BrokerLumen logo, AI governance for mortgage brokersBrokerLumen logo, AI governance for mortgage brokers

Home / Rules Library / California CPPA ADMT

Mortgage AI Rules Library

California CPPA ADMT rules: automated decisions in lending

Last reviewed: October 28, 2026. General information, not legal advice. Quotes come from the CPPA's approved regulations text (California Code of Regulations, title 11); each is followed by a plain-English line. This page covers only the ADMT rules, not the cybersecurity audit or risk assessment rules in full.

What counts as ADMT

"any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking."Cal. Code Regs., tit. 11, section 7001(e)

In plain English: The rules target tools that make the decision, or make it with little real human involvement, not tools a person merely consults.

Is lending a significant decision?

"“Financial or lending services” means the extension of credit or a loan, transmitting or exchanging funds, the provision of deposit or checking accounts, check cashing, or installment payment plans."Section 7001(ddd)(1)

In plain English: Approving or denying a loan is a significant decision, so ADMT used for it is covered.

Compliance date for existing tools

"must be in compliance with the requirements of this Article no later than January 1, 2027."Section 7200(b)

In plain English: If you already use ADMT for significant decisions, you have until January 1, 2027 to meet the ADMT rules.

Pre-use notice

"A business that uses ADMT as set forth in section 7200, subsection (a), must provide consumers with a Pre-use Notice."Section 7220(a)

In plain English: Before using ADMT for a significant decision, tell consumers how you use it and about their rights to opt out and to access ADMT information. It can sit in your Notice at Collection.

Opt-out and the human appeal exception

"to a human reviewer who has the authority to overturn the decision."Section 7221(b)(1), human appeal exception

In plain English: Consumers generally can opt out of ADMT for significant decisions. You can skip the opt-out if you offer an appeal to a qualified person who can overturn the decision.

Access requests

Under section 7222(a) and (b), consumers can ask a business about its use of ADMT for a significant decision about them, and the business must explain in plain language the specific purpose, the logic of the ADMT and the outcome for the consumer. Plan a way to answer these requests.

Risk assessments

"Using ADMT for a significant decision concerning a consumer."Section 7150(b)(3), in the list of processing that requires a risk assessment

In plain English: Using ADMT for loan decisions also triggers a written risk assessment. For processing that began before January 1, 2026, section 7155(b) sets a December 31, 2027 deadline, and section 7157(a)(1) sets an April 1, 2028 date for submitting risk assessment information to the CPPA.

A California checklist for brokers and lenders

  1. Confirm whether the CCPA applies to your business and which exemptions apply to your loan data.
  2. List tools that make or substantially make credit decisions without real human involvement.
  3. Draft a Pre-use Notice for each covered use.
  4. Choose: offer an ADMT opt-out, or a human appeal by a reviewer who can overturn the decision.
  5. Set up a process to answer ADMT access requests.
  6. Schedule the risk assessment and calendar January 1, 2027, December 31, 2027 and April 1, 2028.

Train your team on human review and disclosures

The $699 AI Team Kit includes the AI Policy Kit, the AI Best Practices Playbook on human review, recordkeeping and disclosures, a 25-slide staff training deck with a facilitator guide and sign-off log, vendor AI scorecards, and a full year of Small Shop portal access with the state AI law tracker. Kits are templates; have counsel confirm your California obligations.

Get the AI Team Kit, $699AI Policy Starter, $99AI Policy Kit, $349Compare kits

Frequently asked questions

When do the CPPA ADMT rules take effect?

The regulations took effect January 1, 2026. A business using ADMT for a significant decision before January 1, 2027 must comply with the ADMT article no later than January 1, 2027.

Is a mortgage decision a significant decision under the CPPA rules?

Significant decisions include those resulting in the provision or denial of financial or lending services, defined to include the extension of credit or a loan.

Do consumers get to opt out of ADMT?

Generally yes for significant decisions, but section 7221(b)(1) gives an exception when the business offers an appeal to a qualified human reviewer who has the authority to overturn the decision.

Does the CCPA apply to mortgage data?

The CCPA statute contains exemptions that may cover some financial data. We have not verified how they apply to your files, so ask counsel.