Latest
  1. Johns Hopkins Bayview tells 3,182 patients an employee put their health data into a public AI tool
  2. China’s AI compute access expected to double in 2027, with US-designed chips about 65 per cent
  3. UK commits £100m to national AI Biosecurity Lab
  4. Moonshot AI releases Kimi K3.1 Pro with 1-million-token context window
  5. Residents in Newport and Cardiff oppose hyperscale datacentres near homes
  6. Study: Grok 4.7 picked Republicans in 92% of forced midterm answers, GPT-6.1 Sol picked Democrats in 97%
  7. Attackers exploiting the PHP flaws hand the break-in to AI agents, Unit 42 says
  8. Elvis Presley’s rightsholders sue Anthropic over training on 274 songs

Latest / Work and education

Rule changeWorkFinanceCaliforniaReported

California approves privacy rules on automated decisions, risk assessments and audits

See how this story connects

Source: Baker McKenzie: New California requirements on AI risk assessments and cybersecurityAlso reported by Sheppard Mullin

California’s Office of Administrative Law approved the California Privacy Protection Agency’s regulations on 23 September 2025, after the agency’s board adopted them 5-0 on 24 July 2025. From 1 January 2027, businesses using automated decision-making technology for significant decisions on lending, housing, education, employment or health care must give notice, offer an opt-out, explain decisions on request and allow appeals. Businesses doing higher-risk processing must also carry out documented risk assessments, and cybersecurity audits phase in from April 2028 by revenue band.

Why it matters

Employers, lenders and landlords using algorithms on Californians must offer opt-outs and explanations from 2027 and run documented risk assessments.

When
23 Sep 2025
ID
WTA-N-2025-0117
Who
California Privacy Protection Agency
Rules involved

Summary by wheresthe.ai, from Baker McKenzie and the reporting credited above. We could not open the primary document, so it is marked Reported. Checked against the source on 9 Oct 2026.

Read the original at Baker McKenzie

Source copy: download the page as saved on 18 Oct 2026 (PDF). Documents the source offers: document 1 (PDF), document 2 (PDF). Also held by the Internet Archive.

Next stop on this Storyline: What happened nextCalifornia bans AI-only firing and requires notice of AI-driven mass layoffs

Cite this story

WTA-N-2025-0117: “California approves privacy rules on automated decisions, risk assessments and audits.” wheresthe.ai, 23 Sep 2025. https://wheresthe.ai/d/us-ca-cppa-admt-regulations-approved-2025-09/ (source: Baker McKenzie: New California requirements on AI risk assessments and cybersecurity).

Spotted an error? Email [email protected].