CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits

What it is

In September 2025 the California Office of Administrative Law approved a package of regulations under the California Consumer Privacy Act (CCPA) covering three new areas. They are automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits. The California Privacy Protection Agency (CPPA) Board adopted the package on 24 July 2025, and it took effect on 1 January 2026. The regulations sit in Title 11 of the California Code of Regulations, with the ADMT rules in Article 11 (sections 7200 to 7222) and risk assessments in Article 10 (sections 7150 to 7157).

For AI governance these are the most detailed rules in force in any US state. They define what ADMT is, when using it triggers obligations, what consumers must be told, and what a risk assessment has to contain.

Who it applies to

The regulations apply to businesses subject to the CCPA, broadly for-profit businesses doing business in California that meet the Act’s revenue or data-volume thresholds, when they process the personal information of California consumers. Under the CCPA, consumers include employees, job applicants and independent contractors, so workplace uses are in scope.

ADMT means technology that processes personal information and uses computation to replace, or substantially replace, human decision-making. A decision is substantially replaced when the output is used without meaningful human involvement. The ADMT rules apply when a business uses ADMT to make a significant decision about a consumer. A significant decision is one that results in the provision or denial of any of the following.

• financial or lending services
• housing
• education enrolment or opportunities
• employment or independent contracting opportunities or compensation
• healthcare services

What it requires

Pre-use notice. A business using ADMT for a significant decision gives the consumer a pre-use notice, at or before the point it collects the personal information it will process with ADMT. The notice explains the purpose, the consumer’s right to opt out (or the exception being relied on), the right to access information about the ADMT and how the technology works. It can be folded into the existing notice at collection if it carries the required content.

Opt-out. Consumers can opt out of the use of ADMT for a significant decision unless an exception applies. The main one is the human appeal exception, where the business lets the consumer appeal to a human reviewer who has authority to overturn the decision.

Access. On request the business explains how it used ADMT for a decision about the consumer, including the logic in plain terms and the outcome.

Risk assessments. Before starting processing that presents significant risk to consumers’ privacy, a business conducts and documents a risk assessment. The listed triggers include selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, and using automated processing to infer traits such as performance at work, health or economic situation from systematic observation of applicants, students or employees. The assessment records the purpose, the categories of data, the benefits and negative impacts, the safeguards, and who approved the processing. Businesses keep each assessment for as long as the processing continues or five years after completion, whichever is later, and submit summary information to the CPPA each year.

Cybersecurity audits. Businesses whose processing presents significant security risk complete an independent annual cybersecurity audit, phased in by revenue from 2028 to 2030.

Key dates

• 1 January 2026. Regulations take effect. Risk assessments are required before new in-scope processing begins.
• 1 January 2027. A business already using ADMT for significant decisions must comply with the ADMT rules by this date. New uses after it must comply from the start.
• 31 December 2027. Risk assessments due for in-scope processing that began before 2026 and continues.
• 1 April 2028. Risk assessment information for 2026 and 2027 submitted to the CPPA. First cybersecurity audits due for businesses with 2026 revenue above US$100 million.
• 1 April 2029 and 2030. Cybersecurity audits due for the remaining revenue bands.

How it relates to other frameworks

The regulations overlap with two other California regimes. The Civil Rights Council’s automated-decision system regulations apply anti-discrimination law to the same employment tools, and SB 53 covers frontier model developers. Outside California, Colorado SB 26-189 starts on the same day with a different trigger (material influence rather than replacement of human decision-making) and no risk assessment.

The regulations allow a single risk assessment to cover a comparable set of processing activities, and let a business reuse an assessment prepared for another law if it carries the required content. A data protection assessment under another state privacy law, or an impact assessment structured around ISO/IEC 42005, can be extended rather than duplicated. The model is closer to the GDPR than any other US law, though the trigger and the exceptions differ.

Working with it in Aicura

US state framework content is available in Aicura on the Enterprise tier and is switched on in Settings under Frameworks. The AI Register records which systems and agents take part in significant decisions, and the data each one uses. Each risk and impact assessment is tied to the exact version of the system’s register entry it read, so the assessment on file matches the version in use, and the Cadence view shows how long ago each one was last done and when it is going stale. Privacy policy reviews can be pointed at the framework so your notices are checked against it, and the Policy review report shows where each policy stands. Aicura gives guidance for your own judgement and your advisers’. It does not decide whether a use is ADMT or submit anything to the CPPA.