Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
Our ADMT and AI Notice Playbook walks through California’s CCPA automated decision-making rules and Colorado’s SB 26-189, both starting January 1, 2027, in nine steps, with a scope decision tree, notice and disclosure templates, a vendor questionnaire, a 7-week countdown and a one-page checklist. Read all 18 pages below.
Compliance Guide · Edition 01The ADMT &
AI Notice
Playbook
How to find, disclose and defend every automated decision your business makes about people, before California and Colorado start enforcing on January 1, 2027.
The playbook
A score is now a decision, and a decision now needs a notice.
On January 1, 2027, two states start regulating the same thing from different angles. California’s CCPA regulations give consumers a right to know about, opt out of, and get an explanation of automated decision-making technology (ADMT) used for significant decisions. Colorado’s SB 26-189 requires notice, a plain-language explanation within 30 days of an adverse decision, a way to correct data, and a chance at human review.
Neither law bans automation. Both require you to say when you use it, explain it when it goes against someone, and put a real person behind it. Most of the work is finding the tools, so we start there.
The 60-second answer
You probably need this guide if software scores, ranks, screens or recommends outcomes for job applicants, employees, borrowers, tenants, patients, students or policyholders in California or Colorado. You probably don’t if your automation only targets ads, fights fraud, or sorts information for a human who makes the call on their own.
This guide is general information, not legal advice. The templates are starting points to review with counsel.
Same start date, different triggers
California asks whether technology replaces human decision-making. Colorado asks whether it materially influences the outcome. Build to whichever is stricter for each step.
| Topic | CA California CCPA ADMT rules | CO Colorado SB 26-189 |
|---|---|---|
| Who it covers | Businesses subject to the CCPA that use ADMT for a significant decision about a California consumer, including employees and applicants. | Developers and deployers of covered ADMT used for consequential decisions about Colorado consumers, employees and applicants. |
| Trigger | Technology that processes personal information and replaces, or substantially replaces, human decision-making. | Technology whose output materially influences a consequential decision, such as by scoring, ranking or classifying. |
| Decisions covered | Financial or lending services, housing, education, employment and compensation, and health care. | Same five, plus insurance and essential government services. |
| Before use | Pre-use notice with purpose, rights, and how the ADMT works. | Clear and conspicuous notice near the point of interaction. |
| Opt-out | Yes, unless a human appeal or a narrow hiring or work-allocation exception applies. | No opt-out right. |
| After a decision | Access right: purpose, logic, result, and how the output was used. | Within 30 days of an adverse decision: description, the ADMT’s role, how to get more information, and rights. |
| Human review | Required for the appeal exception; reviewer must be able to change the decision. | On request after an adverse outcome, to the extent commercially reasonable, plus a way to correct data. |
| Assessments and records | Risk assessment before use; existing processing assessed by Dec 31, 2027; attestation by Apr 1, 2028. | Compliance records kept at least 3 years. No impact assessment required. |
| Enforcement | CalPrivacy and the Attorney General. Per-violation fines adjusted for inflation. | Attorney General only. 60-day cure period until Jan 1, 2030. No private right of action. |
Where they agree
Both exclude advertising. Both protect trade secrets in explanations. Both treat employees and job applicants as covered people. Both start January 1, 2027.
One notice can meet both laws if it includes California’s required contents. One human review process can meet California’s appeal exception and Colorado’s reconsideration right if the reviewer has real authority to change outcomes.
Check your scope
Run each automated tool through these questions. If you reach a red box, that tool needs the rest of this playbook.
California also checks whether you meet CCPA thresholds. Colorado excludes basic tools like spreadsheets and calculators, general chat tools not set up for these decisions, and uses that are incidental, trivial or clerical.
Inventory every automated decision
Most ADMT isn’t labeled AI. It arrives as a feature inside software HR, lending or property teams already use. Ask each department these questions, then fill one row per tool.
Likely in scope
- Résumé screeners, assessment scoring and interview-ranking tools
- Credit, affordability and underwriting models
- Tenant screening scores and rent-eligibility checks
- Shift scheduling or task allocation that sets pay or hours
- Clinical triage, prior-authorization or care-eligibility rules
- Admissions, scholarship or placement scoring
- Insurance pricing and claims triage (Colorado)
Usually out of scope
- Ad targeting and audience building
- Fraud prevention and security tools
- Spell-check, spreadsheets and calculators
- Chatbots that answer questions but don’t decide
- Tools that only summarize files for a human, with no score
- Routine scheduling or clerical routing
Watch for drift. A “summary only” tool that adds a fit score or a recommendation next quarter moves into scope.
| Tool & vendor | Decision | People | States | Output | Human role | Status |
|---|---|---|---|---|---|---|
| HireScore (vendor) | Interview shortlist | Applicants | CA, CO | Score 1–100 | Recruiter sees score, decides | Both |
| RentCheck | Lease approval | Tenants | CO | Pass / refer / fail | Auto-decline under 550 | CO |
| ShiftPlan | Hours & pay | Employees | CA | Assigned shifts | Manager can override | CA |
| Doc Summarizer | Claims intake | Customers | CA, CO | Summary only | Adjuster decides | Out |
Tool names are illustrative. Add columns for data inputs, vendor contact, notice location and the date you last tested the tool.
Test the human in the loop
The single most important question in both laws is what your people actually do with the output. A human who rubber-stamps a score doesn’t take a tool out of scope.
“Substantially replaces” human decision-making
A tool substantially replaces a human when you use its output to make a decision without human involvement. Human involvement counts only if the person:
- Knows how to interpret and use the output
- Reviews and analyzes it with other relevant information
- Has authority to make or change the decision based on that analysis
Miss any one and the tool is ADMT.
“Materially influences” the decision
The output must be a factor that is more than trivial and that affects the outcome, for example by scoring, ranking or classifying people. Human review doesn’t remove a tool from scope here. Instead, it’s one of the remedies you owe after an adverse decision.
Excluded: tools that only summarize or organize information for human review with no score, ranking or recommendation that materially affects the result.
Five questions to ask the people who use each tool
| Question | Red flag answer |
|---|---|
| How often do you go against the tool? | “Almost never.” Ask for override rates by month. |
| What else do you look at before deciding? | “Just the score.” Nothing else is considered. |
| Can you change the outcome without asking anyone? | Overrides need sign-off, or the system won’t allow them. |
| Were you trained on what the output means? | No training records, or training is only on the software’s buttons. |
| Does anyone review applications the tool rejects? | Rejected candidates are never seen by a person. |
Practical takeaway
Document the human role for each tool now: who reviews, what they see, their authority, and their override rate. That record is your scope decision in California and your human-review evidence in Colorado.
Write the pre-use notice
California must include
Where and when
- At or before collection of the information the ADMT will use
- In the channel where you mainly deal with the person (app, portal, email, paper)
- Before reusing data you collected for something else
- Readable, accessible, in the languages you normally use
Colorado adds
A clear and conspicuous notice near the point of interaction, such as a link on the application page. A California-compliant notice will usually satisfy it.
How we use automated tools to review applications
We use [tool name], an automated system, to review applications for [roles]. It looks at the information you give us, such as your work history, skills and answers to screening questions, and gives each application a score from 1 to 100. Our recruiters use that score, along with your application, to decide who moves to an interview.
Your choices. You can ask us not to use this automated review. A recruiter will review your application instead. Opt out of automated application review or email [address].
Want to know more? You can ask how the system was used in your case and what it concluded. Request information about automated review.
We will not treat you differently for using any of these rights. Colorado applicants: if we make a decision that goes against you, we will explain the system’s role within 30 days and tell you how to ask for a person to review it.
If you rely on California’s hiring exception or a human appeal instead of an opt-out, replace “Your choices” with a description of that exception or the appeal process.
One consolidated notice can cover several tools if it includes the required details for each. Put a short version at the point of use and link to the full notice.
“To improve our services” fails California’s specific-purpose test.
A notice only in the privacy policy isn’t at the point of collection.
Say what the tool produces: a score, a rank, a pass or fail.
A cookie banner toggle isn’t an acceptable ADMT opt-out.
A vendor model update can make the notice wrong. Re-check it.
Build the opt-out or the appeal
California gives you a choice for each tool: let people opt out, or qualify for an exception. Pick deliberately, because the exception comes with its own obligations.
Offer an opt-out
Works for any significant decision. You’ll need an alternative process, such as a human reviewer, for everyone who opts out.
Human appeal exception
Works for any significant decision. Let people appeal to a qualified reviewer who can overturn the result, and let them submit information.
Hiring or work-allocation exception
Only for admission, acceptance or hiring, or for allocating work and pay. The tool must work for its purpose and not discriminate unlawfully.
If you offer an opt-out
- At least two methods, one matching how you usually interact with people
- Online: an interactive form reached from a link in the pre-use notice, titled with what the person is opting out of
- A cookie banner is not an acceptable method
- No account required, no verification beyond what’s needed to find the person
- If they opt out before processing, don’t start. If after, stop within 15 business days and tell your vendors
- Wait 12 months before asking them to opt back in
If you use the appeal exception
- Name the reviewer role and train them on what the output means
- The reviewer must be able to change the decision; otherwise the exception fails
- Describe the appeal clearly in the notice and in the decision message
- Let people submit documents or information
- Answer on the CCPA’s request timelines and keep records
Remember
Exceptions remove the opt-out only. The pre-use notice, access right, non-retaliation rule and risk assessment still apply.
Which option fits?
| If your situation is… | Usually choose | Because |
|---|---|---|
| High volume, few complaints | B: human appeal | Only people who disagree go to a person |
| Screening job applicants | C, if testing supports it, or B | The hiring exception avoids a parallel manual process |
| A human already reviews most cases | A: opt-out | The alternative process already exists |
Explain decisions when people ask
When a California consumer asks, explain in plain language:
You can withhold trade secrets and security-sensitive details from the logic and result. Verify identity as for other access requests.
Within 30 calendar days of an adverse consequential decision, send a plain-language disclosure covering the decision, the ADMT’s role, how to get more information about the ADMT and the data used, and the person’s rights. On request, explain how to correct inaccurate data and offer human review and reconsideration to the extent commercially reasonable.
Existing ECOA and FCRA adverse action notices can satisfy overlapping requirements. Watch the Colorado AG’s rules on disclosure content, due by January 1, 2027.
About our decision on your rental application
On [date], we were not able to approve your application for [property].
How automation was involved. We use [tool], an automated screening system that scores applications using credit history, income and rental history. Your score was below our approval threshold, and it was one of the main factors in this decision, along with [other factors].
Get more information. You can ask us for more detail about the system and the information it used about you: [email / link].
Fix incorrect information. If anything we used is wrong, tell us how to correct it: [instructions].
Ask for a person to review. You can request that a member of our team review and reconsider this decision: [how]. We will respond within [timeframe].
Send within 30 calendar days of the decision. Keep a copy for at least three years.
- Name the main factors, in everyday words
- Say whether the output decided the result or was one factor
- Tell people what they can do next, and by when
- Skip model jargon like “weights” and “features”
One process, two laws
Route California access requests and Colorado information requests to the same team and template. The facts you need are the same: inputs, output, how it was used, and who decided.
Design human review that holds up
One workflow can serve California appeals, California opt-outs and Colorado reconsideration requests. The details below are what regulators and plaintiffs will test.
What makes a reviewer “meaningful”
- Real authority to override, written into their role
- Training on what the output means and its known limits
- Access to the underlying information, not just the score
- Enough time per case to actually review it
- Freedom from targets that reward agreeing with the tool
Numbers to watch every quarter
What the tool measures and what it can’t see · its known error patterns · how to weigh new information from the person · when and how to override · how to write the reason down.
Get what you need from vendors
You can’t write an honest notice or explanation without knowing how the tool works. Both laws push information from the companies that build ADMT to the companies that use it.
- Intended uses and known harmful or inappropriate uses
- Categories of training data
- Known limitations
- Instructions for appropriate use and meaningful human review
- Notice of material updates, with records kept 3 years
- Give business customers the facts they need for their own risk assessments
- Support opt-outs: service providers and contractors must stop processing within the same 15 business days
In practice you’ll also need the categories of personal information that drive the output to write your notice.
Questions to send every ADMT vendor this month
| # | Question | Why it matters |
|---|---|---|
| 1 | Which inputs most affect the output, and what does the output mean? | Notice and access contents |
| 2 | Was the tool tested for accuracy and unlawful discrimination? Can we see results? | CA hiring and allocation exceptions |
| 3 | Can you stop processing a person’s data within 15 business days on request? | CA opt-out mechanics |
| 4 | Can you produce a per-person explanation of a specific result? | CA access, CO adverse disclosures |
| 5 | Do you use our applicants’ or customers’ data to train your models? | Risk assessment and notice accuracy |
| 6 | How will you tell us about material model updates? | CO developer duty, re-assessment |
Contract note
Colorado makes contract terms that indemnify a party against its own anti-discrimination violations involving covered ADMT void as against public policy, and splits liability between developers and deployers by relative fault. Review indemnities before renewals.
Keep the evidence
When a regulator calls, the question will be “show me.” Build the binder as you go.
Using ADMT for a significant decision, or training ADMT for one, triggers a CCPA risk assessment. It must cover:
- How the processing works, in operational detail
- Specific benefits (generic purposes don’t count)
- Negative impacts on privacy
- Safeguards you’ll use
- Who contributed, and approval by someone with authority to stop it
Keep assessments while processing continues, or 5 years after, whichever is later.
Developers and deployers keep records showing compliance for at least three years. Colorado dropped the old impact-assessment requirement, but records are what you’ll show the AG to use the 60-day cure period.
The binder, tool by tool
Set a review rhythm
Quarterly
Override rates, request volumes, response times, notice accuracy.
On every model change
Re-check the notice, the scope decision and the risk assessment.
Yearly
Re-run the inventory and confirm each tool still matches its documentation.
Where ADMT shows up, industry by industry
The most common tools we see in each sector, and the first move to make.
Tools: résumé screeners, video interview scoring, assessments, scheduling that sets hours or pay.
First move: decide whether you’ll rely on California’s hiring exception. If so, get the vendor’s accuracy and bias testing in writing.
Tools: credit and affordability models, line-increase engines, collections prioritization.
First move: map your ECOA and FCRA adverse action notices against Colorado’s disclosure, then fill the gaps.
Tools: tenant screening scores, income verification, rent-eligibility rules.
First move: find every auto-decline threshold. Those are the clearest cases of ADMT in both states.
Tools: triage, prior authorization, eligibility and care-management scoring.
First move: confirm which data is HIPAA-covered and which is CCPA-covered. Patient-facing scheduling and outreach tools often fall under the CCPA.
Tools: admissions scoring, placement tests, scholarship ranking, proctoring flags.
First move: Colorado lets FERPA-compliant processes satisfy overlapping duties. Document which ones you rely on.
Tools: pricing and underwriting models, claims triage and fraud-adjacent scoring.
First move: separate true fraud detection (excluded) from claims scoring that affects payouts (covered).
Every sector
Your own workforce counts. HR tools are the most common ADMT we find, and both laws cover employees and job applicants.
Seven weeks to January 1
A realistic plan for a mid-size business starting in mid-November. Assign an owner to each week before you start.
Ready for January 1?
Tick each item only if you can show evidence for it.
Find it
Tell people
Give choices
Explain & review
Prove it
Questions we hear most
Usually not. It counts only if it makes, or materially influences, a decision about jobs, credit, housing, education, health care, insurance (CO) or government services (CO). Colorado expressly excludes chat tools not set up for these decisions.
No. Both laws exclude advertising from the decisions they cover. Other privacy rules on sharing and profiling still apply.
In California, only if that person meets all three human-involvement tests. In Colorado, a human sign-off doesn’t change scope if the tool’s output materially influences the result.
Follow the people, not your offices. Applicants and customers in either state can bring you into scope.
For lending, Colorado lets ECOA and FCRA adverse action notices satisfy overlapping requirements. Add anything they don’t cover, such as the ADMT’s role and the right to human review.
No. Both laws let you withhold trade secrets. You still have to explain, in plain language, what the tool used and how its output affected the decision.
California: per-violation fines under the CCPA, set by CalPrivacy or the Attorney General. Colorado: Attorney General enforcement under the Colorado Consumer Protection Act, with a 60-day cure period available until January 1, 2030.
Glossary
Where this comes from
This guide is based on the text of California’s CCPA regulations on automated decision-making technology, risk assessments and cybersecurity audits (approved in 2025 and effective January 1, 2026, with ADMT duties applying from January 1, 2027), and on Colorado SB 26-189 as signed on May 14, 2026, along with law firm analyses listed here.
The templates are illustrative. Adapt them to your tools, your exceptions and your counsel’s advice. Colorado’s Attorney General is writing rules on adverse-decision disclosures and consumer rights, due by January 1, 2027, which may add detail.
Information is current as of November 2026. This guide is for general information and is not legal advice.
Captain Compliance helps businesses meet privacy laws without slowing down: consent and GPC, website scanning, privacy request handling, vendor and AI risk, and privacy program management.
Read our companion report: The State of Privacy & AI Governance 2026–2027.
Find your automated
decisions before
regulators do.
Captain Compliance helps you inventory AI and automated tools, publish notices, and handle opt-out, access and appeal requests with a record of every step.
Scan & inventory
Find the trackers, tools and vendors touching personal data.
Notices that stay current
Privacy notices and disclosures that update as rules change.
Requests on deadline
Opt-outs, access requests and appeals, tracked and logged.
captaincompliance.com
By Richart Ruddie, Founder & CEO
Not legal advice. Current as of November 2026.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
