This examination is modeled on the Multistate Performance Test (MPT). You are a junior associate at a law firm retained by Nexus Health, Inc. You must complete three lawyering tasks.
The File contains the factual record: client communications, internal documents, and regulatory notices. The Library contains a curated set of real, enacted authorities with official citations and hyperlinks — the statutes, regulations, and professional responsibility rules directly relevant to the tasks.
The Library is sufficient to complete all three tasks with a full, well-reasoned answer. You are not required to go beyond it.
Because this is an open-book, take-home examination, you may also draw on additional authorities from outside the Library — cases, regulations, secondary sources, or other statutes — if you believe they strengthen your analysis. Outside authorities are not required, and a response grounded entirely in the Library materials can receive full credit. If you do cite outside sources, use proper legal citation form and do not misrepresent what those sources say.
The California legislature has enacted a layered AI framework. The CCPA/CPRA provides the broadest base, with finalized ADMT regulations effective January 1, 2027. California’s Transparency in Frontier Artificial Intelligence Act (SB 53, 2025) adds requirements for “frontier developers.” Students should assess which frameworks apply to Nexus Health and where scope limitations create gaps that affect the analysis.
Nexus Health, Inc. is a digital health company headquartered in San Francisco, California. Nexus developed ARIA (Adaptive Risk Intelligence Assistant), an AI system deployed at partner hospitals to assist clinicians with triage and to flag patients at elevated risk of deterioration. ARIA is not FDA-cleared as a medical device; it is marketed as a “clinical decision support tool.” Nexus has approximately $80 million in annual revenue and processes health data for over 300,000 California residents.
Privileged & Confidential — Attorney Work Product
MEMO To: Outside Counsel | From: Dana Voss, General Counsel, Nexus Health | Date: March 14, 2026
Three urgent issues require your written analysis. First, ARIA is deployed in hospitals in California and Germany. Each regulator is asking different things of us. Second, the California Privacy Protection Agency (CPPA) has sent a formal inquiry alleging that ARIA processes “sensitive personal information” without adequate disclosure and that its outputs constitute “automated decisionmaking technology” (ADMT) subject to consumer rights. Third, our data scientist Dr. Priya Mehta has flagged internally that ARIA’s risk scores show a disparate performance gap across racial subgroups — an 18% false-negative rate for Black patients versus 9% for white patients on the deterioration-prediction task. Dr. Mehta has asked whether she has any obligation to report this externally. We have not yet disclosed this disparity to our hospital partners.
Please advise on all three issues.
California Privacy Protection Agency — Informal Inquiry Notice No. 2026-012
The CPPA has received a complaint alleging that Nexus Health’s ARIA system: (1) processes patient health data and infers racial/ethnic characteristics without a conspicuous pre-use notice; (2) generates risk scores that constitute “automated decisionmaking technology” affecting patients’ access to care; and (3) has not provided consumers with an opt-out mechanism.
The CPPA requests a written response within 30 days addressing Nexus Health’s data practices under the CCPA (Cal. Civ. Code §§ 1798.100–1798.199.100) and the CPPA’s ADMT Regulations (11 Cal. Code Regs. §§ 7150–7157), which require pre-use notices for ADMT used in significant decisions affecting health.
ARIA Model Card — Internal v2.3 (Excerpt)
ARIA uses a gradient boosting model trained on EHR data from three hospital systems (2015–2023). Inputs include age, vital signs, lab values, ICD-10 codes, medication history, and ZIP code as a socioeconomic proxy. Outputs are risk scores (0–100) used by clinicians in triage decisions.
Post-deployment monitoring (Q4 2025) identified a performance disparity: false-negative rate of 18% for Black patients vs. 9% for white patients. Root cause analysis is ongoing.
The model was developed at an estimated cost well below $100 million in compute.
Compliance note: ARIA is not an FDA-cleared device and is not developed by a “frontier developer” as defined in California Health & Safety Code § 22756.1 (SB 53). Nexus does not train foundation models.
Nexus EU Operations — Compliance Status (March 2026)
ARIA is deployed at two hospital partners in Germany. Both classify ARIA as a high-risk AI system under Annex III of the EU AI Act (Reg. (EU) 2024/1689). They are requesting a conformity assessment and technical documentation.
Our German deployment predates August 2, 2026. Counsel should advise whether the transitional provisions of Article 111 of the AI Act affect our obligations.
Internal Email — Dr. Mehta to General Counsel
“Dana — I’ve reviewed the Q4 monitoring data. The disparity is real and the hospitals are using ARIA scores to prioritize ICU bed allocation. If patients are being harmed because the model performs worse for Black patients, I believe we have a duty to disclose. I’ve spoken with HR about whistleblower protections. I asked specifically whether California’s new AI safety law — the one Newsom signed last fall — protects me if I report to the CPPA or Attorney General directly. HR couldn’t give me a clear answer. Can outside counsel address whether I’m protected?”
(a) A business that controls the collection of a consumer’s personal information shall, at or before the point of collection, inform consumers of the following: (1) The categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. A business shall not collect additional categories of personal information or use personal information collected for additional purposes that are incompatible with the disclosed purpose for which the personal information was collected without providing the consumer with notice consistent with this section. (2) If the business collects sensitive personal information, the categories of sensitive personal information to be collected and the purposes for which the categories of sensitive personal information are collected or used, and whether that information is sold or shared. A business shall not collect additional categories of sensitive personal information or use sensitive personal information collected for additional purposes that are incompatible with the disclosed purpose for which the sensitive personal information was collected without providing the consumer with notice consistent with this section. (3) The length of time the business intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine that period provided that a business shall not retain a consumer’s personal information or sensitive personal information for each disclosed purpose for which the personal information was collected for longer than is reasonably necessary for that disclosed purpose.
A consumer shall have the right, at any time, to direct a business that collects sensitive personal information about the consumer to limit its use of the consumer’s sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.
Includes: (1) personal information that reveals a consumer’s racial or ethnic origin; (2) a consumer’s health or medical information; (3) inferences drawn from any personal information to create a profile about a consumer reflecting the consumer’s health.
The Agency shall promulgate regulations governing the use of automated decisionmaking technology, including profiling. The regulations shall establish consumer rights to access information and to opt out of the use of automated decisionmaking technology.
A consumer whose nonencrypted and nonredacted personal information is subject to an unauthorized access, exfiltration, theft, or disclosure may bring a civil action for statutory damages of $100 to $750 per consumer per incident, or actual damages, whichever is greater.
Any technology that processes personal information and uses computation to execute a decision, replace human decisionmaking, or substantially replace human decisionmaking. “Substantially replace” means using the technology’s output as a key factor in a human’s decisionmaking.
A decision that results in the provision or denial of, or that significantly affects: financial or lending services; housing; insurance; education enrollment; employment or independent contractor opportunities; healthcare access or service; or access to essential goods or services.
A business that uses ADMT to make a significant decision concerning a consumer must provide a Pre-use Notice before using ADMT with respect to that consumer. The Pre-use Notice must inform the consumer about: (1) the type of ADMT used; (2) the purpose and logic of the ADMT; (3) how to exercise the right to opt out.
A business must conduct and document a risk assessment before initiating processing activities that pose significant risk to consumer privacy, including use of ADMT for a significant decision concerning a consumer. Assessments must identify and weigh benefits against potential risks to consumers, including risks from algorithmic discrimination based on protected characteristics.
ADMT obligations apply to businesses using ADMT for significant decisions beginning January 1, 2027. Risk assessment obligations are effective January 1, 2026. As of the exam date (March 2026), pre-use notice and opt-out obligations are not yet operative, but risk assessments are required.
AI systems listed in Annex III are classified as high-risk. Annex III, point 5(c) covers AI systems intended to be used for making decisions or materially influencing decisions on access to and enjoyment of essential private services and public services, including healthcare.
A risk management system shall be established, implemented, documented, and maintained in relation to high-risk AI systems. The risk management system shall consist of a continuous iterative process run throughout the entire lifecycle of a high-risk AI system.
Training, validation, and testing data sets shall be subject to appropriate data governance and management practices. Those practices shall concern, in particular: the examination in view of possible biases that could affect health, safety or fundamental rights or lead to discrimination prohibited under Union law.
High-risk AI systems shall be designed and developed in such a way to ensure that their operation is sufficiently transparent to enable deployers to interpret the system’s output and use it appropriately. The provider shall ensure that high-risk AI systems are accompanied by instructions for use including: the level of accuracy, robustness, and cybersecurity against which the system has been tested and validated, and any known and foreseeable limitations.
Providers of high-risk AI systems shall report any serious incident to the market surveillance authorities of the Member States where that incident occurred. A “serious incident” includes any malfunctioning of a high-risk AI system that has led or may lead to the death of a person or serious damage to a person’s health.
High-risk AI systems that have been placed on the market or put into service before August 2, 2026 shall comply with this Regulation by August 2, 2027, provided they have not undergone significant changes in their design since their initial placing on the market or putting into service.
The TFAIA applies to “frontier developers” — persons who train a “frontier model” using more than 10²⁶ floating-point operations. A “large frontier developer” additionally has annual gross revenues exceeding $500 million. Students must assess whether Nexus Health meets these thresholds.
“Frontier model” means a foundation model trained using a quantity of computing power greater than 10²⁶ integer or floating-point operations. “Frontier developer” means a person that trains a frontier model and makes it publicly available to Californians.
A frontier developer shall not make, adopt, or enforce a rule, regulation, policy, or contract that prevents a covered employee from disclosing to the Attorney General, a federal authority, or a person with authority over the covered employee, information that the covered employee reasonably believes discloses that the frontier developer’s activities pose a specific and substantial danger to the public health or safety resulting from a catastrophic risk, or that the frontier developer has violated the TFAIA. A frontier developer shall not retaliate against a covered employee for such disclosures.
“Covered employee” means an employee responsible for assessing, managing, or addressing the risk of a critical safety incident in the company.
California Labor Code § 1102.5 (not reproduced in full) provides broader whistleblower protections for employees who report violations of state or federal law to government agencies. Students should note whether § 1102.5 may provide an independent basis for protection where the TFAIA does not apply.
If a lawyer for an organization knows that an officer, employee, or other person associated with the organization is engaged in action, intends to act, or refuses to act in a matter related to the representation that is a violation of a legal obligation to the organization, or a violation of law that reasonably might be imputed to the organization, and that is likely to result in substantial injury to the organization, then the lawyer shall proceed as is reasonably necessary in the best interest of the organization. Unless the lawyer reasonably believes that it is not necessary in the best interest of the organization to do so, the lawyer shall refer the matter to higher authority in the organization.
A lawyer may reveal information relating to the representation of a client to the extent the lawyer reasonably believes necessary to prevent reasonably certain death or substantial bodily harm.
A lawyer may reveal information relating to the representation of a client to the extent the lawyer reasonably believes necessary to prevent the client from committing a crime or fraud that is reasonably certain to result in substantial financial injury to another and in furtherance of which the client has used or is using the lawyer’s services.
In representing a client, a lawyer shall exercise independent professional judgment and render candid advice. In addition to legal considerations, a lawyer may refer to other considerations such as moral, economic, social and political factors, that may be relevant to the client’s situation.
The CPPA announced that regulations covering cybersecurity audits, risk assessments, and automated decisionmaking technology were approved on September 22, 2025 and take effect January 1, 2026, with ADMT-specific consumer rights operative January 1, 2027. The regulations require businesses using ADMT for significant decisions to provide pre-use notices and honor opt-out rights. Risk assessments are required before initiating processing activities posing significant risk, including use of ADMT for significant decisions affecting healthcare access.
Dana Voss has asked you to prepare an interoffice memorandum analyzing Nexus Health’s legal exposure under three frameworks: (1) the CCPA/CPRA and finalized ADMT Regulations; (2) the EU AI Act; and (3) California’s Transparency in Frontier Artificial Intelligence Act (SB 53).
For each framework, address:
Your memo must engage honestly with scope limitations. For SB 53, you must analyze whether Nexus Health and ARIA fall within the statute’s definitions. If a framework does not fully apply, explain the gap and identify what residual risk remains.
Your memo should also assess how California’s regulatory trajectory — the ADMT regulations effective January 1, 2027 — affects compliance planning even now.
Drafting note: The memo is privileged and candid. Do not soft-pedal bad facts.Write a client letter to Dana Voss responding to the CPPA inquiry (Document 2). Your letter must address three questions:
Dr. Mehta’s email (Document 5) raises professional responsibility questions. Draft a section of an internal ethics memo addressing:
Use this checklist to self-assess your response before submitting. I will look for evidence of each item in your written work.
Interactive Timeline of Rhetorical History 8th Century BCE – Epic Poetry Rhetoric had not yet…
Here is a template to build your very own Multi-State Performance "style" exam. After you've…
Oh, Claude! § § § Three students unable to express their Contracts analysis in fewer…
I want my students to have experience with Adobe Acrobat and pdfs before their first…
As so often happens in the land of academia, I've been so busy with teaching,…
For the first semester of legal writing, I set aside a few minutes at the…