{"slug":"us-california-ccpa-risk-assessment","id":"AIPT-OBL-0121","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0121","title":"Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions","short_title":"Risk assessment","category":"impact_assessment","summary":"A business must conduct and document a risk assessment before starting processing that presents significant risk to consumers' privacy. The listed activities include selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, and certain automated processing that infers traits such as ability, performance at work, economic situation or health. Each assessment is reviewed at least every three years, updated within 45 calendar days of a material change, and kept for as long as the processing continues or five years after completion, whichever is later. Processing that began before the regulations took effect and continues must be assessed by 31 December 2027.\n","practical_action":"List processing activities in the § 7150 categories, assess each before it starts (and existing ones by 31 December 2027), schedule three-yearly reviews and a 45-day update on material change, and keep every version.","is_binding":true,"applies_from":"2026-01-01","section":"Article 10, §§ 7150, 7152, 7155","source_reference":"Cal. Code Regs. tit. 11, §§ 7150, 7155","official_source_url":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf","review_status":"pending_review","confidence_level":"high","last_verified_at":null,"reviewed_by":null,"actors":["deployer"],"sectors":["cross_sector"],"use_cases":["hiring_and_hr","health","finance_and_credit","education"],"applicability":[],"evidence_examples":[{"title":"The risk assessment for each in-scope activity, with dates, versions and the material changes that triggered updates","description":null,"artifact_type":"document"},{"title":"The list of processing activities checked against § 7150","description":null,"artifact_type":"document"}],"framework_mappings":[],"controls":[{"slug":"ai-system-inventory","title":"AI system inventory and classification","kind":"process","relationship":"supports","note":"Finding which processing activities are in scope.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-system-inventory"},{"slug":"privacy-and-data-protection-for-ai","title":"Privacy and data-protection controls for AI","kind":"process","relationship":"supports","note":"Privacy risk assessment of personal-information processing.","confidence_level":"high","url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai"},{"slug":"ai-impact-assessment","title":"AI impact and fundamental-rights impact assessment","kind":"process","relationship":"satisfies","note":"A documented assessment of the processing's risks before it starts.","confidence_level":"high","url":"https://aipolicytracker.org/controls/ai-impact-assessment"}],"url":"https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment","policy":{"slug":"us-california-cppa-admt-regulations","title":"California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits","status":"in_force","jurisdiction":"us-california","url":"https://aipolicytracker.org/policies/us-california-cppa-admt-regulations"}}