What makes a system "high-risk"?
A system may qualify as "high-risk" when it produces an automated output that assists or replaces human discretion in a decision with a meaningful effect on a person.
Look for outputs such as: a score, classification, ranking, recommendation, prediction, or similar simplified result used in a significant decision.
Examples of a "legal or similarly significant" university decision
Student Status or Opportunity
Hiring or Personnel Decisions
Eligibility or prioritization
CDT examples include AI recommending approval or denial of benefits, generative AI ranking resumes where the score determines advancement, and statistical-model identity matches used to support arrest-warrant decisions.
What the law requires
California Government Code § 11546.45.5, enacted through AB 302 (2023), created a statewide inventory and annual legislative reporting requirement for High-Risk ADS.
CSU is covered
The statute expressly includes the California State University within the definition of a “State agency” for this reporting requirement.
Scope
The inventory covers High-Risk ADS proposed for use, development, or procurement, as well as systems already being used, developed, or procured.
Annual reporting
The California Department of Technology reports the comprehensive inventory to specified legislative committees beginning January 1, 2025 and annually thereafter.
Inventory detail
For each system, the inventory includes the supported decision, intended benefits and alternatives, relevant research, categories of data and personal information used, and risk-mitigation measures such as cybersecurity, privacy, accuracy and bias controls, audits, and ways to contest a decision.
Reporting does not mean the technology is prohibited. The purpose is to identify, assess, and inventory qualifying systems so CSU can meet its legal reporting obligations.
What is not an Automated Decision System?
AB 302 identifies common technologies that are excluded from the ADS definition for this reporting purpose. Routine infrastructure or data-management technology does not, by itself, make a campus activity a High-Risk ADS.
- Spam email filters
- Firewalls
- Antivirus software
- Identity and access management tools
- Calculators
- Databases
- Datasets
- Other compilations of data
The key distinction is whether the technology actually functions as an automated decision system by producing a score, classification, recommendation, or similar output used in a significant decision.
Why this matters for CSUB
CSUB must identify campus use so qualifying systems can be reported through the CSU Chancellor’s Office and incorporated into the CSU’s systemwide inventory.
Faculty and staff should report systems that may use automated scoring, ranking, classification, prediction, or recommendations to influence consequential decisions about students, applicants, employees, or other people.
When in doubt, report or ask. It is better to raise a potential use case before deploying or relying on the system for a consequential decision.
