2027-04-01 · US-CA · 231 days from today

By April 1, 2027, California businesses using automated decision-making (ADMT) for significant decisions must serve pre-use notices, honor consumer opt-outs, respond to access requests about logic and outcomes, and enable appeals of automated decisions.

What it requires

Businesses must provide consumers with notice before using automated decision-making technology for significant decisions. Consumers must be able to opt out. When a consumer requests information about how an automated decision was made or what the outcome was, you must provide that information. Consumers must have a process to appeal or contest automated significant decisions. These requirements apply to any use of ADMT that produces legal or similarly significant effects on consumers.

Who it binds

Any for-profit, nonprofit, or public entity operating in California and covered by the CCPA that deploys automated decision-making technology to make or support significant decisions about consumers. This includes product teams, data teams, compliance officers, and in-house counsel at those organizations. Small businesses and non-CCPA-covered entities are not bound by this deadline.

How to check whether you comply

  • Inventory all systems using algorithms, ML models, or automated logic to make or substantially influence decisions about consumers (credit, employment, eligibility, access).

  • Audit each system for a pre-use notice template, opt-out mechanism, and access-request workflow.

  • Verify that your appeals or contest process is documented and accessible to consumers.

  • Confirm that your legal team or privacy lead has mapped which automated decisions trigger this obligation under the CCPA.

What teams get wrong

This deadline is confirmed. Teams often underestimate scope—'significant decisions' is broad and includes determinations that affect access to services or pricing, not just final go/no-go decisions. Ensure your appeals process is not just theoretical; it must allow meaningful review and reversal.

This is one of 17 dated AI obligations we track

You have 231 days on this one. There are 16 others across the EU, UK, and US, and they do not arrive in a convenient order. The AI Compliance Deadline Radar lists every one of them with a live countdown.

Get The AI Reg Brief — free. Twice a month, three minutes. Every issue leads with a countdown to the next deadline that binds you, so the one about to land finds you rather than the other way round.

Source

Not legal advice. This summarizes a public source so you can act on it; verify against the primary text before you rely on it.