Is your AI compliant?

ADMT stands for Automated Decision-Making Technology. If your AI recommends, scores, filters, or ranks people — in hiring, lending, insurance, healthcare, housing, or education — you're using ADMT. California Privacy Rights Act (CPRA) regulations (§7150-7155) now require either proof that humans genuinely review AI recommendations (advisory-only) or formal risk assessments filed with the state (compliance). Violations are $7,500 per consumer, per incident, no cap. The $1.35M Tractor Supply penalty and “hundreds of investigations in progress” show the California Privacy Protection Agency (CPPA) means it.

That's exactly the question regulators will ask — and the answer depends on whether humans genuinely review those recommendations. If your approval rate is 98% with 3-second review times, the AI is the de facto decision-maker regardless of what you call it. Advisor proves meaningful human review with cryptographic evidence: dwell time, factor acknowledgment, override patterns, and authenticated decision creation. If your AI is truly advisory, Advisor gives you the proof. If it's rubber-stamped, you'll discover that before CPPA does.

Advisor is for avoidance — prove your AI is advisory-only so ADMT regulations don't trigger. We deploy enforcement middleware into your infrastructure. Auditor is for compliance — when your AI does make or substantially replace human decisions, generate the §7155 risk assessments the regulation requires. Your compliance officer uses a dedicated portal. Many companies need both: advisory architecture for some AI systems and compliance documentation for others.

Three differences. First, scope: they cover broad AI governance (risk registers, policy management, bias audits). AIGov covers ADMT only — two sections of one regulation, served deeply. Second, delivery: they're enterprise platforms with $100K+ contracts and months-long sales cycles. We deploy into your infrastructure in weeks, not quarters. Third, enforcement: they document compliance posture. AIGov enforces it architecturally — making it impossible for AI to bypass human review, not just tracking whether it did.

SOC 2 and ADMT are completely different compliance domains. Vanta covers SOC 2, ISO 27001, and HIPAA — none of which address automated decision-making. ADMT regulations require different infrastructure entirely: advisory-only architecture enforcement, per-decision audit trails with cryptographic proof, risk assessments specific to AI decision systems, and consumer opt-out mechanisms. Vanta may add ADMT modules eventually, but today there's nothing to add on top of.

ADMT-focused, multi-jurisdiction: CPRA §§7150-7155 (risk assessments, effective Jan 2026), §§7220-7222 (consumer rights, effective Jan 2027), Colorado AI Act (high-risk AI impact assessments, Jun 2026), Illinois HB 3773 (AI in hiring, Jan 2026), and EU AI Act Article 12 (audit logging for high-risk systems, Aug 2026). Our controls also map to ISO 42001, the international standard for AI management systems — useful if you're pursuing certification or need a recognized framework for board-level reporting. We intentionally don't cover SOC 2, HIPAA, cookie consent, DSAR processing, or general privacy. Just automated decision-making.

Trainer is the bridge between advisory and automated. Every time a human reviews an AI recommendation through Advisor, they generate labeled training data: what the AI said, what the human decided, and why. Over months, Trainer structures this into a decision corpus, tracks human-AI agreement, and scores automation readiness. When agreement rates are high enough and edge cases are covered, Trainer produces the evidence package justifying the transition to automation — and Auditor handles the compliance obligations that follow. You don't need Trainer to use Advisor or Auditor. But if your long-term goal is confident, compliant automation, the data you need starts accumulating from day one.

Everything runs in your infrastructure. Your audit trail data is yours. Assessment documents are yours. Decision corpus data is yours. We deploy into your cloud, your VPC, your compliance boundary — exportable at any time. The honest answer on lock-in: switching costs are structural, not contractual. Your decision corpus and custom models are inherently yours, but they work best within the integrated AIGov platform. We think that's fair — the value compounds because the infrastructure is connected.