California’s automated decision rules arrive January 1. Three months to get ready.

In short: from January 1, 2027, businesses subject to California’s privacy law that use automated decision-making technology to substantially replace human decision-making in significant decisions about consumers must give pre-use notice and honor opt-out and access rights. Colorado’s replacement AI law (subject to pending federal litigation and the Attorney General’s rules) and New York’s frontier-model rules start the same day. Twelve weeks is enough to be ready if the inventory starts now.^1,2

In September 2025 the California Privacy Protection Agency approved regulations on automated decision-making technology, risk assessments and cybersecurity audits. Businesses that use such technology to make significant decisions about consumers, in areas including employment, housing, credit, education and health care, must give pre-use notice and honor opt-out and access rights, with compliance required by January 1, 2027.¹ With less than three months to go, this briefing sets out what to have ready. It is educational, not legal advice.

What the rules ask for

• Pre-use notice: tell people, before the technology is used in a significant decision about them, that it will be and what it does.
• Opt-out: a way to opt out of the automated decision-making, subject to the exceptions in the rules.
• Access: on request, information about how the technology was used in a decision about the person.
• Risk assessments and cybersecurity audits for certain processing, on the schedules set in the regulations.¹

The final rules were narrower than the drafts: the ADMT provisions apply to technology that replaces or substantially replaces human decision-making, not to every tool that informs a decision.¹ The wider package took effect on January 1, 2026, with the ADMT rules from 2027, risk-assessment submissions to the agency starting in 2028 and cybersecurity audits phasing in from 2028.²

January 1, 2027 is a crowded date

• Colorado: SB 26-189, signed in May, takes effect, subject to pending federal litigation and the Attorney General’s implementing rules, requiring notice when automated decision-making technology is used in consequential decisions, explanation after adverse outcomes, and correction and human review.³
• New York: the RAISE Act, as amended in March, applies to large frontier-model developers, with critical safety incidents to be reported within 72 hours.⁴
• Ongoing: Illinois’s notice duty for AI in employment decisions has applied since January 2026, and New York City’s bias-audit rule since 2023.⁵

If you sell the technology

Vendors of hiring, lending, tenancy and similar tools will be asked for help by every customer at once. Prepare one document per product that describes what it does, the information it uses, how its outputs are meant to be reviewed, and how a customer can retrieve the record of a specific decision. Customers will need it for California’s notices and access requests and for Colorado’s explanations; a vendor that has it ready will win renewals that others lose.

What a good pre-use notice says

• That an automated system will be used in the decision, and which decision.
• In plain language, what the system does and the kinds of information it uses.
• How to opt out or request human review where the rules give that right, and what happens next.
• How to ask for information about a decision after it is made.

The most common gap is not the notice itself but the process behind it: a request arrives, and nobody knows which system produced the decision, which version was running, or who can review it. The inventory in week one exists to close that gap.

A twelve-week plan

1. Weeks 1-3: inventory. List every system that makes or materially influences significant decisions about Californians and Coloradans, including vendor tools.
2. Weeks 4-6: design the notices and requests. One pre-use notice template adapted per state; one process for opt-outs, access requests, explanations and human review.
3. Weeks 7-9: assess. Run or update the risk assessment for each in-scope system, and get vendors’ documentation.
4. Weeks 10-12: test and train. Walk a request through end to end, and train the people who will answer them.

Most of the work is shared across the three, and our earlier briefings cover the pieces: the Colorado law in detail, the European case law on explanations that sets a useful benchmark for what a good explanation looks like, and the incident procedure that the frontier rules assume. State AI laws and the automated-decision rules are taught in Module 6 of the AIMP program.

Building one set of capabilities (notice, explanation, review, records) to the strictest rule that applies is far cheaper than building a separate program for each state, and it leaves you ready for the next law on the calendar.