Three state frameworks governing automated decision-making and personal data take effect on January 1, 2027. California’s rules on automated decision-making technology reach businesses covered by its privacy law, Colorado’s rewritten AI law no longer exempts small businesses, and Delaware’s privacy law will apply to companies handling data on as few as 10,000 state residents.
Key Takeaways
- California businesses already using automated decision-making technology (ADMT) for significant decisions must comply with new CCPA rules by January 1, 2027.
- Colorado’s SB 26-189, signed May 14, 2026, takes effect January 1, 2027, and drops the original law’s exemption for businesses with fewer than 50 full-time employees.
- Delaware’s privacy law will apply to businesses handling personal data of at least 10,000 Delaware consumers, down from 35,000, starting January 1, 2027.
- California’s rules cover decisions about financial or lending services, housing, education, employment and health care services.
- Colorado’s law can reach businesses based in other states that use ADMT in decisions about Colorado residents.
- The California privacy law’s revenue threshold of $26,625,000 is scheduled for its next inflation adjustment on January 1, 2027.
Three State Frameworks Arrive on the Same Day
January 1, 2027, is a compliance date for businesses that use automated tools to make decisions about people. California, Colorado and Delaware each have new requirements taking effect that day, and each defines who is covered differently. For small businesses, the most practical question is not what the laws require in detail, but whether they apply at all.
That question is increasingly relevant given small business AI adoption reaching 89% in 2026. Many of those tools now help screen job applicants, score loan or rental applicants, or prioritize customers.
California’s ADMT Rules Apply to Businesses Covered by the CCPA
California’s rules come from regulations adopted by the California Privacy Protection Agency (CPPA) under the California Consumer Privacy Act. They apply only to companies that meet the CCPA’s definition of a “business.” That means a for-profit company doing business in California with annual gross revenue above $26,625,000, or one that buys, sells or shares the personal information of 100,000 or more California consumers or households, or that earns at least half of its revenue from selling or sharing personal information. The revenue test counts total gross revenue, not only California sales, and the CPPA adjusts the figure every two years, with the next adjustment due January 1, 2027.
The regulations define ADMT as technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. They apply when a business uses ADMT for a “significant decision,” defined as one that results in the provision or denial of financial or lending services, housing, education, employment or health care services. A business using ADMT for such decisions before January 1, 2027, must comply by that date, and one that starts afterward must comply from the start. Requirements include a pre-use notice describing the purpose of the technology, its logic and the type of output it generates, along with the consumer’s right to opt out.
Colorado Drops Its Small Business Exemption
Colorado Governor Jared Polis signed SB 26-189 on May 14, 2026, replacing the state’s original AI Act with a narrower framework built around transparency, notice and consumer recourse. The new law covers ADMT used to materially influence consequential decisions in areas such as employment, housing, lending, insurance and health care.
For small businesses, the most significant change is scope. SB 26-189 eliminates the original law’s exemption for businesses with fewer than 50 full-time employees, and it applies to deployers doing business in Colorado, which can include companies headquartered elsewhere that make decisions about Colorado residents. The Colorado Attorney General has sole enforcement authority. According to the Attorney General’s rulemaking page, the Department of Law has proposed implementing rules and held a public rulemaking hearing on October 26, 2026, ahead of final adoption. Hiring is one of the areas where many small businesses already use automated tools, a trend reflected in a Hubstaff survey on how AI is changing workloads.
Delaware Lowers Its Privacy Threshold to 10,000 Consumers
Delaware Governor Matt Meyer signed House Bill 380 on September 2, 2026, expanding the Delaware Personal Data Privacy Act effective January 1, 2027. The law will apply to businesses that handle the personal data of at least 10,000 Delaware consumers, down from 35,000. For businesses that earn more than 20% of their gross revenue from selling personal data, the threshold drops from 10,000 to 5,000 consumers.
The amendments also expand the definition of sensitive data to include categories such as neural data, financial account credentials, pregnancy status and government-issued identification numbers, and they extend obligations to third parties that acquire personal data from businesses covered by the law.
Coverage Triggers Differ by State
| State | Who Is Covered | Effective |
|---|---|---|
| California | CCPA “businesses”: revenue above $26,625,000, data on 100,000+ California consumers or households, or 50%+ of revenue from selling or sharing data | ADMT compliance by January 1, 2027 |
| Colorado | Deployers and developers of ADMT used in consequential decisions about Colorado residents; no small business exemption | January 1, 2027 |
| Delaware | Businesses handling data on 10,000+ Delaware consumers, or 5,000+ if over 20% of revenue comes from data sales | January 1, 2027 |
Tools From Outside Vendors Still Fall Under the Rules
Many small businesses use AI through software vendors or managed service providers rather than building it themselves. Colorado’s law separates developers, which build ADMT, from deployers, which use it, and requires developers to supply deployers with technical documentation starting January 1, 2027. The obligations tied to using the technology, such as notices to consumers, fall on the deployer. That makes vendor relationships part of the picture, at a time when managed service providers’ own uneven results with AI show how early many providers still are.
FAQs
When Do California’s ADMT Rules Take Effect?
Businesses already using automated decision-making technology for significant decisions must comply by January 1, 2027. Businesses that begin using it after that date must comply from the start.
Does Colorado’s AI Law Apply to Small Businesses?
SB 26-189 does not include the original law’s exemption for businesses with fewer than 50 full-time employees. It can apply to businesses that use automated decision-making technology in consequential decisions about Colorado residents.
What Is Delaware’s New Privacy Law Threshold?
Starting January 1, 2027, Delaware’s privacy law applies to businesses handling the personal data of at least 10,000 Delaware consumers, or 5,000 if more than 20% of revenue comes from selling personal data.
What Counts as a Significant Decision Under California’s Rules?
A significant decision is one that results in the provision or denial of financial or lending services, housing, education, employment or health care services.
