ADMT — Automated Decision-Making Technology — is the term in California Consumer Privacy Act (CCPA) regulations finalised by the California Privacy Protection Agency (CPPA) in 2025-2026 that covers any system using personal data to make or facilitate decisions that produce significant effects on a California consumer. AI agents that make hiring, firing, financial, healthcare, housing, education, or insurance decisions almost always count.

When does ADMT apply?

ADMT applies when (1) the business is subject to CCPA — broadly, businesses with California consumers and certain revenue or data thresholds — AND (2) the agent uses personal information to make or facilitate a decision that produces a "significant effect." Significant-effect categories include financial services, lending, employment, education, housing, healthcare, criminal justice, and access to essential goods/services.

How is ADMT different from the EU AI Act?

Different jurisdictions, similar instinct. EU AI Act classifies systems by risk tier across 27 EU member states; ADMT focuses on consumer rights (notice, opt-out, access) under California law. The EU AI Act is a product-safety regulation; ADMT is a privacy-rights regulation. Both apply if you have California users in the EU, and you should plan compliance around both rather than picking one.

What rights does ADMT give California consumers?

Three main rights: (1) Pre-use notice — before processing, the consumer must be told the agent will be used and what for; (2) Right to opt out of certain ADMT — including profiling for behavioural advertising and certain training uses; (3) Right to access information about ADMT — what the agent decided, what categories of personal information were used, and (in some cases) the logic. Consumers can submit a verifiable request through a designated method.

California ADMT Rules for AI Agents: 2026 Buyer Guide

What counts as ADMT

The CPPA's definition is intentionally broad. An AI agent is ADMT if it:

Uses personal information about a California consumer (which includes B2B contacts, employees, and prospects in 2026);
To make or facilitate (i.e. substantially contribute to) a decision; AND
The decision produces a "significant effect" — financial, employment, education, housing, healthcare, criminal justice, or access to essential goods/services.

The "facilitate" prong is the wide one. An AI agent that drafts the rejection email a human then sends still facilitates the decision — and counts.

Common AI-agent use cases that trigger ADMT

CV-screening / candidate ranking
Lead scoring that determines whether a human salesperson follows up
Credit / loan / insurance underwriting assistance
Fraud-detection scoring with downstream account actions
Tenant screening and housing decisions
Healthcare triage and care-pathway recommendations
Employee monitoring + performance scoring
Customer-tier or risk classification influencing service eligibility

Common AI-agent use cases that don't trigger ADMT:

Internal scheduling / calendar optimisation
Meeting transcription / summarisation
Document classification for routing
Marketing-email drafting (subject to ADMT only when used for behavioural-advertising profiling)
Code generation

The four-step compliance flow

Pre-use notice. Before personal information is processed by the ADMT, give a clear notice — what the agent does, what categories of data it uses, what significant effect it might produce. Notice must be at least as prominent as your privacy policy link and presented at or before collection.
Right to opt out. For some ADMT uses (especially profiling for behavioural advertising and certain forms of training), consumers can opt out. You must offer a verifiable mechanism — typically a webform or an authenticated portal request.
Right to access. Consumers can request: what categories of personal information the ADMT used, the logic involved (in non-trade-secret terms), and the decision the ADMT facilitated about them. Respond within 45 days of the verifiable request.
Risk assessment + audit. Businesses processing ADMT for "extensive profiling" or training certain models must conduct a risk assessment and, in some cases, submit it to the CPPA. The detailed thresholds are in the final regulations published by the CPPA in 2025-2026 — confirm with counsel.

How ADMT, GDPR Art. 22, and the EU AI Act overlap

Concern	California ADMT (CCPA)	GDPR Art. 22	EU AI Act
Jurisdiction	California consumers	EU/UK data subjects	EU users + market
Trigger	"Significant effect" decisions using PI	Solely automated decisions with legal/significant effect	High-risk system classification
Pre-use notice	Required	Implied via Art. 13/14	Required transparency
Opt-out	Required for some uses	Right to object; right not to be subject	Not the same; uses risk-tier obligations
Access to logic	Yes (non-trade-secret)	Yes (meaningful info)	Yes (transparency)
Risk assessment	Required for some ADMT	DPIA when high-risk	Risk-management system for high-risk
Sanction	Up to $7,500 per intentional violation	Up to 4% of global turnover	Up to 7% of global turnover (severe)

If you have California users + EU users (most B2B SaaS): all three apply. Build the higher floor — typically EU AI Act + GDPR — and ADMT obligations slot inside.

Buyer checklist

Map your agent use case to the ADMT definition. Be honest about the "facilitate" prong.
If ADMT applies, draft the pre-use notice. Plain language. Visible at collection.
Build the opt-out mechanism. Tie it to your existing CCPA "Do Not Sell or Share" plumbing.
Document the logic. The agent's decision rules should be explainable in non-technical language and documented separately from the prompt — auditors and regulators will ask.
Set up data-subject-access-request handling specifically for ADMT inquiries — what was decided, what data was used, what logic.
Run the risk assessment if your processing volume or use case crosses CPPA thresholds.
Confirm the agent platform supports your obligations: can it surface the categories of PI used per decision? Can it export a per-consumer decision log?
Renew annually. ADMT regulations will continue to evolve; review your processing inventory at least once per year.

Platform implications

Few AI agent platforms have explicit ADMT support in 2026 — the regulations are too new. What to ask vendors:

Per-decision audit log accessible to the customer
Categories-of-personal-information tagging at the input layer
EU + California regional data residency options
Decision-logic documentation export (not just the prompt)

If the vendor cannot supply these, your in-house obligations grow accordingly. For high-volume ADMT use cases, prefer platforms with the strongest enterprise governance posture — Workato, Voiceflow, Relevance AI, Botpress.