Companies have little time left to determine whether their automated tools fall within the scope of California's sweeping automated decision-making technology (ADMT) regulations and to prepare for new compliance obligations taking effect in 2027. The regulations extend beyond traditional AI systems to a broad range of automated decision-making tools and impose new requirements related to risk assessments, transparency and consumer rights. This article explores the regulations’ application, key compliance steps, areas of uncertainty and litigation implications, distilling insights offered by privacy and AI counsel at CalPrivacy, Harvey AI, Goodwin Procter and DataGrail during a recent IAPP webinar. See “Updating Compliance Programs to Address the CPPA’s Regulations on ADMT and Risk Assessments” (Sep. 17, 2025).