Late last month, California approved new regulations restricting automated decision-making –ADM – under the Californian Consumer Privacy Act. ADM refers to computer processing of personal information in order to make a decision. And the new regs restrict use of ADM for decisions about employment, housing, healthcare, and allocation of other vital resources – with the goal of protecting Californians against discrimination and invasion of privacy. California’s regs join a long list of proposed and enacted anti-ADM laws in other states: Texas, New York, Colorado, etc. The new California regs won’t go into effect until January of 2027, and other states have delayed rollout too, but it’s time to ask how to address these laws in contracts.
If you sell AI, this is probably your problem – and maybe even if you buy it
If you provide artificial intelligence, your customer’s violation of ADM laws and regs could get you into trouble. That goes for the ultimate vendor of AI – the LLM or whatever – and for any company reselling AI functionality (e.g., as part of SaaS). Why? The reach of these laws remains to be seen, but it’s likely you could be sued for your customer’s unacceptable use of your AI. And your customer’s ADM could damage your brand, if word spreads that the customer discriminated or violated privacy using your system. So you should consider contract terms on ADM.
If you’re an AI customer, you probably don’t need ADM terms, since you’re the problem: you’re the contracting party who might misuse the system. But you should understand the issue and the terms your vendor might request. (Also, in the unlikely event that you authorize your vendor to train its AI using your inputs, you could be dragged into litigation about misuse of the vendor’s system – and in that case you should consider contract terms restricting ADM. If so, reverse the parties in the sample clause below.)
Sample language
The proposed clause below restricts use of automated decision-making by AI customers. It uses vocabulary from the new California regulations, but it should help with compliance in multiple jurisdictions.
Unless it first performs a Risk Assessment (as defined below), Customer shall not use the System for automated decision-making (“ADM”) that has or could have a material impact on an individual related to employment, service as an independent contractor, lending or other financial services, housing, education, or healthcare. If Customer does perform ADM using the System, it shall: (a) perform human oversight reasonably sufficient to protect individuals from unfair or illegal discrimination or other unfair decision-making; and (b) comply with any applicable law on ADM. (“Risk Assessment” refers an assessment of whether the risk of infringing an individual’s privacy or illegally or unfairly discriminating outweighs the benefits of the ADM to, collectively, that individual, Customer, related stakeholders, and the public.)
The clause above isn’t crystal clear. What’s “oversight reasonably sufficient to protect individuals from … unfair decision-making”? But the laws themselves lack clarity, and this adopts their concepts. So as caselaw fills out the meaning of these laws, it should improve the clarity of these terms. And if you’re the vendor and your customer wants greater clarity, fine. You’re better off negotiating language that fits your customer’s use-case than leaving ADM terms out of the contract.
This probably isn’t the final word on ADM terms. We don’t know how California’s or the other states’ laws will be interpreted, and we don’t know what others will come down the pike. (California, for instance, also has a new bill on ADM in employment: SB-7.) But this is a good start.
If you’d like to learn more about contracts for purchase and sale of AI, check out this 2-hour on-demand course: Artificial Intelligence Contracts: Drafting and Negotiating.
THIS ARTICLE IS NOT LEGAL ADVICE. IT IS GENERAL IN NATURE AND MAY NOT BE SUFFICIENT FOR A SPECIFIC CONTRACTUAL, TECHNOLOGICAL, OR LEGAL PROBLEM OR DISPUTE, AND IT IS NOT PROVIDED WITH ANY GUARANTEE, WARRANTY, OR REPRESENTATION. LEGAL SITUATIONS VARY, SO BEFORE ACTING ON ANY SUGGESTION IN THIS ARTICLE, YOU SHOULD CONSULT A QUALIFIED ATTORNEY REGARDING YOUR SPECIFIC MATTER OR NEED.
© 2025 Tech Contracts Academy, LLC