Where AI & Privacy Intersect: 10 Myths About ADM(T)

As our clients prepare for automated decision-making (ADM) requirements beginning in 2027 in California, Colorado, and Connecticut, we’d like to clear up a few myths about ADM. For this article, we use “ADM” as shorthand to include ADMT under California’s CCPA regulations, ADMT under Colorado’s SB 26-189 (which repealed and replaced the Colorado AI Act), automated employment-related decision technology (AEDT) under Connecticut’s Public Act 26-15 (formerly SB 5), and automated decision-making under the EU’s GDPR Article 22. We also briefly discuss the EU DSA where automated content or account restrictions overlap with GDPR obligations.

Myth #1: There are no real AI laws in the U.S.

When companies think of AI laws in the U.S., they’re often focused on targeted, narrow topics that usually don’t significantly affect most companies: chatbot disclosures, frontier models, training data transparency, sector-specific laws. But ADM requirements are among the widest-reaching de facto AI laws