# Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions

- **Record type**: Obligation
- **Instrument**: California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits
- **Jurisdiction**: California (United States)
- **Category**: impact_assessment
- **Binding**: Yes
- **Applies from**: 2026-01-01
- **Provision**: Cal. Code Regs. tit. 11, §§ 7150, 7155

## In brief

Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions is a legal requirement under the California CPPA automated decision-making rules in California (United States) (Cal. Code Regs. tit. 11, §§ 7150, 7155). A business must conduct and document a risk assessment before starting processing that presents significant risk to consumers' privacy.

## What the duty requires

A business must conduct and document a risk assessment before starting processing that presents significant risk to consumers' privacy. The listed activities include selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, and certain automated processing that infers traits such as ability, performance at work, economic situation or health. Each assessment is reviewed at least every three years, updated within 45 calendar days of a material change, and kept for as long as the processing continues or five years after completion, whichever is later. Processing that began before the regulations took effect and continues must be assessed by 31 December 2027.

## What an organisation does about it

List processing activities in the § 7150 categories, assess each before it starts (and existing ones by 31 December 2027), schedule three-yearly reviews and a 45-day update on material change, and keep every version.

## Controls that meet this duty

- AI system inventory and classification (supports): https://aipolicytracker.org/controls/ai-system-inventory
- Privacy and data-protection controls for AI (supports): https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai
- AI impact and fundamental-rights impact assessment (satisfies): https://aipolicytracker.org/controls/ai-impact-assessment

## Parent instrument

- California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits
  - Record: https://aipolicytracker.org/policies/us-california-cppa-admt-regulations
  - Context file: https://aipolicytracker.org/policies/us-california-cppa-admt-regulations.md

## Provenance

- **Permanent id**: AIPT-OBL-0121 (https://aipolicytracker.org/id/AIPT-OBL-0121; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment
- **Official source**: https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf
- **Provision**: Cal. Code Regs. tit. 11, §§ 7150, 7155
- **Review status**: pending review
- **Confidence**: high
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-11-12
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions (California CPPA automated decision-making rules)" [AIPT-OBL-0121, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0121 (accessed 12 November 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.