What does CPPA ADMT, risk-assessment and cybersecurity-audit regulations say about AI in banking?

What are the key points of CPPA ADMT, risk-assessment and cybersecurity-audit regulations?

• 'ADMT' means technology that processes personal information and uses computation to replace or substantially replace human decisionmaking; a human who knows how to interpret the output, actually reviews it and has authority to change the decision takes the process outside the definition
• 'Financial or lending services' — the first-listed significant decision — covers extending credit or a loan, transmitting or exchanging funds, deposit or checking accounts, check cashing and installment payment plans; behavioral advertising was dropped from the final text
• ADMT obligations from January 1, 2027: pre-use notice describing purpose and how the technology works; a right to opt out, which the business may replace with a human-appeal route staffed by a reviewer able to overturn the decision; and an access right to the logic, key parameters, output and its role in the decision
• Risk assessments required before selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, or training ADMT for such use; attestation and summary due to the CPPA by April 1, 2028 for 2026–27 activities, then annually
• Cybersecurity audits for businesses over the size thresholds, certified to the Agency by April 1, 2028 (revenue over $100M), April 1, 2029 ($50–100M) or April 1, 2030 (under $50M), then annually
• The Agency declined to add an entity-level exemption for financial institutions: the CCPA already exempts GLBA- and CalFIPA-covered information at the data level (Civil Code §1798.145(e)), a point the Final Statement of Reasons makes explicit
• Employee, applicant and contractor personal information has been fully inside the CCPA since January 1, 2023, so hiring, promotion and compensation decisions at a bank are squarely covered

What did CPPA ADMT, risk-assessment and cybersecurity-audit regulations change for banks?

California turned its privacy statute into the state's operative AI rule for consequential decisions without passing an AI statute. For banks the practical effect is a two-track programme: GLBA-covered credit and account data are largely outside the ADMT article, while HR screening tools, marketing models, non-GLBA products and any model trained on Californians' non-exempt data need notices, appeal channels, risk assessments and, above the thresholds, audited security by 2028.