California’s Draft Regulations on Artificial Intelligence and Automated Decision-Making Technology: What You Need to Know

California’s Proposed Regulations on Artificial Intelligence and Automated Decision-Making Technology: What You Need to Know

In November 2023, the California Privacy Protection Agency (CPPA) released a set of draft regulations on the use of artificial intelligence (AI) and automated decision-making technology (ADMT). These regulations are still in development, but organizations should closely monitor their progress as they could have far-reaching implications beyond California’s borders, given the state’s status as home to many major technology companies.

A recent ruling by a California appeals court allows the CPPA to enforce rules as soon as they are finalized, making it crucial for organizations to stay informed on the evolution of the ADMT rules to ensure compliance when they take effect.

The draft regulations, which are subject to change as the CPPA continues to review public comments, aim to address the use of ADMT under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). The CPRA established the CPPA as a regulatory agency with the authority to issue regulations on consumers’ rights related to automated decisions.

The regulations would apply to for-profit organizations that meet certain criteria, such as annual revenue thresholds or data-sharing practices, and engage in specific uses of AI and ADMT, including making significant decisions, extensive profiling, and training ADMT tools.

The draft rules define ADMT as software or programs that process personal data using computation to execute decisions, replace human decision-making, or facilitate human decision-making. The regulations specify exempt tools and cover uses such as making significant decisions, extensive profiling, and training ADMT.

Key requirements of the draft regulations include issuing pre-use notices to consumers, offering opt-out options for ADMT use, and providing information on how ADMT affects consumers. The rules also outline exemptions for certain uses of ADMT and requirements for risk assessments before using ADMT for significant decisions or profiling.

While the rules are not yet finalized, observers estimate they may take effect in mid-2025 at the earliest. The CPPA will enforce the regulations, with penalties for violations ranging from unintentional to intentional noncompliance.

As the regulations continue to evolve, organizations must stay informed on the latest developments to ensure compliance with California’s new rules on AI and ADMT. These regulations have the potential to shape how AI and automation are regulated nationwide and how consumers are protected in the digital age.