Latest
  1. Johns Hopkins Bayview tells 3,182 patients an employee put their health data into a public AI tool
  2. China’s AI compute access expected to double in 2027, with US-designed chips about 65 per cent
  3. UK commits £100m to national AI Biosecurity Lab
  4. Moonshot AI releases Kimi K3.1 Pro with 1-million-token context window
  5. Residents in Newport and Cardiff oppose hyperscale datacentres near homes
  6. Study: Grok 4.7 picked Republicans in 92% of forced midterm answers, GPT-6.1 Sol picked Democrats in 97%
  7. Attackers exploiting the PHP flaws hand the break-in to AI agents, Unit 42 says
  8. Elvis Presley’s rightsholders sue Anthropic over training on 274 songs

Rules / California

CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits

Partly in forceRegulationBinding

Updates the California Consumer Privacy Act regulations to give consumers rights to pre-use notice, opt-out and access when businesses use automated decision-making technology for significant decisions (e.g. employment, lending, housing, health care, education), and requires risk assessments and annual cybersecurity audits for high-risk processing. Applies to businesses subject to the CCPA.

Why it matters

Companies using AI to make or substantially replace human decisions about Californians need ADMT notices, opt-out/appeal paths and documented risk assessments.

What it requires

Impact assessmentConsumer rightsTransparency to usersData governance

Key obligations, provision by provision

8 obligations in article order. How IDs work

  1. WTA-R-US-CA-0003-00411 CCR Section 7120-7124BusinessesFrom 1 Apr 2028

    Complete an annual independent cybersecurity audit if your processing presents significant security risk, and certify completion to the CPPA by each 1 Apr; the first report is due 1 Apr 2028, 2029 or 2030 by revenue.

  2. WTA-R-US-CA-0003-00111 CCR Section 7150, 7152, 7155(a)AnyoneSince 1 Jan 2026

    Conduct and document a risk assessment before starting processing that presents significant privacy risk, including using ADMT for significant decisions or training ADMT or facial recognition, and review it at least every three years.

  3. WTA-R-US-CA-0003-00211 CCR Section 7153ProvidersSince 1 Jan 2026

    Give any business to which you make available ADMT trained on personal information, for significant decisions, all available facts it needs to conduct its own risk assessment.

  4. WTA-R-US-CA-0003-00311 CCR Section 7157AnyoneFrom 1 Apr 2028

    Submit risk assessment information to the CPPA, including counts by processing type and an executive’s attestation under penalty of perjury, by 1 Apr 2028 for 2026-2027 assessments, then by each 1 Apr.

  5. WTA-R-US-CA-0003-00511 CCR Section 7220DeployersFrom 1 Jan 2027

    Give consumers a Pre-use Notice at or before collecting their data for ADMT use in significant decisions, explaining the specific purpose, how the ADMT works, and how to opt out (or appeal) and access ADMT information.

  6. WTA-R-US-CA-0003-00611 CCR Section 7221(a)-(f)DeployersFrom 1 Jan 2027

    Let consumers opt out of ADMT used for significant decisions through at least two easy methods, unless an exception applies, such as offering an appeal to a qualified human reviewer with authority to overturn the decision.

  7. WTA-R-US-CA-0003-00711 CCR Section 7221(m)-(n)DeployersFrom 1 Jan 2027

    Stop processing a consumer’s personal information with the ADMT within 15 business days of an opt-out request and tell service providers and others processing it to do the same.

  8. WTA-R-US-CA-0003-00811 CCR Section 7222DeployersFrom 1 Jan 2027

    Explain in plain language, when a consumer requests access to ADMT, the specific purpose of its use, the logic of the ADMT, and the outcome and how its output was used in the decision.

Penalties

CCPA administrative fines of $2,500 per violation or $7,500 per intentional violation (inflation-adjusted)

SourceCalifornia Privacy Protection Agency: https://cppa.ca.gov/regulations/ccpa_updates.html Checked against the source on 4 Oct 2026. Adopted by the CPPA Board 24 Jul 2025 and approved by the Office of Administrative Law 22 Sep 2025; regulations effective 1 Jan 2026 with phased compliance (ADMT 1 Jan 2027; risk-assessment attestations and audits later).

Cite this record

WTA-R-US-CA-0003: CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. California Privacy Protection Agency. wheresthe.ai, https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/ (checked 4 Oct 2026).

History

  • Adopted changed from 22 Sep 2025 to 24 Jul 2025

More from California