California has no dedicated AI statute for banks — the Automated Decisions Safety Act (AB 1018) was not among the bills sent to the Governor when the Legislature adjourned on August 31, 2026 — but three binding instruments reach them. The California Privacy Protection Agency's regulations on automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits were approved September 22, 2025 and took effect January 1, 2026: businesses using ADMT to make 'significant decisions', a category that lists financial or lending services first, must give pre-use notice, an opt-out or human-appeal route, and an explanation on request from January 1, 2027, with risk-assessment attestations due to the Agency by April 1, 2028 and the first cybersecurity-audit certifications due the same day for businesses over $100 million in revenue. What narrows this for banks is the CCPA's data-level exemption (Civil Code §1798.145(e)): personal information subject to the Gramm-Leach-Bliley Act sits outside the statute, so the rules bite hardest on employment, marketing and non-GLBA data rather than on the credit decision itself. The Civil Rights Council's regulations on automated decision systems in employment (in force since October 1, 2025) and the Attorney General's January 2025 advisory that existing consumer-protection, civil-rights and credit-reporting law already applies to AI complete the picture.
| Full name | California — Privacy Protection Agency (CCPA/CPRA automated decisionmaking, risk-assessment and cybersecurity-audit regulations), Attorney General, and Civil Rights Council |
| Role | State privacy-and-civil-rights regime whose automated decisionmaking rules reach lending, deposit and employment decisions — the most-cited state AI rules after Colorado's |
| Force on banks | Binding law |
| Applies to | Businesses over the CCPA thresholds (about $25 million in annual revenue, inflation-adjusted, or personal information of 100,000+ consumers or households) — including banks, credit unions and lenders for personal information that is not subject to GLBA or the California Financial Information Privacy Act; and, separately, any employer with five or more California employees using automated decision systems in hiring, promotion or pay |
| Key document | CPPA regulations on cybersecurity audits, risk assessments and automated decisionmaking technology (11 CCR §§ 7001, 7120–7124, 7150–7157, 7200–7222; approved Sep 22, 2025, effective Jan 1, 2026; ADMT obligations from Jan 1, 2027) |
| Latest move | Legislature adjourned Aug 31, 2026 with AB 1609 (customer-service chatbots at businesses over $500M revenue) and SB 947 (workplace automated decision systems) on the Governor's desk until Sep 30; AB 1018 did not pass. ADMT obligations for significant decisions apply from Jan 1, 2027 |
| Documents tracked | 4 · all documents → |
The CPPA's 2025 package is the operative text. 'ADMT' is technology that processes personal information and uses computation to replace or substantially replace human decisionmaking — a business that keeps a human reviewer who understands the output, actually reviews it and can change the outcome is not using ADMT in the regulatory sense. A 'significant decision' is one that results in the provision or denial of financial or lending services, housing, education, employment or independent-contracting opportunities, or health-care services; 'financial or lending services' is defined to cover the extension of credit or a loan, transmitting or exchanging funds, deposit or checking accounts, check cashing and installment plans. Where ADMT is used for such a decision the business must give a pre-use notice, honor an opt-out (or instead offer an appeal to a qualified human reviewer), and on request explain the logic, the output and how it was used. Using ADMT for a significant decision also triggers a documented risk assessment before the processing starts.
For a bank the scoping question is the exemption, not the definition. The CCPA exempts personal information that is collected, processed, sold or disclosed subject to the Gramm-Leach-Bliley Act, the California Financial Information Privacy Act or the Farm Credit Act — at the level of the data, not the institution. In its Final Statement of Reasons the Agency declined to add an entity-level financial-institution exemption precisely because the statute already provides a data-level one. At a GLBA-covered lender the application, bureau, account and adverse-action data behind a credit decision is that data, so the ADMT article largely does not reach the credit decision. It does reach employee and applicant data (inside the CCPA since January 1, 2023), prospect and advertising data, non-GLBA product lines, and model-training data; mixed-input models remain the unresolved edge.
Two further instruments matter. The Civil Rights Council's regulations under the Fair Employment and Housing Act, in force since October 1, 2025, make it unlawful for an employer with five or more employees to use an automated decision system that discriminates on a protected basis, treat anti-bias testing as relevant evidence, extend liability to vendors acting as the employer's agent, and require four-year retention of ADS records — directly relevant to bank HR screening tools. The Attorney General's January 13, 2025 legal advisory states that the Unfair Competition Law, False Advertising Law, CCPA, Unruh Civil Rights Act, FEHA and the Consumer Credit Reporting Agencies Act already govern AI, and singles out AI used 'to evaluate consumers' credit risk and guide loan decisions' as a use that must still produce specific adverse-action reasons. California's Department of Financial Protection and Innovation has issued no AI-specific guidance for the institutions it licenses.
What has the California CPPA actually published on AI?
| Date | Document | Status |
|---|---|---|
| Sep 22, 2025 | CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6) | In force |
| Jun 27, 2025 | Civil Rights Council ADS employment regulations — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR) | In force |
| Jan 13, 2025 | California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence | Final |
| Jun 28, 2018 | Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) — California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145) | In force |
| Date | Type | Document / event |
|---|---|---|
| Aug 31, 2026 | Milestone | Legislature adjourns: AB 1018 not passed; chatbot and workplace-ADS bills go to the Governor. The Automated Decisions Safety Act (AB 1018), which would have required pre-deployment bias evaluations of automated decision systems used for consequential decisions including lending, was not among the AI bills sent to the Governor. AB 1609 (customer-service chatbot disclosure and 15-minute human hand-off at businesses over $500 million in revenue) and SB 947 (worker protections for automated decision systems) were; the Governor has until September 30, 2026 to act. |
| Jan 1, 2026 | Milestone | CPPA regulations on ADMT, risk assessments and cybersecurity audits take effect. The package approved by the Office of Administrative Law on September 22, 2025 became operative. ADMT obligations for significant decisions phase in from January 1, 2027; risk-assessment attestations and the first cybersecurity-audit certifications are due April 1, 2028. |
| Sep 22, 2025 | Regulation | CPPA ADMT, risk-assessment and cybersecurity-audit regulations — CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Companies — approved regulation text (11 CCR Division 6). Adopted by the California Privacy Protection Agency board on July 24, 2025, approved by the Office of Administrative Law on September 22, 2025 and operative January 1, 2026, this package adds three articles to the CCPA regulations: annual cybersecurity audits (Article 9), risk assessments (Article 10) and automated decisionmaking technology (Article 11). source ↗ |
| Jun 27, 2025 | Regulation | Civil Rights Council ADS employment regulations — Modifications to Employment Regulations Regarding Automated-Decision Systems (Fair Employment and Housing Act regulations, 2 CCR). Approved by the Office of Administrative Law and filed June 27, 2025, and in force since October 1, 2025, the Civil Rights Council's regulations state that using an automated-decision system that discriminates against applicants or employees on a basis protected by the Fair Employment and Housing Act is unlawful. source ↗ |
| Jan 13, 2025 | Guidance | California AG legal advisory on AI (Jan 2025) — Legal Advisory: Application of Existing California Laws to Artificial Intelligence. On January 13, 2025 Attorney General Rob Bonta issued a legal advisory stating that California's existing laws already govern the development and use of AI. source ↗ |
| Jun 28, 2018 | Statute | Cal. Civ. Code §1798.145 (CCPA exemptions, incl. GLBA data) — California Consumer Privacy Act — exemptions, including the data-level exemption for information subject to the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act (Civil Code §1798.145). Section 1798.145 of the Civil Code lists what the California Consumer Privacy Act (enacted June 28, 2018, operative January 1, 2020, and amended by the California Privacy Rights Act from January 1, 2023) does not reach. source ↗ |
- Governor's action by Sep 30, 2026 on AB 1609 (customer-service chatbots: no representing a bot as human, clear AI disclosure, a way to reach a human within 15 minutes or by appointment within one business day; $5,000/$10,000 penalties; businesses over $500M revenue) and SB 947 (automated decision systems in employment) — both would reach large banks' customer and HR operations
- Jan 1, 2027: ADMT obligations (pre-use notice, opt-out or human appeal, access explanation) apply to significant decisions; how the CPPA treats mixed GLBA/non-GLBA model inputs, which the Final Statement of Reasons left open
- Apr 1, 2028: risk-assessment attestations and summaries for 2026–27 processing, and the first cybersecurity-audit certifications for businesses over $100M in revenue (Apr 1, 2029 for $50–100M; Apr 1, 2030 below $50M)
- Whether AB 1018 or a successor bias-evaluation bill returns in the 2027 session, and any CPPA enforcement action that tests the data-level GLBA exemption
- Whether the Department of Financial Protection and Innovation issues AI guidance under the California Consumer Financial Protection Law
Do California's ADMT regulations apply to banks?
Only partly. The regulations cover automated decisionmaking technology used for significant decisions, which expressly include financial or lending services. But the CCPA exempts personal information subject to the Gramm-Leach-Bliley Act at the data level (Civil Code §1798.145(e)), so at a GLBA-covered lender the credit decision itself is largely outside the rules. Employment decisions, marketing data, non-GLBA products and model-training data remain inside.
When do California's ADMT rules take effect?
The regulations took effect January 1, 2026. Businesses using ADMT for significant decisions must comply with the notice, opt-out and access requirements from January 1, 2027. Risk-assessment attestations are due to the CPPA by April 1, 2028.
Does California have an AI law like Colorado's ADMT Act?
No. The Automated Decisions Safety Act (AB 1018) did not pass by the August 31, 2026 adjournment. California regulates AI in banking through the CPPA's privacy regulations, the Civil Rights Council's employment ADS rules, and existing consumer-protection and civil-rights law, as the Attorney General's January 2025 advisory set out.
Follow every move these regulators make
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →