# California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits

- **Record type**: Policy instrument
- **Jurisdiction**: California (United States)
- **Instrument type**: Regulation
- **Status**: In force
- **Binding**: Yes
- **Issuing body**: California Privacy Protection Agency
- **Adopted**: 2025-09-22
- **In force**: 2026-01-01
- **Applies from**: 2027-01-01

## In brief

The California CPPA automated decision-making rules is a binding regulation of California (United States), issued by California Privacy Protection Agency. It has been in force since 1 January 2026; its first obligations apply from 1 January 2027. Businesses subject to the CCPA that use automated decision-making technology for significant decisions, or whose processing requires a risk assessment or cybersecurity audit.

## Summary

Regulations under the California Consumer Privacy Act on automated decision-making technology (ADMT), risk assessments and cybersecurity audits. Businesses that use ADMT to make significant decisions about consumers must comply from 1 January 2027, with further deadlines phased into 2028.

## Scope

Businesses subject to the CCPA that use automated decision-making technology for significant decisions, or whose processing requires a risk assessment or cybersecurity audit.

## Who it applies to

Businesses subject to the California Consumer Privacy Act.

## Key dates

Approved by the Office of Administrative Law 22 September 2025; effective 1 January 2026; ADMT compliance from 1 January 2027; a submission to the CPPA due 1 April 2028.

## Notes on dates

Dates as stated in search extracts of the official source; confirm against it.

## Provenance

- **Permanent id**: AIPT-POL-0208 (https://aipolicytracker.org/id/AIPT-POL-0208; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/policies/us-california-cppa-admt-regulations
- **Official source**: https://cppa.ca.gov/announcements/2025/20250923.html
- **Source document**: CPPA announcement: regulations approved by the Office of Administrative Law
- **Published by**: California Privacy Protection Agency
- **Review status**: pending review
- **Confidence**: medium
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-10-21
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits" [AIPT-POL-0208, record version 1, not yet verified]. https://aipolicytracker.org/id/AIPT-POL-0208 (accessed 21 October 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.