California's AI Decision Rules Start Jan. 1: A Founder Checklist

Plenty of Los Angeles startups now sell, or quietly rely on, software that scores people: tools that screen job applicants, approve customers for payment plans, rank rental applicants or route patients. Starting January 1, 2027, California's privacy regulator expects covered businesses that use this kind of technology for important decisions to tell people about it, let them opt out in many cases and explain how it works on request. If your company builds or buys these tools, the next nine weeks are a good time to take inventory.

This is a plain-language overview, not legal advice. Talk to privacy counsel about your specific setup.

What changed, and when

The California Privacy Protection Agency, which now calls itself CalPrivacy, finalized a package of updated regulations under the California Consumer Privacy Act in September 2025. According to the agency's announcement, the rules took effect January 1, 2026, but businesses got extra time for three pieces: cybersecurity audits, risk assessments and requirements for automated decisionmaking technology, or ADMT. Businesses that use ADMT to make significant decisions must comply beginning January 1, 2027.

Does the CCPA even apply to you?

Many early-stage companies are not covered. The agency's applicability checklist says a for-profit business that does business in California and handles consumers' personal information generally has to comply if it meets at least one of these tests:

• Gross annual revenue over $26,625,000 in the previous calendar year.
• Buys, sells or shares the personal information of 100,000 or more consumers or households.
• Derives 50% or more of annual revenue from selling or sharing personal information.

The revenue figure is adjusted for inflation every odd-numbered year, according to the agency's page on monetary thresholds, so check for an update in January. A seed-stage company with a small user base may fall outside all three tests. A consumer app with a large California audience, or a fast-growing company past the revenue line, may not. And if you sell software to larger companies, your customers will likely be asking you to help them comply either way.

What counts as ADMT and a "significant decision"

A Mayer Brown analysis summarizes the definition this way: ADMT is technology that processes personal information and uses computation to replace, or substantially replace, human decision-making. Profiling is included.

The key word is "substantially." Under the regulations as summarized by the firm, a human reviewer keeps a tool out of that category only if the person knows how to interpret the output, actually reviews it along with other relevant information, and has the authority to make or change the decision. A manager who rubber-stamps an algorithm's ranking probably does not meet that bar.

The rules cover significant decisions about providing or denying:

• Financial or lending services, including credit, loans and installment payment plans.
• Housing.
• Education enrollment or opportunities.
• Employment or contractor opportunities and pay, including hiring, work assignment, promotion and termination.
• Healthcare services.

For Los Angeles, that list touches fintech and buy-now-pay-later companies, proptech and tenant screening, edtech, health startups and the many HR and staffing tools used by studios, restaurants and retailers.

What covered businesses must do

Per the Mayer Brown summary, a business using ADMT for a significant decision must give California residents a notice before use, an opportunity to opt out (subject to exceptions) and a right to access information about how the technology was used. Separately, the regulations require risk assessments for higher-risk processing, which includes using automated processing to make significant decisions. For risk assessments conducted in 2026 and 2027, the business must submit information and an attestation to the agency by April 1, 2028.

Small employers: the AI hiring rules already apply

Even if the CCPA does not reach your company, a separate set of rules might. The California Civil Rights Council's regulations on automated-decision systems in employment took effect on October 1, 2025, according to the Civil Rights Department. They make clear that using such a system can violate state anti-discrimination law if it harms applicants or employees based on protected characteristics, and they require employers to keep employment records, including automated-decision data, for at least four years. California's employment discrimination law generally applies to employers with five or more employees, which includes many small LA businesses.

A practical checklist for founders

These steps are our suggestions, not legal requirements:

1. List every tool that scores, ranks, filters or recommends decisions about people, including features inside your HR, payments or CRM software.
2. Map the human role. For each tool, write down who reviews the output and whether they can override it.
3. Check applicability against the CCPA thresholds, and revisit as you grow.
4. Ask vendors what support they will provide for notices, opt-outs and access requests.
5. Draft notices early. Plain-language explanations take longer to write than most teams expect.
6. Keep records. If you use automated tools in hiring, make sure your data retention covers at least four years.

For builders, there is an upside: products that make human review, explanations and opt-outs easy are likely to be easier to sell to California customers in 2027.