California's ADMT Compliance Deadline Is January 1, 2027: What SaaS Vendors Will Be Asked For

If your product helps a customer decide who gets hired, who is approved for a loan, or who gets a housing, education or healthcare decision, that customer may face a California compliance deadline. Under the California Privacy Protection Agency's regulations, a business subject to the CCPA that uses automated decisionmaking technology to make a significant decision before January 1, 2027 must comply with the ADMT notice, opt-out and access requirements no later than January 1, 2027. A business using ADMT for a significant decision on or after that date must comply whenever it uses the technology for that purpose.¹

This post is written for the company whose software sits underneath that decision. Several of the rules assume the vendor's cooperation, and one of them places an obligation directly on a business that makes the technology available to others.

What the rules cover

The regulations define automated decisionmaking technology ("ADMT") as technology that processes personal information and uses computation to replace, or substantially replace, human decisionmaking.² "Substantially replace" means the business uses the technology's output to make the decision without human involvement. Human involvement requires a reviewer who knows how to interpret and use the output, reviews and analyzes it together with any other relevant information, and has the authority to make or change the decision.³

The rules apply when ADMT is used to make a significant decision: one that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services.⁴

Whether a particular customer's use of a particular product meets both definitions is a fact-specific question. The same software can be ADMT in one customer's workflow and not in another's, depending on what a human does with its output.

What your customers will have to do

For a business within the rules, the regulations require:

• A Pre-use Notice, presented prominently and conspicuously at or before the point of collecting the personal information the business plans to process with ADMT. If the information was already collected for a different purpose, the notice must be provided before processing it for the covered ADMT purpose. It must explain the specific purpose in plain language. Generic wording such as "to make a significant decision" is not enough.⁵
• An opt-out, with defined exceptions. One exception applies where the business offers an appeal to a human reviewer who has the authority to overturn the decision. That exception also requires a reviewer who understands and analyzes the ADMT output and relevant information, considers information the consumer submits in support of the appeal, and can change the decision based on that analysis. The business must provide an easy-to-use appeal method and comply with the applicable disclosure, timing and verification requirements. Its Pre-use Notice must explain the appeal right and how to exercise it.⁶
• A right to access information about the business's use of ADMT with respect to the consumer.⁷
• A risk assessment. Using ADMT for a significant decision is one of the processing activities the regulations treat as presenting significant risk to consumers' privacy.⁸ For covered processing initiated on or after January 1, 2026, the assessment must be conducted and documented before processing begins. For processing the business began before January 1, 2026 and continues after that date, the assessment must be conducted and documented no later than December 31, 2027.⁹

Where the vendor comes in

Opt-out requests travel down the chain. When a consumer opts out after processing has begun, the business must stop using the ADMT for that consumer as soon as feasibly possible, and no later than 15 business days after receiving the request. It must also notify its service providers, contractors and others to whom it made the personal information available for that ADMT processing, and instruct them to comply within the same time frame.¹⁰ Our post on AI subprocessors and customer contracts covers how customer commitments can reach the vendors underneath them.

Access requests need the vendor's data. A service provider or contractor must help the business respond to a verifiable request to access ADMT, including by providing, or enabling access to, the personal information it holds under its written contract with the business.¹¹

Certain ADMT providers must supply facts for their customers' risk assessments. A business that makes ADMT available to another business to make a significant decision must give that recipient-business all facts available to it that are necessary for the recipient to conduct its own risk assessment. This applies only to ADMT trained using personal information.¹² Here, "business" means a business subject to the CCPA; selling SaaS does not by itself establish that status. Whether this direct obligation applies to a vendor requires a separate assessment.

Put together, a customer preparing for January 1, 2027 may ask its vendor three practical questions:

1. When we receive an opt-out, can your product stop processing that person through the automated feature within our deadline, and how will you confirm that it has?
2. When we receive an access request, how do we get the information you hold about that person, and how quickly?
3. What can you tell us about how the feature works and how it was built, so that we can complete our risk assessment?

The same questions can appear in security questionnaires and in negotiations over customer contract terms for AI products.

What to review before your customers ask

These are questions to take to your contracts, not conclusions about any particular agreement:

• Your data processing terms. Do they describe how opt-out instructions reach you, and on what timeline? Do they commit you to a response time you can actually meet? Our guide to enterprise SaaS contracts and DPAs covers those terms.
• Assistance obligations. Does the contract already say how you support consumer requests, and does that cover access requests about the automated feature?
• What you will disclose about the model. If your feature is trained using personal information, decide in advance what information you can provide to customers for their risk assessments, and who at your company approves it. Our AI vendor contract questions post covers the same issue from the customer's side.
• Where human review sits. A customer may rely on human involvement or a human-appeal process. Be clear about which parts of that workflow your product supports and which the customer must run.
• Product changes. A change to how the feature works may matter to a customer's notice and risk assessment. Consider how you tell customers about material changes.

What this post does not cover

This post covers the California Privacy Protection Agency's ADMT and risk-assessment regulations only. The customer-facing duties discussed here apply to businesses subject to the CCPA; the vendor provisions depend on the vendor's role and the conditions described above. This post does not determine whether any particular company or processing activity is covered. For the privacy notice side of California law, see our post on California privacy policies. Other laws can also apply to automated decisions, including California's employment regulations on automated-decision systems, discussed in our post on AI in hiring in California and Texas, and other states' AI statutes, discussed in our AI governance guide.

How we can help

Accord & Shield Legal reviews and drafts SaaS agreements, data processing terms and privacy documentation for technology companies in Arizona, California and Texas. To better understand the scope of your matter, you can schedule an initial consultation. The consultation is evaluation-only; no legal advice is provided. Representation begins only after an engagement agreement is signed and any required retainer is received. Please do not send confidential or sensitive documents before we confirm that we can assist.

---

This article is general information, not legal advice. Reading it does not create an attorney-client relationship. Whether and how these regulations apply to your business depends on your specific facts; consult an attorney about your situation.