# Submit risk assessment information to the California Privacy Protection Agency each year

- **Record type**: Obligation
- **Instrument**: California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits
- **Jurisdiction**: California (United States)
- **Category**: record_keeping
- **Binding**: Yes
- **Applies from**: 2028-04-01
- **Provision**: Cal. Code Regs. tit. 11, § 7157

## In brief

Submit risk assessment information to the California Privacy Protection Agency each year is a legal requirement under the California CPPA automated decision-making rules in California (United States) (Cal. Code Regs. tit. 11, § 7157). It applies from 1 April 2028. The record carries 2 evidence examples.

## What the duty requires

For risk assessments conducted in 2026 and 2027, the business submits information to the Agency by 1 April 2028, and for later years by 1 April of the following year. The submission includes the business's name and a point of contact, the period covered, the number of assessments conducted or updated in total and per processing activity, and whether they involved each listed category of personal and sensitive personal information, among other items listed in § 7157(b).

## What an organisation does about it

Keep a register of assessments by year and activity, with the personal-information categories each involved, so the annual submission can be compiled; name the point of contact.

## Controls that meet this duty

- Automatic event logging and record retention (supports): https://aipolicytracker.org/controls/record-keeping-and-logging
- AI governance policy and accountability structure (supports): https://aipolicytracker.org/controls/ai-governance-policy-and-accountability

## Parent instrument

- California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits
  - Record: https://aipolicytracker.org/policies/us-california-cppa-admt-regulations
  - Context file: https://aipolicytracker.org/policies/us-california-cppa-admt-regulations.md

## Provenance

- **Permanent id**: AIPT-OBL-0122 (https://aipolicytracker.org/id/AIPT-OBL-0122; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission
- **Official source**: https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf
- **Provision**: Cal. Code Regs. tit. 11, § 7157
- **Review status**: pending review
- **Confidence**: high
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-11-12
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Submit risk assessment information to the California Privacy Protection Agency each year (California CPPA automated decision-making rules)" [AIPT-OBL-0122, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0122 (accessed 12 November 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.