California · CCPA · ADMT
Your lawyer tells you what the rule requires. We build it.
California’s automated decisionmaking rules arrive as a list of tickets rather than a policy memo. A notice that renders before a decision gets made, a way for a person to say no, a log detailed enough to reconstruct why the software decided what it did, and a human with the authority to overturn it.
Most teams have read a law firm summary and filed the whole thing under legal. That is how you end up in October 2026 with eleven weeks left and no plumbing.
What we build
Four rights attach on 1 January 2027. They map onto roughly four pieces of engineering, though not one to one, because the opt-out and the appeal are partly substitutes for each other.
Pre-use notice
A notice that renders before the decision is made, describing how the technology works, what personal information it uses, what it outputs, and what happens on opt-out.
How we approach itOpt out
A path for a person to refuse ADMT processing — or a documented exception plus a human-appeal route good enough to substitute for it.
How we approach itAccess
A decision log detailed enough to answer "why me?" — inputs, output, logic and the reviewer's role, retained and retrievable per person.
How we approach itAppeal
A place for requests to land, and a path to reverse a decision that has already propagated downstream.
How we approach it
Two ways to start
Both are fixed in scope and priced in writing before anything begins. Which one fits depends on whether you are the business making the decisions or the software vendor whose product makes them.
For the business making the decisions
ADMT readiness sprint
Two weeks, fixed scope. We inventory every automated decision that touches the five significant-decision categories, run the reviewer interviews, and hand your counsel a gap list they can sign off against the regulation.
- Decision inventory, traced from outcome back to the system that produced it
- Human-involvement findings for each reviewer role, honestly stated
- Gap list against the notice, opt-out, access and appeal requirements
- An implementation plan with sequencing against the 1 January 2027 date
Then, if you want us to, we build what the plan says. You are free to take the plan to your own team instead.
For SaaS vendors with California customers
ADMT feature pack
If your product scores, ranks, filters or recommends people in hiring, lending, housing, healthcare or education, your California customers will need pre-use notices, opt-out handling and decision logging from your product by January 2027, and their contracts with you will say so. We build those features into your product on a fixed-scope basis.
- Pre-use notice component your customers can configure per decision
- Opt-out and human-review request flows, with the exceptions the rule allows
- Decision log schema and access-request export that can answer "why me?"
- Vendor-contract evidence: the documentation your customers will ask you for
Scoped against your stack and roadmap so your own team keeps shipping the product while the compliance surface gets built alongside it.
How an engagement runs
- 01
Readiness pass
A decisions-first inventory, not a systems-first one. We start from the five significant-decision categories and trace backwards to whatever produces the output, because a systems-first pass misses the spreadsheet in HR every time.
- 02
The reviewer interview
The human-involvement test is a question about working practice, not code. We sit with the people who actually review these outputs and establish, honestly, whether they clear all three parts. This is the cheapest finding available and the one most often assumed rather than checked.
- 03
Build the four things
Pre-use notice, opt-out or a good-enough appeal, a decision log that can answer "why me?", and somewhere for requests to land. Built into your stack, not bolted alongside it.
- 04
Evidence for the filing
The risk assessment is an engineering document wearing a suit. We produce the artifacts your counsel needs to file, rather than leaving them to reverse-engineer it from your codebase.
The five decisions that put you in scope
The list is exhaustive, which narrows the work usefully. Teams routinely over-scope here and burn a quarter inventorying systems the rule never touched — and under-scope, because “employment” is far broader than hiring.
Financial or lending services
Loan or credit approval · Credit limit setting · Insurance underwriting or terms
Housing
Tenant screening or scoring · Rental application approval
Education enrollment or opportunities
Admissions decisions · Programme or course placement
Employment or independent contracting opportunities or compensation
Applicant ranking or screening · Allocation or assignment of work (e.g. which shifts someone gets) · Compensation, including incentive and bonus eligibility · Promotion, discipline or termination
Healthcare services
Care authorisation or hours · Triage or acuity scoring · Coverage determinations
Common questions
No, and you should be wary of an engineering firm that says otherwise. Your counsel decides whether you are covered and which of your decisions count. We build what they tell you that you owe, and we produce the technical evidence they need in order to advise you.
Law firms tell you what the regulation requires. Almost none of them can build a pre-use notice that renders before a decision, a decision log detailed enough to answer an access request, or a path to reverse a decision that has already propagated downstream. That gap between the advice and the working system is the whole of what we do.
It depends far less on your codebase than on how quickly we can get time with the people who run the affected processes. The inventory is slower than the builds for exactly that reason. We scope it against your calendar, not your repo size.
Then we tell you that and stop, and you have found out in 2026 rather than 2028. That is a far cheaper outcome than the alternative, and we would rather say so early than build something nobody needed.
Yes, and it is usually the better arrangement, because your team knows where the decisions actually live. We can embed engineers into your team or take the work end to end. See our staff augmentation and dedicated team options.
Indirectly, and soon. The regulation binds the business using the technology, but it also requires that business to obtain contractual commitments from the vendors whose products make or support the decision. In practice your California customers will ask for pre-use notice support, opt-out handling, decision logging and documentation, and a vendor that cannot supply them becomes the reason a customer fails their own compliance. The feature pack above exists for exactly that situation.
Section 7200(b) requires a business already using ADMT for a significant decision to be in compliance by 1 January 2027. Risk assessments for processing that began before 1 January 2026 must be documented by 31 December 2027 and submitted to the Agency by 1 April 2028.
Start with the cheapest question
Tell us which of the five categories your business touches and we will tell you what a readiness pass would cover and what it would leave alone. If your reviewers genuinely clear the involvement test, that is a much cheaper thing to learn now than in 2028, and we would rather say so early.