Latest
  1. Johns Hopkins Bayview tells 3,182 patients an employee put their health data into a public AI tool
  2. China’s AI compute access expected to double in 2027, with US-designed chips about 65 per cent
  3. UK commits £100m to national AI Biosecurity Lab
  4. Moonshot AI releases Kimi K3.1 Pro with 1-million-token context window
  5. Residents in Newport and Cardiff oppose hyperscale datacentres near homes
  6. Study: Grok 4.7 picked Republicans in 92% of forced midterm answers, GPT-6.1 Sol picked Democrats in 97%
  7. Attackers exploiting the PHP flaws hand the break-in to AI agents, Unit 42 says
  8. Elvis Presley’s rightsholders sue Anthropic over training on 274 songs

Rules / CCPA ADMT regulations / 11 CCR Section 7157

11 CCR Section 7157, CCPA ADMT regulations (California)

Submit risk assessment information to the CPPA, including counts by processing type and an executive's attestation under penalty of perjury, by 1 Apr 2028 for 2026-2027 assessments, then by each 1 Apr.

WTA-R-US-CA-0003-003 Permanent ID

Scope

Applies to businesses subject to the CCPA. The CPPA or Attorney General may demand full risk assessment reports, due within 30 days (7157(e)).

Dates. Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026.

Penalty. Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).

Source11 CCR Section 7157 of the CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity AuditsChecked against the official text on 8 Oct 2026.

History

No changes to this obligation since we started recording on 8 Oct 2026. All changes

Cite this obligation

WTA-R-US-CA-0003-003: 11 CCR Section 7157, CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-003/ (checked 8 Oct 2026).

Other obligations under CCPA ADMT regulations

  1. WTA-R-US-CA-0003-00411 CCR Section 7120-7124BusinessesFrom 1 Apr 2028

    Complete an annual independent cybersecurity audit if your processing presents significant security risk, and certify completion to the CPPA by each 1 Apr; the first report is due 1 Apr 2028, 2029 or 2030 by revenue.

  2. WTA-R-US-CA-0003-00111 CCR Section 7150, 7152, 7155(a)AnyoneSince 1 Jan 2026

    Conduct and document a risk assessment before starting processing that presents significant privacy risk, including using ADMT for significant decisions or training ADMT or facial recognition, and review it at least every three years.

  3. WTA-R-US-CA-0003-00211 CCR Section 7153ProvidersSince 1 Jan 2026

    Give any business to which you make available ADMT trained on personal information, for significant decisions, all available facts it needs to conduct its own risk assessment.

  4. WTA-R-US-CA-0003-00511 CCR Section 7220DeployersFrom 1 Jan 2027

    Give consumers a Pre-use Notice at or before collecting their data for ADMT use in significant decisions, explaining the specific purpose, how the ADMT works, and how to opt out (or appeal) and access ADMT information.

  5. WTA-R-US-CA-0003-00611 CCR Section 7221(a)-(f)DeployersFrom 1 Jan 2027

    Let consumers opt out of ADMT used for significant decisions through at least two easy methods, unless an exception applies, such as offering an appeal to a qualified human reviewer with authority to overturn the decision.

  6. WTA-R-US-CA-0003-00711 CCR Section 7221(m)-(n)DeployersFrom 1 Jan 2027

    Stop processing a consumer's personal information with the ADMT within 15 business days of an opt-out request and tell service providers and others processing it to do the same.

  7. WTA-R-US-CA-0003-00811 CCR Section 7222DeployersFrom 1 Jan 2027

    Explain in plain language, when a consumer requests access to ADMT, the specific purpose of its use, the logic of the ADMT, and the outcome and how its output was used in the decision.