Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions
Download: JSON · MarkdownUnder California CPPA automated decision-making rules, Cal. Code Regs. tit. 11, §§ 7150, 7155
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 8 sections
In brief
Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions is a legal requirement under the California CPPA automated decision-making rules in California (United States) (Cal. Code Regs. tit. 11, §§ 7150, 7155). A business must conduct and document a risk assessment before starting processing that presents significant risk to consumers' privacy.
- Jurisdiction
- California (United States)
- Nature
- Legal requirement
- Source reference
- Cal. Code Regs. tit. 11, §§ 7150, 7155
- Applies from
- 1 January 2026
- Who it binds
- Deployer / user organisation
- Evidence examples
- 2
- Controls that meet it
- 3
- Official source
- Open official text
- Verification
- Pending review · source-linked
What does it require?
A business must conduct and document a risk assessment before starting processing that presents significant risk to consumers' privacy. The listed activities include selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, and certain automated processing that infers traits such as ability, performance at work, economic situation or health. Each assessment is reviewed at least every three years, updated within 45 calendar days of a material change, and kept for as long as the processing continues or five years after completion, whichever is later. Processing that began before the regulations took effect and continues must be assessed by 31 December 2027.
Practical action
List processing activities in the § 7150 categories, assess each before it starts (and existing ones by 31 December 2027), schedule three-yearly reviews and a 45-day update on material change, and keep every version.
Who does it apply to?
- Sectors
- Cross-sector / all sectors
Applies from:
Which controls meet this duty?
Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.
-
satisfiesProcessAI system owner · once per ai systemAI impact and fundamental-rights impact assessment
Serves 12 recorded duties · evidence: AI impact assessment, Impact assessment approval, Impact assessment procedure and template
A documented assessment of the processing's risks before it starts.
-
supportsProcessAI governance lead · continuousAI system inventory and classification
Serves 13 recorded duties · evidence: AI system register, Risk-tier classification sign-off, AI intake and classification procedure
Finding which processing activities are in scope.
-
supportsProcessData protection officer · once per ai systemPrivacy and data-protection controls for AI
Serves 15 recorded duties · evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use
Privacy risk assessment of personal-information processing.
Templates that cover this duty
Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.
- Fundamental Rights Impact Assessment (FRIA)
Assessment · DOCX and XLSX · v6
- AI Impact Assessment
Assessment · DOCX and XLSX · v6
- California ADMT and Risk Assessment Kit (CPPA)
Kit · DOCX and XLSX · v1
- AI Workforce Impact Assessment
Assessment · DOCX and XLSX · v1
What evidence would a reviewer expect?
| Evidence | Type | Notes |
|---|---|---|
| The risk assessment for each in-scope activity, with dates, versions and the material changes that triggered updates | document | |
| The list of processing activities checked against § 7150 | document |
Frequently asked questions
Is this a legal requirement?
Yes. It is a legal requirement under California CPPA automated decision-making rules (Cal. Code Regs. tit. 11, §§ 7150, 7155).
When does this obligation apply?
It applies from 1 January 2026.
What evidence shows compliance?
A reviewer would expect: The risk assessment for each in-scope activity, with dates, versions and the material changes that triggered updates; The list of processing activities checked against § 7150.
Which controls satisfy this obligation?
AI system inventory and classification; Privacy and data-protection controls for AI; AI impact and fundamental-rights impact assessment.
What should an organisation do in practice?
List processing activities in the § 7150 categories, assess each before it starts (and existing ones by 31 December 2027), schedule three-yearly reviews and a 45-day update on material change, and keep every version.
Cite this record
AIPolicyTracker (2026). “Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions (California CPPA automated decision-making rules)” [AIPT-OBL-0121, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0121 (accessed 12 November 2026). Data licensed CC BY 4.0.
Permanent id AIPT-OBL-0121: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: CPPA announcement: regulations approved by the Office of Administrative Law, California Privacy Protection Agency, https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf.
BibTeX
@misc{aipolicytracker2026_conductanddocumentariska,
author = {{AIPolicyTracker}},
title = {{Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions (California CPPA automated decision-making rules)}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment}},
url = {https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment},
urldate = {2026-11-12},
note = {Data licensed CC BY 4.0. Accessed 12 November 2026}
}
Change history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Similar obligations in other instruments
- Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits — India DPDP Act, India
- Conduct a data protection impact assessment for high-risk processing using new technologies — UAE PDPL, United Arab Emirates
- Deployers must complete impact assessments for high-risk AI — Colorado AI Act, Colorado (United States)
- Carry out a fundamental rights impact assessment before deployment — EU AI Act, European Union
- Carry out a data protection impact assessment for high-risk AI processing — ICO AI guidance, United Kingdom
- Map context, intended use and potential impacts (Map) — NIST AI RMF, United States (voluntary)
- Operators of high-impact AI should assess its impact on fundamental rights before use — AI Basic Act, South Korea (voluntary)
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.