Automated Decision-Making

What is automated decision-making?

Automated decision-making is when software, often AI, makes a decision about a person with little or no human involvement. Examples include screening job applicants, approving loans or setting insurance prices.

Privacy laws give people rights when this happens. Under the GDPR, Article 22 gives people the right not to be subject to a decision "based solely on automated processing" that has legal or similarly significant effects, with some exceptions. Where an exception applies, people can still ask for human intervention and contest the decision.

In California, regulations on automated decisionmaking technology (ADMT) under the CCPA took effect on January 1, 2026, according to the California Privacy Protection Agency. They cover technology that replaces or substantially replaces human decisions about significant matters such as lending, housing, education, jobs and healthcare. Businesses already using ADMT for those decisions must comply by January 1, 2027, according to the regulations. Duties include a pre-use notice, an opt-out and a right to access information about the ADMT.

Colorado AI Act

Read the full page on Colorado AI Act

The Colorado AI Act (SB 24-205) was signed on May 17, 2024. Its start date was later pushed to June 30, 2026. It never took effect.

On May 14, 2026, Colorado repealed and replaced it with SB 26-189, a narrower law on automated decision-making technology. Its main duties apply to consequential decisions made on or after January 1, 2027. Companies using covered tools must give a pre-use notice and, after an adverse outcome, an explanation within 30 days. People can correct inaccurate data and ask for human review, to the extent commercially reasonable.

As of October 2026, the state attorney general had not finalized the rules, and enforcement was paused under a court order in a pending lawsuit, as Jones Walker reported on October 23, 2026.

Why it matters to you

As a business buyer, these rules reach you when you use a vendor's tool to make decisions about people, such as hiring or pricing. Under California's rules and Colorado's new law, notice and review duties fall on the company using the tool, while Colorado's law asks the tool's developer to supply documentation. Vendor terms, such as an acceptable use policy, can add their own rules. Anthropic's Usage Policy, for example, requires a qualified person to review AI recommendations in high-risk uses before they are acted on. A new version effective November 12, 2026 drops that review when the outcome is wholly favorable in four listed cases, such as paying an insurance claim, where the law allows it, as Venpo reported in Anthropic will let AI approve a claim without a human, but not deny one.

What to check

• List vendor tools that score, rank or decide anything about job candidates, employees or customers.
• Ask each vendor what documentation it provides for notices and explanations.
• Check vendor terms and usage policies for human review requirements.

How Venpo helps

Venpo watches your vendors' terms, AI terms and usage policies and emails you when rules about automated decisions or human review change.