AI Governance Podcast - California's ADMT Regulations with Phil Laird

This episode of the AI Governance Podcast features Phil Laird, General Counsel of the California Privacy Protection Agency (CPPA).

 

Phil leads the CPPA's legal function through the agency's work on automated decision-making technology - the ADMT regulations, the Risk Assessment requirements, and the Delete Request and Opt-out Platform (DROP) build that's now well underway. The CPPA has become arguably the most consequential US-side voice on AI governance, and Phil's role sits at the centre of how California is operationalising oversight in 2026 and 2027.

 

Phil joined Enzai's Matt McCallum to discuss:

• Meaningful human involvement and automation bias: What California's definition of human review explicitly closes the door on, and the most common implementation failure mode in early ADMT programmes - organisations believing they have addressed automation bias when they have not.
• The 2026/2027 implementation roadmap: The Risk Assessment timeline, what's in scope and when, and how California's regime overlaps with - and where it diverges from - EU AI Act and GDPR risk assessment work that businesses may already be doing.
• The DROP platform: Where California is in the build of its centralised Delete Request and Opt-out Platform, the architectural ambition behind it, and what operational readiness in 2026/2027 looks like for in-scope businesses.
• Frictionless as operating doctrine: Why the CPPA's "frictionless" framing is not consumer rhetoric but the operating principle shaping how the agency sequences regulatory work and what it expects from business.
• Where the field is going: Phil's read on enforcement priorities, the practitioner gaps the CPPA is watching, and the next twelve months of agency agenda from inside the team.