Artificial Intelligence Policy Tracker
Search
Menu
Legal requirement Record keeping and logging California (United States) In force

Submit risk assessment information to the California Privacy Protection Agency each year

Download: JSON · MarkdownUnder California CPPA automated decision-making rules, Cal. Code Regs. tit. 11, § 7157

Pending review · linked to the official source, waiting for a reviewer to confirm it (a factual check against the official source, not a legal review or legal advice)
What this label means
Verified
— a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
Pending review
— linked to the official source and in the queue for a reviewer to confirm.
Source-linked
— linked to the official source, not yet confirmed by a reviewer.
Verification policy and current standing · a factual check, not legal advice.
No change recorded as of 11 Nov 2026 · official source last checked
Open official source Sign in to follow

Report a correction How we verify

On this page 8 sections

In brief

Submit risk assessment information to the California Privacy Protection Agency each year is a legal requirement under the California CPPA automated decision-making rules in California (United States) (Cal. Code Regs. tit. 11, § 7157). It applies from 1 April 2028. The record carries 2 evidence examples.

Instrument
California CPPA automated decision-making rules
Jurisdiction
California (United States)
Nature
Legal requirement
Source reference
Cal. Code Regs. tit. 11, § 7157
Applies from
1 April 2028
Who it binds
Deployer / user organisation
Evidence examples
2
Controls that meet it
2
Official source
Open official text
Verification
Pending review · source-linked

What does it require?

For risk assessments conducted in 2026 and 2027, the business submits information to the Agency by 1 April 2028, and for later years by 1 April of the following year. The submission includes the business's name and a point of contact, the period covered, the number of assessments conducted or updated in total and per processing activity, and whether they involved each listed category of personal and sensitive personal information, among other items listed in § 7157(b).

Practical action

Keep a register of assessments by year and activity, with the personal-information categories each involved, so the annual submission can be compiled; name the point of contact.

Who does it apply to?

Applies from:

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

  • supportsTechnical measureEngineering lead · continuous
    Automatic event logging and record retention

    Serves 11 recorded duties · evidence: AI system event logs, Log schema and retention standard, Log integrity and retention check

    Counts and categories by year come from the assessment register.

  • supportsPolicyExecutive sponsor for AI · annual
    AI governance policy and accountability structure

    Serves 17 recorded duties · evidence: AI policy, Board or executive approval of the AI policy, AI governance forum minutes

    A named point of contact and an owner for the annual submission.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

All 5 templates that cover it →

What evidence would a reviewer expect?

Evidence examples
EvidenceTypeNotes
The register of risk assessments by year and processing activitydocument
Each year's submission and its confirmationdocument

Frequently asked questions

Is this a legal requirement?

Yes. It is a legal requirement under California CPPA automated decision-making rules (Cal. Code Regs. tit. 11, § 7157).

When does this obligation apply?

It applies from 1 April 2028.

What evidence shows compliance?

A reviewer would expect: The register of risk assessments by year and processing activity; Each year's submission and its confirmation.

Which controls satisfy this obligation?

Automatic event logging and record retention; AI governance policy and accountability structure.

What should an organisation do in practice?

Keep a register of assessments by year and activity, with the personal-information categories each involved, so the annual submission can be compiled; name the point of contact.

Cite this record

AIPolicyTracker (2026). “Submit risk assessment information to the California Privacy Protection Agency each year (California CPPA automated decision-making rules)” [AIPT-OBL-0122, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0122 (accessed 12 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0122: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: CPPA announcement: regulations approved by the Office of Administrative Law, California Privacy Protection Agency, https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf.

BibTeX 
@misc{aipolicytracker2026_submitriskassessmentinfo,
  author       = {{AIPolicyTracker}},
  title        = {{Submit risk assessment information to the California Privacy Protection Agency each year (California CPPA automated decision-making rules)}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission}},
  url          = {https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission},
  urldate      = {2026-11-12},
  note         = {Data licensed CC BY 4.0. Accessed 12 November 2026}
}

Change history

No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.

Similar obligations in other instruments

Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.