Creating rules around how businesses can use consumers’ personal information is proving to be easier said than done, as privacy regulators wrestle with how to rein in artificial intelligence and automated decision-making tools, or ADMT.

Regulations intended to protect consumers from having significant decisions made about them by machines are a sticking point for the California Privacy Protection Agency, whose board met Tuesday to hammer out details on draft regulations around ADMT. One of those rules would require businesses to submit risk assessments to the CPPA detailing how they use and protect personal information and what the consequences and benefits might be to consumers.