Privacy Map

California. AI / automated decisions. Regulation

CCPA ADMT/Risk/Audit RegulationsCCPA Regulations on Automated Decisionmaking Technology, Risk Assessments, Cybersecurity Audits and Insurance (Cal. Code Regs. tit. 11, § 7000 et seq., 2025 update)

Partially in force

§1Summary

Synopsis

Requires businesses using ADMT for significant decisions to give pre-use notices, opt-out and access rights; requires risk assessments for high-risk processing; and mandates annual independent cybersecurity audits for businesses meeting risk thresholds.

Key themes
  • automated decisionmaking
  • pre-use notice
  • ADMT opt-out
  • risk assessments
  • independent cybersecurity audits
  • attestations to regulator
Unique features

First US state rules requiring independent annual cybersecurity audits and regulator-submitted risk assessment summaries.

SaaS relevance

SaaS businesses meeting CCPA thresholds that profile users or process sensitive data must run risk assessments; AI/HR-tech vendors will be asked to support customers' ADMT notices and opt-outs.

§2Obligations

Extraterritorial
Yes
DPO
No
Cross-border transfers
None
Maximum penalty
As CCPA

§3Dates

Key dates
  • Adopted
  • In force
  • Board adopted 2025-07-24; OAL approved 2025-09-23; general effect 2026-01-01; ADMT compliance 2027-01-01; risk assessment attestations due 2028-04-01; cybersecurity audit certifications due 2028-04-01 (>$100m revenue), 2029-04-01 ($50–100m), 2030-04-01 (<$50m).

§4Text and authority

Text
Authority
California Privacy Protection Agency (CalPrivacy)

§5Where it applies

Domestic law of
California

§6Sources and verification

Sources consulted
Verification

High confidence.