{
 "record_id": "WTA-R-US-CA-0003-003",
 "kind": "obligation",
 "record": {
  "record_id": "WTA-R-US-CA-0003-003",
  "provision": "11 CCR Section 7157",
  "applies_to": [
   "Anyone"
  ],
  "duty": "Submit risk assessment information to the CPPA, including counts by processing type and an executive's attestation under penalty of perjury, by 1 Apr 2028 for 2026-2027 assessments, then by each 1 Apr.",
  "type": "Registration or filing",
  "status": "applies later",
  "applies_from": "2028-04-01",
  "url": "https://wheresthe.ai/id/WTA-R-US-CA-0003-003/",
  "rule": {
   "record_id": "WTA-R-US-CA-0003",
   "id": "us-ca-ccpa-admt-regulations-2025",
   "title": "CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits",
   "jurisdiction": "US-CA",
   "jurisdiction_name": "California",
   "url": "https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/"
  },
  "penalty": "Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).",
  "scope_note": "Applies to businesses subject to the CCPA. The CPPA or Attorney General may demand full risk assessment reports, due within 30 days (7157(e)).",
  "date_note": "Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026.",
  "source_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf",
  "verified_on": "2026-10-08",
  "citation": "WTA-R-US-CA-0003-003: 11 CCR Section 7157, CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-003/ (checked 2026-10-08)."
 },
 "history": [],
 "note": "Informational, not legal advice. Every record links to its official source; check it before relying on a record. Cite as \"Source: wheresthe.ai\"."
}