1, 2025, set administrative fines at "not more than $2,663 for each violation or $7,988 for each intentional violation." The CCPA's private right of action covers certain data breaches, not ADMT notices: damages range from $107 to $799 per consumer per incident. Treat these as the ceiling the statute allows, not a prediction of what the CPPA will seek. These are the 2025 amounts. The statute requires the next CPI adjustment of the fines and damages on January 1, 2027, so check the CPPA's adjustment page after that date.

Other California rules on the same tools

The ADMT regulations are not the only California layer:

• FEHA automated-decision system regulations. Akin Gump notes that amendments extending the Fair Employment and Housing Act's anti-discrimination protections to decisions made with automated-decision systems "took effect on October 1, 2025."
• SB 947, the No Robo Bosses Act. Governor Newsom signed SB 947 by Senator Jerry McNerney on September 30, 2026. According to Covington's summary, it "requires human corroboration for ADS-based disciplinary or termination decisions," requires a post-use notice when an employer primarily relies on an automated decision system for such a decision, carries a $500 civil penalty and becomes operative on July 1, 2027. Our SB 947 and SB 951 guide covers it in detail.

For the federal layer, see the EEOC AI hiring guidance checklist. If you hire across several states, the multi-state AI bias audit requirements guide compares the audit rules. The Workday AI lawsuit checklist covers litigation risk around screening tools.

Compliance checklist: California ADMT

• List every tool used in hiring, work allocation and pay, promotion, or demotion, suspension and termination decisions about California residents
• For each, decide whether the output is used without human involvement (reviewer understands the output, reviews it with other information, can change the decision)
• Confirm the business meets a CCPA threshold
• Complete a risk assessment before any new covered use; for uses that started before January 1, 2026, by December 31, 2027
• Record review and approval by someone with authority to decide whether the processing goes ahead
• Publish the pre-use notice at or before collection, by January 1, 2027 for existing uses
• Offer two opt-out methods, including an online form behind an opt-out link if you hire online, or document the exception you rely on and name it in the notice
• Set up a process to stop processing within 15 business days of a late opt-out and to tell your vendors
• Set up the access request process
• Put the April 1, 2028 submission in the compliance calendar, with the executive who will attest
• Check NYC Local Law 144 if you also hire in New York City
• Review FCRA requirements if your tool uses background check data

What people are saying

We searched Reddit (r/humanresources, r/privacy and site-wide) for a discussion of the CPPA's ADMT rules in hiring and did not find one we could quote. We will add one if a real thread appears.

Our take

Three parts of the final text are easy to get wrong if you work from summaries.

The hiring opt-out exception is not a general pass for screening tools. It covers a tool used solely to assess ability to perform the job, and only if it works for that purpose and does not unlawfully discriminate. A tool that also scores "culture fit" or predicts how long someone will stay is harder to fit inside "ability to perform at work," so plan for the opt-out or the human appeal route instead.

The online opt-out form is the requirement most notice templates miss, including our own July version. If people apply on your careers site, an email address and a phone number do not meet the rule on their own.

Last, the pre-use notice now has to coexist with SB 947 from July 1, 2027. If the same tool feeds discipline or termination decisions, you will need the CPPA notice before use and, under SB 947, human corroboration and a notice after use. Build one inventory of tools and decisions and map both laws onto it, rather than running two projects.

How we checked this

We read the CPPA's approved regulation text (sections 7001, 7150 to 7157, 7200, 7220 and 7221), the CPPA's rulemaking page, its CCPA FAQ and its inflation-adjustment page, the CCPA statute text as published by the CPPA (Civil Code section 1798.199.95 on the CPI adjustment), the CPPA's meeting page for July 24, 2025 with its webcast, Littler's April 1, 2026 employer guide, Akin Gump's alert, Covington's summary of the September 2026 California employment laws, and the Governor's September 30, 2026 signing release. That is 10 sources, 6 of them from the CPPA. Every fact on this page has a row with a verbatim quote in our source log.

This review corrected our July version: the late opt-out deadline is 15 business days, not 15 days; the pre-use notice must also describe the access right, and online businesses must offer an opt-out form behind a link, not only email and phone; the hiring exception requires that the tool works for its purpose and does not unlawfully discriminate, not documented anti-bias testing as such; the negative impacts list is examples to consider, not a mandatory list; the risk assessment is approved by someone with authority to decide, while the executive attestation goes with the CPPA submission; the April 1, 2028 submission is a set of counts and categories plus an attestation, not a summary of findings; one assessment can cover similar uses; existing processing has until December 31, 2027 for its assessment; the revenue threshold is $26.625 million and fines are $2,663 and $7,988 after the 2025 adjustment. We removed unsourced claims that the CPPA has named ADMT an enforcement priority for 2027 to 2028, that penalties are counted per applicant, and that plaintiffs' firms are monitoring ADMT compliance. Last reviewed: October 10, 2026.

Related Reading

• Newsom's Sept 30 AI Signings: Who Must Act
• California SB 690 Ends Most CIPA Pen Register Lawsuits: What Survives
• California AB 1898 died in committee: what passed instead
• California SB 947 and SB 951: No Robo Bosses and Worker Displacement Act
• FTC Drops Disparate-Impact Claims: What AI Hiring Tools Still Owe You
• NYC Local Law 144 AI bias audit employer guide
• FCRA AI hiring disclosure requirements 2026
• EEOC AI hiring guidance 2026 employer checklist
• AI governance for HR teams complete guide
• Multi-state AI bias audit requirements 2026
• Workday AI lawsuit HR screening checklist