Appearance
The CCPA ADMT Regulations in Modulos
Modulos has two Frameworks for the CCPA ADMT Regulations, and each has the name CCPA ADMT Regulations. You add MFF-29 to the AI System of one ADMT. You add OFF-29 to the organization AI System, at the Organization level.
These instructions tell you how to use MFF-29 and OFF-29. Here, "you" is the organization that adds the two Frameworks.
Organization AI Systems
Frameworks at the Organization level, such as OFF-29, attach to your organization AI System. The AI Registry shows this AI System with the Type Organization. The AI Registry does not make new organization AI Systems. If your organization does not have one, speak to Modulos before you add a Framework at the Organization level.
AI System structure
Modulos recommends this structure for an organization that uses MFF-29 and OFF-29 for the CCPA ADMT Regulations. The structure is not a rule of the regulations, and you can use a different structure.
- One AI System for each ADMT. Use one AI System with
MFF-29for each ADMT. The regulations do not tell a business to keep the items for each ADMT apart. In § 7220(e), a business is permitted to give one Pre-use Notice for more than one use of ADMT. The notice must then have the Article 11 information for each use. In § 7156(a), a business is permitted to conduct one risk assessment for a "comparable set of processing activities". - No scoping questionnaire.
MFF-29andOFF-29have no scoping questionnaire. You record inMRF-489if the regulations apply to the ADMT (step 1 below). - One organization AI System.
OFF-29has the items that your organization uses for all of its ADMTs. These items are the requests from consumers, human involvement, and the human appeal exception. They are also the risk assessments, the Agency submissions, the notices, the contracts, and the items to monitor.
The CCPA Role tag
In MFF-29 and OFF-29, the Frameworks for the CCPA ADMT Regulations, each Requirement has one or more values of the CCPA Role tag. The tag has four values. Each value is a Modulos name for a "role" in the CCPA or in the regulations. The four names are names in Modulos, not "definitions" of the law.
| CCPA Role value in Modulos | Name in the law | Provision |
|---|---|---|
| Business using ADMT | A business that uses ADMT to make a significant decision about a consumer. In Modulos, the value also applies to a business that processes personal information that it intends to use to train such ADMT. | § 7200(a), § 7150(b)(6), Civil Code § 1798.140(d) |
| Service provider or contractor | A service provider or a contractor | Civil Code § 1798.140(ag) and (j) |
| Third party | A third party | Civil Code § 1798.140(ai) |
| ADMT supplier | A business that makes ADMT available to a different business, the recipient-business, to make a significant decision. § 7153 applies only to "ADMT trained using personal information". | § 7153 |
One Requirement can have more than one value, and your organization can have more than one "role". For the applicable provisions, see Service providers, contractors, and third parties. For the duty of § 7153, see the section on the business that makes ADMT available.
The CCPA Role tag puts the Requirements into groups. Modulos wants a subsequent release to use this tag to set Requirements to Out of scope for a "role" your organization does not have.
The Requirements
MFF-29 and OFF-29 give Requirements for the groups of duties in the CCPA ADMT Regulations. In Modulos, each Requirement gives its sources and its Controls. Each row below gives a Requirement, its provisions, and a link to the law.
For each Requirement below, a provision without "Civil Code" is in California Code of Regulations, Title 11.
MFF-29, at the AI System level:
| Requirement | Provisions | Law |
|---|---|---|
MRF-489 Coverage determination | §§ 7001(e), (ddd), 7002, 7150(b), 7155, 7200, 7271(a). Civil Code §§ 1798.140(d), (i), (v), 1798.145, 1798.146 | Who must comply |
MRF-490 Pre-use Notice | §§ 7003, 7010, 7011, 7012, 7200, 7220 | Pre-use Notice |
MRF-491 Opt-out of ADMT | §§ 7001, 7004, 7060, 7063, 7080, 7200, 7221. Civil Code § 1798.125 | Opt-out of ADMT |
MRF-492 Human-appeal route | §§ 7001, 7003, 7004, 7021, 7060, 7080, 7200, 7220, 7221. Civil Code §§ 1798.140(ak), 1798.145(h) | The human appeal exception |
MRF-493 Hiring and work-allocation exceptions | §§ 7001, 7152, 7220, 7221 | The exceptions in section 7221(b)(2) and (b)(3) |
MRF-494 Access to ADMT | §§ 7021, 7060–7062, 7080, 7222. Civil Code §§ 1798.140(ak), 1798.145(h) | Access to ADMT |
MRF-495 Risk assessment for the ADMT | §§ 7001, 7150–7156 | Risk assessments and Agency submissions |
MRF-496 Service providers, third parties and ADMT suppliers | §§ 7050–7053, 7153, 7221, 7222. Civil Code §§ 1798.100(d), 1798.140(j)(2), (ag)(2), 1798.145(i) | Service providers, third parties, and ADMT suppliers |
OFF-29, at the Organization level:
| Requirement | Provisions | Law |
|---|---|---|
ORF-488 ADMT request-handling infrastructure | §§ 7004, 7011, 7020–7021, 7060–7063, 7080, 7100–7102, 7221–7222. Civil Code §§ 1798.140(ak), 1798.145(h) | Time limits for requests and The business and requests from consumers |
ORF-489 Human involvement and human-appeal capability | §§ 7001(e)(1), 7021, 7221(b)(1). Civil Code § 1798.145(h) | The technology test — ADMT and The human appeal exception |
ORF-490 Risk-assessment program and Agency submissions | §§ 7150–7157 | Risk assessments and Agency submissions |
ORF-491 Notice, purpose-compatibility and contract program | §§ 7002, 7003, 7010, 7012, 7050, 7051, 7053, 7220(e) | Pre-use Notice, Purpose limits on personal information, and As the business — contracts and the opt-out flow-down |
ORF-492 California ADMT regulatory watch | No provision that applies to your organization. The Agency's Final Statement of Reasons. Civil Code § 1798.199.95(d) | Possible changes and Items to monitor |
For the Controls of MFF-29 and OFF-29 that other Frameworks also use, see Control overlap.
Steps that Modulos recommends
Modulos recommends this sequence for an organization that uses MFF-29 and OFF-29 for the CCPA ADMT Regulations. Some items in the steps are duties of the regulations, and each step gives a link to them. Other items are not duties. Each of these other items tells you that Modulos recommends it.
- Find if the regulations apply to each ADMT (
MRF-489,ORF-489). Apply the provisions in Who must comply.- Apply the test of § 7200(a) to each technology: business, consumer, personal information, ADMT, and significant decision.
- Apply each CCPA exemption only on its conditions.
- Examine human involvement against all three parts of § 7001(e)(1).
- In Modulos, the test of human involvement applies to the decision flow, not to an appeal after the decision. See The technology test — ADMT.
- Find if the business intends to use personal information to train ADMT for a significant decision (§ 7150(b)(6)).
- Record which date of § 7200(b) applies to each use. See When Article 11 applies.
- Modulos recommends that you record the result in
MRF-489. No provision of the regulations tells you to keep this record. - Modulos recommends that you do this step again before you initiate a processing activity of § 7150(b).
- Modulos also recommends that you do this step again after a material change to the processing (§ 7155(a)(3)).
- Conduct and "document" the risk assessment (
MRF-495,ORF-490). Follow the assessment, approval, retention, and submission duties, with their time limits and conditions. - Prepare the request methods, notices, and contracts (
ORF-488,ORF-491).- Follow the rules for consumer requests for methods, verification, records, and the privacy policy.
- Apply the request time limits.
- Check the purpose limits before you use personal information for a different purpose.
- Prepare the contracts for service providers, contractors, and third parties.
- For each use, select the opt-out or an exception (
MRF-491,MRF-492,MRF-493,ORF-489). Check each exception and all its conditions.- Modulos recommends a record of each selected human reviewer and each decision on appeal.
- Give the notice and prepare for access requests (
MRF-490,MRF-494). Apply § 7200(b) to these Article 11 duties:- For use for a significant decision before January 1, 2027, comply "no later than January 1, 2027".
- For such use on or after January 1, 2027, comply at each time of use.
- Follow the Pre-use Notice rules for the information, time limits, and how to give the notice.
- Prepare to give consumers the access information, with the applicable verification and exceptions.
- Do the duties for each type of person (
MRF-496). Follow the duties for businesses, service providers, contractors, and third parties.- Apply the opt-out instructions and time limits when you receive a request.
- If § 7153 applies, give the facts for the recipient-business's risk assessment.
- Monitor the changes (
ORF-492). Use Items to monitor.- Modulos recommends that you do step 1 again if the Agency changes
§ 7001(e),§ 7001(ddd), or§ 7200(a).
- Modulos recommends that you do step 1 again if the Agency changes
A Requirement can have more than one Control. When all Controls of a Requirement are Executed, Out of scope, or Archived, the Requirement shows ready to be reviewed. The Requirement Owner examines the completed Controls and marks the Requirement as Fulfilled. Follow Reviews & Statuses.
Items to monitor
No provision of the CCPA ADMT Regulations tells a business to monitor these items. ORF-492 is the Requirement for this task. Modulos recommends it, and it is not a duty. The sources of ORF-492 apply to the Agency and the Legislature, not to your organization. Each item below can change the law to which a Requirement applies.
| Item | As of October 2026 | Requirements that it can change | Law |
|---|---|---|---|
Changes by the Agency to § 7001(e) (ADMT), § 7001(ddd) (significant decision), or the threshold of § 7200(a) | The Agency wrote that it "may revisit" these three provisions. | MRF-489, MRF-490 to MRF-494, ORF-488, and ORF-489 | Possible changes |
| AB 1018 | A bill, as amended in the Senate on August 21, 2026. No source shows that it became law. | None. If it becomes law, examine its provisions. | Possible changes |
| Adjustment of the thresholds of the CCPA | The Agency adjusts the monetary thresholds in each "odd-numbered year" (Civil Code § 1798.199.95(d)). | MRF-489 (the business test) | Possible changes |
| A federal law that replaces California privacy law | Not known. | Not known | None |
Items with no Control in the Framework
For the CCPA ADMT Regulations, MFF-29 and OFF-29 have no Control for these items.
- No Control for SB 947. The duties of SB 947 are not in
MFF-29orOFF-29(Which instrument is which). - No Control for AB 1018. As of October 2026, AB 1018 is a bill, and no source shows that it became law. See Possible changes.
- No Control for cybersecurity audits. The cybersecurity audit duties of Article 9 (§§ 7120–7124) are not in
MFF-29orOFF-29. - No specified method to show condition (B). The Frameworks include condition (B) of § 7221(b)(2) and (b)(3), but the regulations give no method to show that it applies.
Where to go next
CCPA ADMT Regulations overview
The regulations, the dates, enforcement, and the possible changes
Coverage and roles
The business, the consumer, ADMT, significant decisions, the exemptions, and when Article 11 applies
Pre-use Notice, opt-out, and access
The Article 11 duties, the three exceptions, and the time limits for requests
Risk assessments and Agency submissions
Article 10 for the use and the training of ADMT, and the information for the Agency
Service providers, third parties, and ADMT suppliers
The contracts, the duties of each "role", and the facts for a recipient-business
Frequently asked questions
The CCPA ADMT Regulations, with a link to the full rule for each item
Disclaimer
This page gives general information. It is not legal advice. The Agency wrote that it "may revisit" three provisions.