Imagine a lending team using Power BI to review customer applications. The dashboard shows an AI-generated risk score, and a manager checks the report each morning. That looks like human oversight until you learn that the credit system has already rejected applications based on the score. By the time the manager opens the report, the decision is made.
That difference matters under California's new CCPA rules. The question is not simply if a dashboard uses Copilot or another AI tool. It's how a business uses the result, and if a person has a real chance to change what happens. This guide looks at the dates, the legal test, and the records dashboard teams may need to keep. It is not legal advice; counsel needs to decide how the rules apply to each business.
What Changed in 2026, and What Starts in 2027?
The California Privacy Protection Agency (CPPA) announced approval of the new rules on September 23, 2025. They took effect on January 1, 2026, although some duties have later compliance dates. For teams using AI to influence customer decisions, those dates call for different kinds of work.
The CPPA's announcement confirms those dates. For required cybersecurity audits, businesses with more than $100 million in revenue have the first certification deadline in 2028. Qualifying businesses in the $50 million to $100 million range follow in 2029, while those below $50 million follow in 2030.
Why the Financial Risk Deserves Attention
California's published penalty limits, effective January 1, 2025, are $2,663 per violation and $7,988 per intentional violation. The higher amount also applies to certain violations involving children under 16.
A scoring system may affect many people before anyone spots a problem. That can make a failure expensive, although each affected decision does not automatically count as a separate violation. The immediate cost for a BI team is finding which automated outputs already feed business decisions.
When Does an AI-Generated Dashboard Insight Become ADMT?
The CCPA rules focus on technology that uses personal information to replace human decision-making, or does so in practice. They also limit the ADMT duties here to significant decisions. An AI summary of quarterly revenue and an automated credit decision may both appear in Power BI, but they are not the same kind of use.
The regulations cover significant decisions involving financial or lending services. Decisions about housing and access to healthcare also appear in the definition. Employment compensation is covered, as are certain education decisions. Targeted advertising alone is not a significant decision under this definition, though other CCPA duties may still apply.
The Difference Between a Reviewer and a Real Decision-Maker
Return to the lending example. Suppose a risk score automatically places a California applicant on a credit-denial list. A manager sees the list but cannot reverse the decision. Calling that step human review does not change what the system did.
How Common Dashboard Uses Compare
These examples show how the rule might apply. A change in the way a business uses the same score can change its treatment. They are not legal findings for a particular company.
Where Power BI Copilot Fits
Microsoft's Copilot documentation describes report summaries and help with DAX. It also tells users to review generated DAX before applying it. A finance analyst reading a summary and making an independent decision is different from an application acting on a score produced from a Copilot-assisted model.
The harder issue often sits outside Power BI. A measure may feed a nightly process that decides who gets credit. Nobody has to click a button in the report for that decision to happen. The team reviewing the AI use needs to follow the output into the system that acts on it.
What the CCPA Rules Require When ADMT Is in Scope
Covered use of ADMT for a significant decision brings duties beyond the model itself. The business must provide a pre-use notice describing the particular purpose before the relevant processing starts. Consumers also have rights to opt out and request information, subject to the exceptions written into the regulations.
An opt-out right is not absolute in every case. For example, the rules allow an exception when a business gives the consumer a qualifying appeal to a human reviewer who can overturn the decision. The pre-use notice rules also require the business to explain any exception it relies on. Legal review is needed before deciding which route applies.
Risk Assessments Need Details About the Actual Use
A risk assessment must describe the processing being reviewed. That includes the personal information involved and the reason it is used. For ADMT, the assessment also needs to explain how the technology works at a useful level and what its output does. The team must consider the risks to consumers and the safeguards in place.
Risk assessments are not limited to ADMT. Selling or sharing personal information can also trigger them. Certain uses of sensitive personal information may do so as well. The California rules require businesses to keep assessments while the processing continues, or for five years after completion, whichever period is longer.
A CCPA ADMT Checklist for Dashboard Teams
The first job is to find the dashboards that affect people, not just the reports that mention AI. A score used in a private application may matter more than a public-facing Copilot summary. Once the team knows where the outputs go, it can give legal counsel a useful account of each process.
Keeping the Evidence in Your Own Environment
A business may need to explain why an applicant was denied credit months after the decision. The report on its own may no longer show the same figures. A measure could have changed, or a new model version may now be in use.
This is where audit records become useful. They can show which query produced an answer and the source data it used. But a query log cannot prove that a human reviewed a decision or had authority to change it.
Governed AI Intelligence With Reporting Hub
BI Genius, Reporting Hub's AI agent product, runs in the customer's Azure environment. It connects to existing Power BI semantic models and can show the DAX behind a response. Its query audit logs let administrators review earlier query steps instead of relying only on the final answer.
That record can support an internal review of what an AI feature returned. It does not tell the whole story of a lending or employment decision, though. A covered business still needs to record how the output was used and how its consumer-rights process worked. BI Genius does not make a business CCPA compliant simply by providing query history.
Frequently Asked Questions
Do the CCPA ADMT Rules Apply to Every AI Dashboard?
No. The ADMT duties discussed here concern technology used to make significant decisions without the human involvement required by the rules. A Copilot summary used for ordinary business planning is not the same as an automated decision about someone's credit application. Other CCPA requirements can still apply to the data processing.
When Do the ADMT Duties Begin?
Covered businesses must comply starting January 1, 2027, including those already using ADMT for significant decisions before that date. Risk assessment compliance began on January 1, 2026. For covered processing started before 2026 and still continuing, the initial risk assessment can be completed by December 31, 2027, under the transition rule.
Does Copilot in Power BI Count as ADMT?
The product name alone does not settle the question. A person reading a Copilot summary and making a real decision may not meet the ADMT definition. A system that acts automatically on a Copilot-assisted score could be different, depending on the type of decision and the other facts.
Which Businesses Are Covered by the CCPA?
The CCPA has several tests for which for-profit businesses it covers. One is an annual gross revenue threshold of $26,625,000, effective January 1, 2025. Smaller businesses can still be covered through other tests. Legal counsel needs to review the full business and its data practices.
What Records Should We Keep?
Keep the risk assessments and updates for the period required by the CCPA. For decisions using AI output, record what the system produced and who had authority to change the outcome. The notice given to the consumer may also matter later. The records should reflect what happened, not just what a process diagram says should happen.
References
- California Privacy Protection Agency (CPPA). Board Approves Final Rulemaking Package. cppa.ca.gov, September 23, 2025.
- California Office of the Attorney General. Monetary Thresholds in the CCPA. privacy.ca.gov, effective January 1, 2025.
- California Code of Regulations. CCPA Regulatory Definitions - Automated Decision-Making Technology. govt.westlaw.com.
- California Code of Regulations. CCPA ADMT Opt-Out Right and Exceptions. govt.westlaw.com.
- California Code of Regulations. CCPA Pre-Use Notice Requirements. govt.westlaw.com.
- California Code of Regulations. CCPA Risk Assessment Requirements. govt.westlaw.com.
- Microsoft Learn. Copilot for Power BI: Privacy, Security, and Responsible Use. learn.microsoft.com.