{"slug":"us-california-ccpa-risk-assessment-submission","id":"AIPT-OBL-0122","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0122","title":"Submit risk assessment information to the California Privacy Protection Agency each year","short_title":"Risk assessment submission","category":"record_keeping","summary":"For risk assessments conducted in 2026 and 2027, the business submits information to the Agency by 1 April 2028, and for later years by 1 April of the following year. The submission includes the business's name and a point of contact, the period covered, the number of assessments conducted or updated in total and per processing activity, and whether they involved each listed category of personal and sensitive personal information, among other items listed in § 7157(b).\n","practical_action":"Keep a register of assessments by year and activity, with the personal-information categories each involved, so the annual submission can be compiled; name the point of contact.","is_binding":true,"applies_from":"2028-04-01","section":"Article 10, § 7157","source_reference":"Cal. Code Regs. tit. 11, § 7157","official_source_url":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf","review_status":"pending_review","confidence_level":"high","last_verified_at":null,"reviewed_by":null,"actors":["deployer"],"sectors":["cross_sector"],"use_cases":[],"applicability":[],"evidence_examples":[{"title":"The register of risk assessments by year and processing activity","description":null,"artifact_type":"document"},{"title":"Each year's submission and its confirmation","description":null,"artifact_type":"document"}],"framework_mappings":[],"controls":[{"slug":"record-keeping-and-logging","title":"Automatic event logging and record retention","kind":"technical","relationship":"supports","note":"Counts and categories by year come from the assessment register.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/record-keeping-and-logging"},{"slug":"ai-governance-policy-and-accountability","title":"AI governance policy and accountability structure","kind":"policy","relationship":"supports","note":"A named point of contact and an owner for the annual submission.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-governance-policy-and-accountability"}],"url":"https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission","policy":{"slug":"us-california-cppa-admt-regulations","title":"California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits","status":"in_force","jurisdiction":"us-california","url":"https://aipolicytracker.org/policies/us-california-cppa-admt-regulations"}}