AI governance frameworks: Compare

Binding regulations adopted by the California Privacy Protection Agency, approved on 2025-09-22, enforceable with civil penalties.

Businesses subject to the CCPA; the ADMT rules reach technology that replaces or substantially replaces human decision-making in a significant decision about a California consumer.

Duties fall on the business that uses the technology for the significant decision; there is no separate developer role.

Triggers rather than tiers: significant decisions for the ADMT rights; six processing activities for risk assessments, including selling or sharing personal information.

Risk assessment reports are kept while processing continues or five years, whichever is later; the agency receives counts and an executive attestation.

A documented risk assessment before starting a triggering activity; activities begun before 2026 need one by 2027-12-31.

Human involvement takes a use outside ADMT only if the reviewer can interpret and analyse the output and has authority to change the decision; a human appeal can replace the opt-out.

Pre-use notice (purpose, opt-out, access, how the technology works); opt-out by at least two methods; access requests answered with purpose, logic, outcome and human role.

Part of the CCPA: notice at collection, purpose limits and consumer rights over personal information apply to the data the technology uses.

Separate cybersecurity audit rules apply, phased by revenue from 2028-04-01; no model testing duty was found.

Agency and Attorney General enforcement; administrative fines up to USD 2,663 per violation or 7,988 if intentional or involving minors (2025 adjustment); risk assessment reports on 30 days' request.

Moderate to heavy: notices, opt-out and access processes, documented risk assessments and an executive attestation.

Effective 2026-01-01; ADMT duties for existing uses by 2027-01-01; backlog risk assessments by 2027-12-31; first submission to the agency by 2028-04-01.