California CCPA ADMT Regulations — Risk Assessment

Q: Does California CCPA ADMT Regulations require Risk Assessment?

Yes. California CCPA ADMT Regulations addresses Risk Assessment through 1 provision.

Does California CCPA ADMT Regulations require Risk Assessment?

California • enacted

Yes — 1 provision

Requirements at a glance

This regulation imposes 6 specific requirements for Risk Assessment across 1 provision:

Pre-processing assessment — Risk assessment required before initiating high-risk processing including ADMT for significant decisions (§ 7150–7152)
Human oversight evaluation — Must evaluate adequacy of human oversight in risk assessment (§ 7152)
Triennial review — Review and update every 3 years, or within 45 days of a material change (§ 7155(a)(2)–(3))
Retention — Retain assessments for duration of processing or 5 years after completion, whichever is later (§ 7155(c))
Submission to CPPA — Attestation submitted to CPPA on CPPA request; first general submission April 1, 2028 for 2026–2027 assessments (§ 7157)
Pre-2026 activities — Businesses with processing initiated before 2026 must complete risk assessment by December 31, 2027 (§ 7155(b))

ADMT Risk Assessment #

Obligation:

Risk Assessment

enacted

Effective:

Jan 1, 2027

Risk tier:

high-risk

Scope:

Businesses using ADMT to make a **significant decision** concerning a consumer. "Significant decision" means one resulting in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services (11 CCR § 7001(ddd)). Each domain is defined in turn: housing excludes decisions based solely on availability, vacancy, or receipt of payment (§ 7001(ddd)(2)); education covers admission, credentials, and suspension or expulsion (§ 7001(ddd)(3)); employment covers hiring, work allocation and compensation, promotion, and demotion, suspension or termination (§ 7001(ddd)(4)). Advertising to a consumer is expressly not a significant decision (§ 7001(ddd)(6))

Requirements

Requirement	Details
Pre-processing assessment	Risk assessment required before initiating high-risk processing including ADMT for significant decisions (§ 7150–7152)
Human oversight evaluation	Must evaluate adequacy of human oversight in risk assessment (§ 7152)
Triennial review	Review and update every 3 years, or within 45 days of a material change (§ 7155(a)(2)–(3))
Retention	Retain assessments for duration of processing or 5 years after completion, whichever is later (§ 7155(c))
Submission to CPPA	Attestation submitted to CPPA on CPPA request; first general submission April 1, 2028 for 2026–2027 assessments (§ 7157)
Pre-2026 activities	Businesses with processing initiated before 2026 must complete risk assessment by December 31, 2027 (§ 7155(b))

Penalties

Violation	Fine
Per violation	$2,500 standard; $7,500 intentional

Sources: CPPA Regulations

View full regulation View obligation Obligation matrix