California · CCPA · ADMT
Your lawyer tells you what the rule requires. We build it.
California’s automated decisionmaking rules arrive as a list of tickets rather than a policy memo. A notice that renders before a decision gets made, a way for a person to say no, a log detailed enough to reconstruct why the software decided what it did, and a human with the authority to overturn it.
Most teams have read a law firm summary and filed the whole thing under legal. That is how you end up in October 2026 with eleven weeks left and no plumbing.
What we build
Four rights attach on 1 January 2027. They map onto roughly four pieces of engineering, though not one to one, because the opt-out and the appeal are partly substitutes for each other.
Pre-use notice
A notice that renders before the decision is made, describing how the technology works, what personal information it uses, what it outputs, and what happens on opt-out.
How we approach itOpt out
A path for a person to refuse ADMT processing — or a documented exception plus a human-appeal route good enough to substitute for it.
How we approach itAccess
A decision log detailed enough to answer "why me?" — inputs, output, logic and the reviewer's role, retained and retrievable per person.
How we approach itAppeal
A place for requests to land, and a path to reverse a decision that has already propagated downstream.
How we approach it
How an engagement runs
- 01
Readiness pass
A decisions-first inventory, not a systems-first one. We start from the five significant-decision categories and trace backwards to whatever produces the output, because a systems-first pass misses the spreadsheet in HR every time.
- 02
The reviewer interview
The human-involvement test is a question about working practice, not code. We sit with the people who actually review these outputs and establish, honestly, whether they clear all three parts. This is the cheapest finding available and the one most often assumed rather than checked.
- 03
Build the four things
Pre-use notice, opt-out or a good-enough appeal, a decision log that can answer "why me?", and somewhere for requests to land. Built into your stack, not bolted alongside it.
- 04
Evidence for the filing
The risk assessment is an engineering document wearing a suit. We produce the artifacts your counsel needs to file, rather than leaving them to reverse-engineer it from your codebase.
The five decisions that put you in scope
The list is exhaustive, which narrows the work usefully. Teams routinely over-scope here and burn a quarter inventorying systems the rule never touched — and under-scope, because “employment” is far broader than hiring.
Financial or lending services
Loan or credit approval · Credit limit setting · Insurance underwriting or terms
Housing
Tenant screening or scoring · Rental application approval
Education enrollment or opportunities
Admissions decisions · Programme or course placement
Employment or independent contracting opportunities or compensation
Applicant ranking or screening · Allocation or assignment of work (e.g. which shifts someone gets) · Compensation, including incentive and bonus eligibility · Promotion, discipline or termination
Healthcare services
Care authorisation or hours · Triage or acuity scoring · Coverage determinations
Common questions
No, and you should be wary of an engineering firm that says otherwise. Your counsel decides whether you are covered and which of your decisions count. We build what they tell you that you owe, and we produce the technical evidence they need in order to advise you.
Law firms tell you what the regulation requires. Almost none of them can build a pre-use notice that renders before a decision, a decision log detailed enough to answer an access request, or a path to reverse a decision that has already propagated downstream. That gap between the advice and the working system is the whole of what we do.
It depends far less on your codebase than on how quickly we can get time with the people who run the affected processes. The inventory is slower than the builds for exactly that reason. We scope it against your calendar, not your repo size.
Then we tell you that and stop, and you have found out in 2026 rather than 2028. That is a far cheaper outcome than the alternative, and we would rather say so early than build something nobody needed.
Yes, and it is usually the better arrangement, because your team knows where the decisions actually live. We can embed engineers into your team or take the work end to end. See our staff augmentation and dedicated team options.
Section 7200(b) requires a business already using ADMT for a significant decision to be in compliance by 1 January 2027. Risk assessments for processing that began before 1 January 2026 must be documented by 31 December 2027 and submitted to the Agency by 1 April 2028.
Start with the cheapest question
Tell us which of the five categories your business touches and we will tell you what a readiness pass would cover and what it would leave alone. If your reviewers genuinely clear the involvement test, that is a much cheaper thing to learn now than in 2028, and we would rather say so early.