AI Governance Under State ADMT Laws: Impact Assessment Requirements Across 14 States

Automated decision-making technology has become central to how businesses operate. Credit decisioning, hiring screening, insurance underwriting, housing applications, healthcare triage — these are no longer processes that rely entirely on human judgment. AI and algorithmic systems now make or heavily influence outcomes that affect people’s fundamental life opportunities.

State legislatures have noticed. As of mid-2026, at least 20 states have enacted comprehensive privacy laws, and within that group, a significant and growing subset impose specific requirements on businesses that use automated decision-making technology (ADMT) for what laws variously call “significant decisions,” “consequential decisions,” or actions producing “legal or similarly significant effects.” The requirements differ by state — some mandate impact assessments, some require pre-use consumer notices, some create opt-out rights, and some require human review. A few require all of the above.

This post maps the current ADMT compliance landscape across the states with the most significant requirements, with particular focus on California, Colorado, and Connecticut, which have the most developed frameworks. It also covers what businesses with operations or customers in multiple states need to do to build a compliant approach before the next wave of compliance deadlines arrives.

Why “Automated Decision-Making Technology” Is the Central Concept

Before diving into specific state requirements, it helps to understand what ADMT actually means under these laws — because the definitions vary, and the variance matters.

At the broadest level, ADMT means any technology that processes personal data and uses computation to replace or substantially replace human decision-making. The California CPPA regulations define ADMT as “any technology that processes personal information and uses computation as a whole or part of a system to make or execute a decision, or to facilitate human decision-making.” Colorado’s new law (SB 26-189) defines it as technology that “processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision.”

The common thread is computational output that influences decisions about people. A rule-based algorithm that automatically denies a credit application without human review is ADMT. A machine learning model that scores job applicants and surfaces a ranked list for a recruiter is ADMT. A recommendation engine that determines which housing listings someone sees is — depending on the state — potentially ADMT for purposes of significant housing decisions.

What distinguishes ADMT regulation from general AI regulation is its focus on decision outputs that affect individual consumers in defined domains. Most state ADMT laws concentrate their requirements on decisions in areas like employment, credit, housing, insurance, education, and healthcare — areas where algorithmic bias and opacity have caused documented harm and where regulated industries often have parallel federal obligations.

California: The Most Developed ADMT Regulatory Framework

California’s ADMT obligations under the CCPA/CPRA regulations — finalized by the California Privacy Protection Agency (CPPA) in September 2025 and effective January 1, 2026 — represent the most detailed ADMT compliance framework currently in effect in the United States.

What Triggers California’s ADMT Requirements?

California’s ADMT rules apply to businesses that use ADMT to make “significant decisions” about California residents. “Significant decisions” is a defined term covering decisions that produce legal or similarly significant effects in the following areas: finances, housing, education, employment, healthcare, insurance access, and access to essential services.

Critically, advertising and marketing were explicitly removed from the final definition of “significant decisions.” After extended debate during the rulemaking process, the CPPA determined that behavioral advertising does not qualify as a “significant decision” for purposes of the ADMT access and opt-out rights. This is a major carveout for the adtech industry — though separate obligations may apply to profiling for behavioral advertising under other provisions.

Consumer Rights in California

Starting January 1, 2027, businesses using ADMT for significant decisions must:

1. Provide a pre-use notice: Before using ADMT to make a significant decision, the business must provide consumers with notice disclosing that ADMT will be used, what type of ADMT, the decision being made, and how the consumer can exercise their rights.

2. Honor opt-out requests: Consumers may opt out of the use of ADMT for significant decisions. Businesses must offer at least two mechanisms for submitting opt-out requests, one of which must match the primary way the business interacts with the consumer.

3. Provide access to ADMT information: Consumers can request information about how the ADMT works, the categories of personal information used, and how the outputs are used in the decision.

4. Opt-out exceptions: Limited exceptions exist for situations where the business offers a human review and reconsideration process as an alternative. However — and this is important — the exception for human review does not apply to ADMT used for profiling for behavioral advertising. That processing cannot leverage the human review exception to avoid the opt-out requirement.

Impact Assessments and Risk Assessments

California’s regulations also impose risk assessment requirements on businesses engaged in high-risk processing, including using ADMT for significant decisions or training ADMT. Risk assessments must:

• Identify the purpose and categories of personal information processed
• Weigh benefits to the business against risks to consumers (privacy, discrimination, security, financial, deceptive practices)
• Identify and implement measures to mitigate identified risks
• Be reviewed and updated when there is a material change in processing

Businesses subject to risk assessment requirements must have begun compliance on January 1, 2026. Risk assessment documentation must be submitted to the CPPA by April 1, 2028 (for businesses with over $100 million in revenue), April 1, 2029 (for $50–100 million), or April 1, 2030 (under $50 million). The ADMT-specific opt-out and notice requirements apply beginning January 1, 2027.

Colorado: A Scaled-Back But Still Consequential Framework

Colorado’s regulatory journey on AI is instructive. In 2024, Colorado enacted SB 24-205, one of the most ambitious AI laws in the country, imposing comprehensive risk management obligations, algorithmic discrimination duties, mandatory impact assessments, and extensive annual reporting requirements on developers and deployers of high-risk AI. Before it ever took effect, it was repealed and replaced.

In May 2026, Governor Polis signed SB 26-189, which takes effect January 1, 2027. The new law is considerably narrower than its predecessor, but it still imposes meaningful obligations.

Who Is Covered

SB 26-189 applies to deployers and developers of “covered automated decision-making technology” — ADMT that is used to materially influence a “consequential decision” about a consumer. Consequential decisions include determinations affecting employment, credit, housing, insurance, education, health care, and access to essential services.

What Deployers Must Do

Deployers of covered ADMT must provide consumers with:

• Clear and conspicuous notice at the point of interaction disclosing that ADMT is being used in a consequential decision
• A plain language explanation within 30 days after a covered ADMT makes a consequential decision resulting in an adverse outcome — explaining how the ADMT functioned and the basis for the adverse outcome
• Meaningful human review: consumers have the right to request human review and reconsideration following an adverse outcome from covered ADMT

What Developers Must Provide to Deployers

Developers of covered ADMT must provide deployers with technical documentation covering:

• Intended uses
• Categories of training data
• Known limitations
• Instructions for appropriate use and human review

This documentation obligation is designed to address a real gap in the current market: deployers often do not have adequate information about how the systems they deploy actually work or what their known failure modes are. SB 26-189 tries to push that information upstream from developers to deployers.

What Was Eliminated Compared to the Old Law

The original Colorado AI Act required duty of care to avoid algorithmic discrimination, mandatory risk management programs, impact assessments, annual reviews, and reporting to the Attorney General. The new law eliminates all of those. Colorado’s legislature made a deliberate choice to prioritize transparency and consumer disclosure over proactive risk management — a significant retreat from the original framework.

Connecticut: The Most Comprehensive New Framework of 2026

Connecticut’s AI Responsibility and Transparency Act (CART Act), signed May 29, 2026, is one of the most comprehensive state AI laws enacted to date. It covers ADMT, chatbots, synthetic media, and employment AI. The ADMT provisions are phased in between August 2026 and January 2028 depending on the specific requirement.

Impact Assessments

Starting August 1, 2026, amendments to the Connecticut Data Privacy Act (CTDPA) require any controller that engages in profiling for the purposes of making a decision that produces a legal or similarly significant effect concerning a consumer to conduct a dedicated “impact assessment” for that profiling. This is a separate requirement from the CTDPA’s existing data protection assessment obligations.

The impact assessment must evaluate the benefits of the profiling, the risks to the consumer (including discrimination, manipulation, and privacy violations), the measures taken to mitigate those risks, and whether the processing is necessary and proportionate to the stated purpose.

Notice and Transparency Requirements

Deployers must provide notice to individuals when AI systems are used to make or substantially inform consequential decisions in employment, education, financial services, housing, insurance, and healthcare. The notice must disclose the use of the technology, its purpose, and the consumer’s rights.

Employment AI Obligations

Beginning October 1, 2027, Connecticut employers using automated employment-related decision technology must:

• Disclose to each employee or applicant that the technology is being used
• Before an employment-related decision is made, provide written notice disclosing the technology’s purpose, trade name, categories and sources of personal data analyzed, and deployer contact information
• Provide candidates and employees the right to appeal to a human reviewer

State Agency Obligations

State agencies must inventory AI systems and conduct impact assessments before deploying AI that affects public benefits or individual rights. This government-side obligation is unusual among state AI laws and reflects Connecticut’s broader approach of treating AI governance as a public sector obligation as well.

Virginia, Montana, and the Comprehensive Privacy Law States

Twenty states now have comprehensive privacy laws in effect as of 2026. Most of these laws include opt-out rights for automated decision-making that produces “legal or similarly significant effects” — a standard borrowed from GDPR. The states with these provisions include California, Colorado, Connecticut, Virginia, Texas, Montana, New Hampshire, Oregon, New Jersey, Delaware, Minnesota, Maryland, Nebraska, Iowa, Indiana, Kentucky, Rhode Island, Tennessee, Utah, and Washington.

The specifics vary:

Virginia (VCDPA): Virginia requires businesses to allow consumers to opt out of automated decision-making used for significant decisions. Virginia does not require impact assessments for ADMT specifically, though it does require general data protection assessments for processing involving significant risk.

Montana: Montana amended its Consumer Privacy law effective October 1, 2025 to remove the “solely” qualifier from automated decision-making opt-outs. This is significant: where many state laws only grant opt-out rights for decisions made “solely” by automated means (with no human involvement), Montana now covers decisions where AI substantially influences but does not entirely replace human judgment. This is a broader protection.

Texas (TRAIGA): The Texas Responsible AI Governance Act, effective January 1, 2026, does not directly mandate ADMT impact assessments but does prohibit AI systems used for behavioral manipulation and discrimination. The Texas Artificial Intelligence Council oversees AI governance in the state, and employers and businesses using AI in consequential decisions face obligations under Texas’s existing privacy law (TDPSA).

New Hampshire: New Hampshire’s privacy law (effective January 1, 2025) includes automated decision-making opt-out rights and recognizes Global Privacy Control signals, meaning businesses must honor GPC browser settings as opt-out requests — a technical implementation obligation that goes beyond simple policy disclosure.

Delaware: Delaware’s privacy law includes opt-out rights for ADMT profiling that produces significant effects, and Delaware has also established an agentic AI regulatory sandbox for testing novel AI deployments under regulatory supervision — a distinctive approach among states.

Oregon: Oregon’s privacy law includes opt-out rights for ADMT and applies to businesses processing data of a lower threshold of Oregon residents than California’s law, meaning smaller businesses are covered in Oregon.

Minnesota and Maryland: Both states enacted comprehensive privacy laws in 2024–2025 that include ADMT opt-out provisions and data protection assessment requirements for high-risk processing. Maryland’s law, which took effect October 1, 2025, is notable for its prohibition on certain data sales and its broad sensitive data protections.

The Common Architecture Across State ADMT Laws

Despite variations, most state ADMT laws share a recognizable architecture. Understanding the common elements helps businesses build compliance programs that work across jurisdictions.

Element 1: Covered Decisions
Every law focuses on decisions in specific high-stakes domains: employment, credit/financial services, housing, education, insurance, healthcare, and access to essential services. Advertising and marketing are generally excluded from ADMT “significant decision” requirements (with some nuance in behavioral advertising profiling).

Element 2: Pre-Use or Point-of-Interaction Notice
Consumers generally must be told before or when ADMT is used in a covered decision. The content of the required notice varies but typically covers: that ADMT is being used, the type of ADMT, the categories of data being processed, and how to exercise rights.

Element 3: Opt-Out Rights (with Exceptions)
Most laws give consumers the right to opt out of ADMT for significant decisions, with exceptions for situations where human review is offered as an alternative (California, Colorado) or where the processing is necessary and proportionate (Connecticut). Business must implement at least one accessible opt-out mechanism.

Element 4: Adverse Outcome Explanation
Colorado and Connecticut both require that when a consumer receives an adverse outcome from covered ADMT, they must receive an explanation — in plain language — of how the system worked and the basis for the adverse result. This 30-day explanation requirement is a practical compliance obligation for deployers.

Element 5: Human Review Rights
Multiple states give consumers the right to request human review of a decision made by or with ADMT. This right cannot simply be “honored” by rubber-stamping the AI’s output — it requires a genuinely independent human reviewer with authority to reach a different conclusion.

Element 6: Impact Assessments / Risk Assessments
California and Connecticut both require formal documented assessments of ADMT-related risks before deployment. These assessments must identify benefits and harms, weigh them against each other, and document risk mitigation measures. They are not one-time exercises — assessments must be updated when processing changes materially.

2026 Compliance Roadmap for Businesses Using ADMT

If your business uses AI or algorithmic systems to make or influence decisions about customers, employees, or applicants in any of the covered states, here is the compliance sequence to work through:

Step 1: ADMT Inventory (Now)
Map every AI or algorithmic system you use that generates outputs used in decisions affecting consumers in the categories covered by state ADMT laws: employment, credit, housing, insurance, education, healthcare, and essential services. For each system, identify: the states in which affected consumers are located, whether the decision qualifies as “significant” or “consequential” under the applicable state laws, and whether the system replaces, substantially replaces, or merely assists human decision-making.

Step 2: Risk / Impact Assessments (California: Now; Connecticut: August 2026)
For each covered ADMT system, conduct and document a risk assessment. California’s requirement is already in effect for risk assessments; ADMT-specific assessments are due by January 1, 2027. Connecticut’s impact assessment requirement for ADMT profiling applies starting August 1, 2026. Do not wait until the last minute — these assessments require meaningful internal analysis, not checkbox compliance.

Step 3: Consumer Notice Infrastructure (California, Colorado, Connecticut: Q3–Q4 2026)
Design and implement consumer notice systems for each covered jurisdiction. For businesses with California consumers, notices must be in place before January 1, 2027. For Colorado, notices must be in place before January 1, 2027. For Connecticut, notice requirements begin October 2026 for some provisions and later for others.

Step 4: Opt-Out Mechanisms (Multiple States: Q3–Q4 2026)
Implement opt-out mechanisms for ADMT used in significant decisions. In California, at least two mechanisms are required, one matching the primary consumer interaction channel. Honor GPC signals for states (including New Hampshire and Rhode Island) that require automatic recognition of universal opt-out signals.

Step 5: Human Review Process (California, Colorado, Connecticut)
Build a meaningful human review process for consumers who exercise their right to reconsideration after an adverse ADMT decision. The human reviewer must have genuine authority to override the system’s output. Document the review process and train the people conducting reviews.

Step 6: Adverse Outcome Explanation Process (Colorado, Connecticut)
Build a 30-day workflow for generating plain language explanations when covered ADMT produces adverse outcomes for consumers. This requires internal documentation of how each covered ADMT system works, what data it uses, and what factors drive its outputs.

Step 7: Developer Documentation (Colorado)
If your company develops rather than deploys covered ADMT, ensure your documentation packages for deployers include intended uses, training data categories, known limitations, and appropriate use instructions.

What Multi-State Businesses Should Know

Businesses operating in multiple states face a compliance patchwork that is genuinely complex. The core advice is straightforward: build to the most demanding standard in each category.

For risk assessments, that means California’s framework — begin now and document thoroughly. For notice, that means Colorado and Connecticut’s point-of-interaction standard. For human review, that means genuine review authority, not pro forma sign-off. For opt-out signals, that means universal opt-out recognition for states that require GPC compliance.

The patchwork will continue to evolve. Several additional states are considering ADMT legislation in their 2026–2027 legislative sessions. Building a compliance infrastructure around the common elements of state ADMT laws — inventory, assessment, notice, opt-out, human review, explanation — positions your business to adapt as the regulatory landscape continues to shift.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.