CCPA CPRA AI Audit Evidence: What the CPPA Expects Once the ADMT Rules Bite

California now has an operational deadline for AI evidence. The California Privacy Protection Agency's regulations on automated decisionmaking technology (ADMT), risk assessments, and cybersecurity audits were approved on 23 September 2025 and took effect on 1 January 2026. ADMT obligations attach from 1 April 2027. Initial risk assessments covering ongoing activities must be complete by 31 December 2027, with the first submission to the CPPA due 1 April 2028.

The regulations define ADMT narrowly: technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. The trigger is a "significant decision," meaning one that provides or denies financial or lending services, housing, education enrollment or opportunity, employment or independent contracting, or healthcare services. Advertising sits outside. I want to walk the evidence artifacts a CPPA review expects, because California programmes tend to hold the ADMT answer in a vendor questionnaire rather than a log.

The pre-use notice record

From 1 April 2027, a business using ADMT for a significant decision must give consumers a pre-use notice describing the intended use and how the technology works. The evidence that the notice was live at the moment of the decision is a per-request record stamping which policy version applied when the call was made. A screenshot of a notice page proves the page existed. It says nothing about which decisions ran under it.

The artifact that survives scrutiny binds a named identity to the specific prompt, the model that answered, and the notice and policy state in force at that timestamp.

The opt-out record

Consumers get the right to opt out of ADMT for significant decisions. Honoring an opt-out is an enforcement decision, and proving you honored it is a per-request record showing the request was refused or routed to a human path. Most deployments cannot show this, because the application checks a preference flag internally and then calls the model with a shared service credential, leaving no independent trace of the refusal.

An opt-out that produces no record is indistinguishable, in an audit, from an opt-out that was ignored.

The access-and-logic record

The rules give consumers a right to request information about the business's use of ADMT, including the logic of the technology and how it applied to them. Answering that request needs decision lineage: the input, the output, and the policy applied at the moment of the decision. This is the same evidence burden that GDPR Article 22 automated decisions creates in Europe, and it is the reason a model card explains the system without explaining the decision the consumer is contesting.

The appeal record

A consumer may appeal an ADMT result to a human reviewer. The evidence is a record showing the original decision, the appeal, and the human review that followed, linked as one chain. Sixteen months out from 1 April 2027, the piece most often missing is the link: the original AI decision lives in an application log, the appeal lives in a ticketing system, and nothing binds them to the same request.

The risk-assessment and security record

Businesses conducting risk assessments in 2026 and 2027 must submit by 1 April 2028, and cybersecurity audits phase in from 1 April 2028 for businesses with over $100 million in 2026 revenue, 1 April 2029 for $50 million to $100 million in 2027 revenue, and 1 April 2030 below that. CCPA section 1798.100(e) requires reasonable security for the personal information a business collects. Shared static API keys undermine that by granting permanent full model access to any caller. Per-role, per-route enforcement at the request boundary produces the access record the audit reaches for, generated by enforcement rather than assembled after the fact.

Why self-written application logs fail

A system that makes the AI call and also writes its own compliance log is attesting to itself. That record breaks under selective logging, under suppression by the same system, and under crash-loss when the process dies after the model responds but before the commit. I argued this in You Own the AI Liability, Not the Vendor.

My candid view: the ADMT rules are the first American regime that makes the self-attestation problem expensive, and the 1 April 2027 date is closer than most California programmes are treating it.

DeepInspect

This is the evidence layer CCPA-bound AI programmes usually lack. DeepInspect sits inline between your users or agents and the LLM APIs they call. For every request it evaluates identity, data classification, and policy, then writes a signed, tamper-evident record before the response returns. That record holds the caller, the classification in the prompt, the model endpoint, the notice and policy version in force, the decision applied, and the response.

When the CPPA asks which significant decisions ran through ADMT, whether opt-outs were honored, and what logic applied to a specific consumer, the answer is a query against records the application never controlled. The CCPA controls mapping shows how each obligation lines up with an enforcement point. Book a technical deep dive at deepinspect.ai.