California: automated decisions regulated from 2027

From 1 January 2027, any business subject to California’s privacy law (CCPA) that hands a “significant decision” to automated decision-making technology will have to announce it, offer a right to opt out and a right of access. These obligations come from regulations adopted on 24 July 2025 by the California regulator (United States (California) · CPPA, known as CalPrivacy since November 2025), approved on 22 September 2025 by the Office of Administrative Law (United States (California) · OAL) and in force since 1 January 2026. The text runs to 127 pages. The phrase “artificial intelligence” does not appear in it once.

First lesson: California is not regulating a technology, it is regulating decisions. What matters is not the algorithm, but the real power left to the human.

What is already settled

• Three regimes in one text (United States (California) · CPPA): automated decision-making technology (ADMT), risk assessments and cybersecurity audits, in force since 1 January 2026, with deadlines staggered until 2030.
• A definition built around the human (United States (California) · CPPA): it covers any technology that processes personal information to replace, or substantially replace, human decision-making. A human only counts if they know how to interpret the output, analyse it with other relevant information and can change the decision.
• Five areas of significant decisions (United States (California) · CPPA): financial and lending services, housing, education, employment and compensation, including for independent contractors, and healthcare services.
• A risk assessment before any new high-risk processing (United States (California) · CPPA): since 1 January 2026, before selling or sharing data, processing sensitive data, deciding through ADMT or training such a tool, or inferring the abilities or behaviour of employees, applicants or students through systematic observation.
• Employees are covered (United States (California) · CalPrivacy): unlike other states, the CCPA protects employees, job applicants and contractors. On 21 July 2026, the audits division set up in February launched its first sectoral audit, of ride-hailing, delivery and task-based gig platforms. Its chief auditor put it plainly: “You cannot contest a decision made by an algorithm without the underlying data.”
• Penalties are rising (United States (California) · Attorney General): on 8 May 2026, General Motors agreed to pay USD 12.75 million for selling driving and location data, the largest CCPA penalty to date.

What comes next

• 1 January 2027 — automated decisions (United States (California) · CPPA): any business already using ADMT for a significant decision must comply: a pre-use notice stating the exact purpose, a right to opt out, a right of access to the tool’s logic and to the outcome.
• 1 July 2027 — human review at work (United States (California) · State Senate): SB 947, signed by the Governor on 30 September 2026, will bar employers from disciplining or dismissing a worker solely on the strength of an automated system; a human will have to corroborate the output.
• 31 December 2027 — existing processing: high-risk processing started before 2026 and still running must have been assessed.
• 1 April 2028 — submission to the agency: for 2026 and 2027 assessments, a member of executive management submits a summary and attests to its accuracy under penalty of perjury.
• 1 April 2028, 2029 or 2030 — first cybersecurity audit: it applies to businesses that derive at least half their revenue from selling or sharing data, or that exceed the revenue threshold and process the data of 250,000 consumers or the sensitive data of 50,000. The first report is due in 2028 above USD 100 million in revenue, in 2029 between 50 and 100 million, and in 2030 below that.

The real issue: proving that the human decides

For a European company, the ground looks familiar. The GDPR already governs decisions based solely on automated processing (EU · GDPR, Article 22) and requires impact assessments (Article 35). California differs on three points.

First, it sets precise criteria for human involvement. A reviewer who signs off without being able to read the output, or without the power to change it, does not count. A token human sign-off pushes the decision into the ADMT regime. Second, it requires a right to opt out, subject to exceptions, the main one being an appeal to a human with authority to overturn the decision. Third, it demands named accountability: a summary of assessments submitted to the agency, and cybersecurity audits certified by an executive.

Administrative fines can reach USD 7,988 per intentional violation since 2025. The CCPA’s revenue threshold has been set at USD 26.625 million since the same date. These amounts are adjusted for inflation in January of odd-numbered years, so new figures are expected in January 2027.

Three points of vigilance

1. HR tools are in the front line. Recruitment, rating, work allocation, pay: a European group hiring or employing in California with a screening or scoring tool is in scope. An opt-out exception exists for hiring, if the tool is used solely to assess ability to perform the job and does not discriminate unlawfully. That still has to be demonstrated.

2. A personal signature. The attestation of assessments and the audit certification must come from a member of executive management directly responsible for the subject. It is not a formality for the legal team.

3. A truly independent auditor. The auditor may be internal, but must not have designed, prepared or recommended what they audit. The standards cited include those of the AICPA, ISACA or ISO.

What a European company with Californian customers should do

1. Check whether it is a “business” under the CCPA: activity in California and, among other criteria, annual revenue above USD 26.625 million (a threshold due to be adjusted in January 2027).
2. Inventory significant decisions made or prepared by a tool: credit, housing, education, employment, health, including at suppliers.
3. Requalify every human sign-off against the three conditions: ability to interpret, analysis, power to change. If one is missing, prepare the pre-use notice and the opt-out, or an appeal to an empowered human.
4. Start from GDPR impact assessments: the regulations allow an assessment prepared for another framework to be reused if it contains the required information. Fill the gaps.
5. Plan the assessments: before any new high-risk processing, before the end of 2027 for existing processing, and name now the executive who will attest by 1 April 2028.
6. Place the business on the audit timetable according to its revenue, and choose an independent auditor.
7. Require tool vendors to provide the purpose, logic and parameters needed to answer access requests on time.

In California, a human in the loop only counts if they can change the decision.

The question to ask on Monday morning

To your HR director and your data protection officer: “Which decisions about Californians, from hiring to credit, are made by a tool that no human can really overrule?”