# 1. What changes for AI scouting in California?


### Does the CCPA cover professional players and applicants?

**California privacy rights are not limited to retail customers.** The regulator explicitly includes California-resident employees and job applicants. Business coverage depends on statutory conditions and thresholds, so neither a small recruitment department nor a supplier’s overseas headquarters settles the question by itself. ([cppa.ca.gov](https://www.cppa.ca.gov/faq.html))

For a club, the useful starting point is a **workflow inventory**, not an inventory of products labelled AI. Record whether a tool retrieves footage, summarises evidence, ranks prospective signings, screens applicants, recommends contract terms or evaluates existing players. Ask counsel which activities and people are covered.

### What must be ready by January 2027?

**Covered uses of ADMT for significant decisions require preparation before 1 January 2027.** The agency identifies employment among the relevant decision areas and describes rights involving notice, access and opting out, subject to the applicable rules and exceptions. ([cppa.ca.gov](https://www.cppa.ca.gov/faq.html))

The final definition focuses on replacing or substantially replacing human decisionmaking. Qualifying human involvement requires a reviewer who understands the output, evaluates it alongside relevant information, and has authority to change the decision. A nominal approval step should therefore not be treated as sufficient without examining how it works. ([cppa.ca.gov](https://www.cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf))

**Recommended supplier acceptance test:** give the reviewer a deliberately incorrect player match or unsupported assessment. Require the system to preserve the original evidence, allow correction, record the reviewer’s reasoning and show whether the correction changes downstream recommendations.

### Are risk assessments already due?

**The risk-assessment timetable is separate from the ADMT timetable.** Requirements began in 2026; initial summary submissions and attestations are due by 1 April 2028. The later submission date is not a blanket permission to postpone assessment work. ([cppa.ca.gov](https://www.cppa.ca.gov/announcements/2025/20250923.html))

The final rules identify triggers beyond ADMT, including sensitive-information processing and certain systematic-observation profiling of applicants or workers. They require assessment before initiating covered processing, while qualifying processing begun before the regulations took effect has a transition deadline of 31 December 2027. ([cppa.ca.gov](https://www.cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf))

**What to request now:** a description of input categories, sources, inferred attributes, purposes, retention, recipients, known limitations and safeguards. Do not accept an undifferentiated statement that the supplier is compliant as a substitute for information about the club’s actual workflow.

### What employment controls already apply?

California’s separate civil-rights regulations took effect on **1 October 2025**. They clarify how existing discrimination protections apply to automated employment systems, require covered employment records—including automated-decision data—to be retained for at least four years, and address assessments that may elicit disability information. ([calcivilrights.ca.gov](https://calcivilrights.ca.gov/2025/06/30/civil-rights-council-secures-approval-for-regulations-to-protect-against-employment-discrimination-related-to-artificial-intelligence/))

**Procurement implication:** reconcile deletion functionality with counsel-approved record-retention and legal-hold rules. Specify which decision records must remain exportable when a scouting subscription ends; do not promise either indefinite retention or immediate deletion of everything.