California Consumer Privacy Act and the ADMT, risk assessment and cybersecurity audit regulations

First determine whether the company meets the CCPA definition of a business. Effective 2025-01-01 the annual gross revenue threshold in Civil Code section 1798.140(d)(1)(A) is $26,625,000 as adjusted for inflation. The determination should be documented and reviewed annually because the risk assessment, cybersecurity audit and ADMT duties all depend on it.

Applies when

U.S. entities or cross-border operating entities of Chinese AI companies that collect personal information from California consumers.

Evidence to retain

• · Business-status determination memo covering revenue, consumer counts and the share of revenue from selling or sharing data
• · Annual review record
• · Applicability matrix across group entities

Estimated first-time effort: 2–5 person-days (estimate, not a commitment)

A business must conduct a risk assessment before initiating any processing that presents significant risk to consumer privacy. The enumerated activities are selling or sharing personal information; processing sensitive personal information (excluding processing of employee and independent contractor sensitive information solely for administering compensation payments, determining and storing employment authorization, administering benefits, providing legally required reasonable accommodation or statutory wage reporting); using ADMT for a significant decision concerning a consumer; and using automated processing to infer or extrapolate a consumer intelligence, ability, aptitude, work performance, economic situation, health including mental health, personal preferences, interests, reliability, predispositions, behaviour, location or movements based on systematic observation of that consumer acting as an education program applicant, job applicant, student, employee or independent contractor.

Applies when

Chinese companies doing AI recruiting, workforce analytics, education assessment, health scoring or behavioural profiling. The fourth trigger directly captures workplace monitoring and proctoring-style computer vision products.

Evidence to retain

• · Risk assessment report structured to the elements of section 7152
• · Processing inventory mapped to the triggering paragraphs
• · Evidence that the assessment predates the start of processing
• · Update triggers and records of assessment updates

Estimated first-time effort: 10–30 person-days (estimate, not a commitment)

For risk assessments conducted in 2026 and 2027 the business must submit the required information to the California Privacy Protection Agency no later than 2028-04-01. For assessments conducted after 2027 submission is due by April 1 of the following year. The submission covers the business name and a point of contact with name, phone and email, the time period covered by month and year, the number of risk assessments conducted or updated in total and per triggering activity, and whether those assessments involved each of the categories of personal and sensitive personal information in Civil Code sections 1798.140(v)(1)(A)-(L), (ae)(1)(A)-(G) and (ae)(2)(A)-(C).

Applies when

Every business that has triggered the risk assessment duty.

Deadline: Assessments from 2026-2027 by 2028-04-01; thereafter by April 1 of the following year

Evidence to retain

• · Register counting risk assessments per triggering activity
• · Submission working papers and receipt
• · Mapping table for the personal and sensitive personal information categories
• · Point-of-contact authorization and change records

Estimated first-time effort: 3–8 person-days (estimate, not a commitment)

A business that uses ADMT to make a significant decision concerning a consumer must provide a Pre-use Notice, and unless an exception applies must include in it the right to opt out of that use and how to exercise it. A business using ADMT for significant decisions before 2027-01-01 must be compliant no later than 2027-01-01; a business that begins on or after that date must be compliant at any time it is using ADMT for a significant decision.

Applies when

Businesses using algorithms in California for significant decisions such as hiring, promotion, termination, credit, housing, education or healthcare services, including the U.S. recruiting and risk teams of Chinese companies.

Deadline: Compliance required by 2027-01-01

Applies from: 2027-01-01

Evidence to retain

• · Pre-use Notice text and screenshots of where it is displayed
• · Inventory of ADMT uses distinguishing significant decisions from other uses
• · Delivery records and version control for the notice
• · Project plan and sign-off evidencing readiness by 2027-01-01

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

A business must establish and publicize channels and workflows for requests to opt out of ADMT (section 7221) and requests to access ADMT (section 7222). Where the business relies on an exception in section 7221(b) instead of offering an opt-out, it must say so in the Pre-use Notice and give the consumer the explanation that section requires.

Applies when

As above.

Applies from: 2027-01-01

Evidence to retain

• · Screenshots of the opt-out and access request intake pages
• · Request log recording intake time, identity verification, outcome and turnaround
• · Memo on any exception relied on and its legal basis
• · Records of human review and of notifying the consumer of outcomes

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

A business whose processing presents significant risk to consumer security must complete a cybersecurity audit. The triggers are meeting the threshold in Civil Code section 1798.140(d)(1)(C), or meeting the (d)(1)(A) revenue threshold and having processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding calendar year. First audit reports are phased by revenue: due 2028-04-01 where 2026 annual gross revenue exceeded $100,000,000 as of 2027-01-01, covering 2027-01-01 to 2028-01-01; due 2029-04-01 where 2027 revenue was between $50,000,000 and $100,000,000 as of 2028-01-01, covering 2028-01-01 to 2029-01-01; and due 2030-04-01 where 2028 revenue was below $50,000,000, covering 2029-01-01 to 2030-01-01. After 2030-04-01 the audit becomes a rolling annual obligation.

Applies when

Operating entities of Chinese AI products with large California user bases or large volumes of sensitive information.

Deadline: First report due 2028-04-01, 2029-04-01 or 2030-04-01 depending on the revenue tier

Evidence to retain

• · Trigger determination working papers with consumer, household and sensitive information counts
• · Cybersecurity audit report
• · Remediation register for audit findings with closure evidence
• · Revenue evidence for the phasing tier and the calendar reminders for each due date

Estimated first-time effort: 20–60 person-days (estimate, not a commitment)