CCPA CPRA AI Controls Mapping: California ADMT Obligations to Enforcement Points
California finalized its ADMT, risk assessment and cybersecurity audit regulations on 23 September 2025, effective 1 January 2026, with ADMT obligations attaching 1 April 2027. Each obligation lands on a concrete moment in the AI request flow. This maps the CCPA and CPRA duties that bite when a prompt carrying personal information reaches a model, from pre-use notice through opt-out, access and appeal, onto the control and enforcement point that satisfies each, and the evidence produced.
The California Privacy Protection Agency wrote AI rules that describe decisions rather than models. Its regulations on automated decisionmaking technology (ADMT), risk assessments, and cybersecurity audits were approved on 23 September 2025, took effect on 1 January 2026, and impose ADMT obligations from 1 April 2027. The definition turns on function: technology that processes personal information and uses computation to replace or substantially replace human decisionmaking, applied to a significant decision about finances, housing, education, employment, or healthcare.
That framing puts the obligation at the request, which is convenient, because the request is also where a control can sit. California programmes usually stop at a governance policy aligned to the CCPA. What tends to be missing is the mapping from a duty to the control that enforces it where personal information leaves the network. I want to set that out duty by duty.
The control point: one HTTPS request
Every mapping below resolves to an HTTPS POST carrying a context window to a model endpoint. That request is where the consumer's identity is known, where their opt-out state can be read, where the prompt classification is evaluated, and where a decision gets recorded or refused. A control described in a privacy policy documents the duty without enforcing it.
Pre-use notice (ADMT rules, from 1 April 2027)
A business using ADMT for a significant decision must tell consumers before the fact what it is doing and how the technology works. The control is policy versioning bound to the request path, so every AI call records which notice and which policy were in force at that timestamp. The evidence is a per-request record that ties a decision to the disclosure that governed it, which is what turns a published notice into proof of the notice's scope.
Opt-out rights
Consumers may opt out of ADMT for significant decisions. The control is enforcement at the boundary: a request from a consumer who has opted out gets refused or routed to a human path before it reaches the model. The evidence is the refusal record itself. An opt-out honored inside application code with no independent trace is unprovable at audit, which is the practical difference between a preference flag and a control.
Access and the right to the logic
Consumers may request information about the use of ADMT, including its logic and how it applied to them. The control is a per-decision record binding input to output and the applied policy, the same lineage requirement that GDPR Article 22 handling creates. The evidence is decision lineage retrievable by consumer and by timestamp rather than a general description of the system.
Appeal to a human reviewer
Consumers may appeal an ADMT result to a person. The control is a route flag on decisions that must support appeal, plus a linkage between the original decision record, the appeal, and the reviewer's outcome. The evidence is a single chain covering all three, which is exactly what breaks when the AI decision lives in an application log and the appeal lives in a ticketing system.
Risk assessments and reasonable security
Initial risk assessments for ongoing activities are due by 31 December 2027, with submission to the CPPA on 1 April 2028, and cybersecurity audits phase in from 1 April 2028 for businesses over $100 million in 2026 revenue, 1 April 2029 for $50 million to $100 million in 2027 revenue, and 1 April 2030 below that. CCPA section 1798.100(e) requires reasonable security. The control is access governance on the model channel: per-role, per-route policy replacing shared static keys, failing closed on ambiguity. The evidence is a continuous access record rather than a point-in-time attestation.
The mapping at a glance
The breach row
The final row activates only after an incident. CCPA section 1798.150 gives consumers a private right of action for a breach of nonencrypted, nonredacted personal information caused by a failure to maintain reasonable security, with statutory damages of $100 to $750 per consumer per incident. When the AI channel is the exposure path, scoping that class depends on knowing which prompts carried which personal information to which endpoint. The independent per-request record answers it, and it is the same artifact the CCPA audit-evidence view is built around. My frank opinion: the statutory-damages math is what will move California AI logging budgets, well before any CPPA enforcement action does.
DeepInspect
Each row above resolves to an enforcement point, and DeepInspect is that point. It sits inline between your users or agents and the LLM APIs they call, evaluates identity, opt-out state, classification, and policy on every request, enforces per-role and per-route rules, and writes a signed record of the decision before the response returns. The ADMT obligations stop being a set of promises and become a running control with evidence attached.
For a business counting down to 1 April 2027, that means notice, opt-out, access, and appeal each have a per-decision record standing behind them. Book a technical deep dive at deepinspect.ai.
Frequently asked questions
- Which CCPA duties matter most for AI traffic?
The ADMT package does the heaviest lifting: pre-use notice, opt-out, the right to information about the logic, and the right to appeal to a human, all attaching from 1 April 2027. Section 1798.100(e) reasonable security and the section 1798.150 private right of action sit underneath and apply now, along with the risk-assessment duty running through 2027 into the April 2028 submission.
- How does the ADMT definition affect scope?
The definition is functional, covering technology that processes personal information and uses computation to replace or substantially replace human decisionmaking for a significant decision. That excludes advertising and most internal productivity uses, and it captures credit adjudication, tenant screening, admissions, hiring, and clinical triage. Scope decisions therefore turn on what the decision does, not on which model answers.
- Do these controls require modifying the model?
They operate at the HTTP request boundary between the application and the model, so they are model-agnostic and need no retraining. The application continues to supply identity and consumer opt-out context, which is its role in any identity-aware design, while classification, enforcement, and recording happen in the request path.
- What about businesses outside California?
The CCPA applies to businesses that do business in California and meet the revenue, data volume, or data sales thresholds, regardless of where they are headquartered. A company in Austin making significant decisions about California residents through ADMT is inside the rules, so the practical scoping question is where the consumers are.