California ADMT and Risk Assessment Kit (CPPA)
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
On this page 7 sections
In brief
The California ADMT and Risk Assessment Kit (CPPA) is a free DOCX and XLSX kit. Version v1, built 12 November 2026, cites 14 recorded duties from 1 instrument, each linked to its official source. It is written for deployer / user organisation. It is licensed CC BY 4.0 and is not legal advice.
- Format
- DOCX and XLSX · Kit
- Version
- v1, built 12 Nov 2026
- Duties cited
- 5 from 1 instruments
- Rows from the records
- 9
- Written for
- Deployer / user organisation
- Price and licence
- Free · CC BY 4.0
What's inside
- Document: a notice, template or procedure for each recorded duty, citing its section and record
- ADMT uses sheet: system, significant decision, opt-out or exception, methods, reviewer, owner
- Opt-out log: received, stop-by date (15 business days), late flag, vendors notified, re-ask date
- Risk assessments sheet: § 7150 category, due date, three-year review, 45-day update, CPPA submission date
- Checklist and dates sheets from the record, with its review status
Dates: Dates are as recorded on the build date. California CPPA automated decision-making rules: Recorded on 15 October 2026 from search-engine extracts. On 11 November 2026 the duties, deadlines and dates below were read from the approved regulation text on the CPPA site (sections cited on each). No reviewer has yet confirmed them, so the record stays pending review.
Preview
The sheets and sections of version v1, as built. Columns marked ▾ have a dropdown; ƒ is a formula.
Sheet: Checklist
| Duty | Section | Applies from | Evidence a reviewer expects | Owner | Status ▾ | Evidence | Record |
|---|---|---|---|---|---|---|---|
| Give consumers a Pre-use Notice before using automated decision-making technology for a significant decision | Cal. Code Regs. tit. 11, § 7220 | 2027-01-01 | The published Pre-use Notice for each use, with the date it went live and where it is shown; A record of which significant decisions use ADMT and which notice c | https://aipolicytracker.org/obligations/us-california-ccpa-admt-pre-use-notice | |||
| Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal | Cal. Code Regs. tit. 11, § 7221 | 2027-01-01 | The opt-out link, form and second method, and a log of requests with dates received and processing stopped; Notices sent to service providers and contractors ab | https://aipolicytracker.org/obligations/us-california-ccpa-admt-opt-out | |||
| Answer consumers' requests to access information about how automated decision-making technology was used about them | Cal. Code Regs. tit. 11, § 7222 | 2027-01-01 | An access-response template per system and a log of requests answered; Contract terms requiring vendors to assist with access requests | https://aipolicytracker.org/obligations/us-california-ccpa-admt-access | |||
| Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions | Cal. Code Regs. tit. 11, §§ 7150, 7155 | 2026-01-01 | The risk assessment for each in-scope activity, with dates, versions and the material changes that triggered updates; The list of processing activities checked | https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment | |||
| Submit risk assessment information to the California Privacy Protection Agency each year | Cal. Code Regs. tit. 11, § 7157 | 2028-04-01 | The register of risk assessments by year and processing activity; Each year's submission and its confirmation | https://aipolicytracker.org/obligations/us-california-ccpa-risk-assessment-submission |
Sheet: ADMT uses
| System or tool | Significant decision it makes ▾ | Replaces or substantially replaces human decision-making? ▾ | In use since | Where the Pre-use Notice is shown | Opt-out offered, or exception relied on ▾ | Opt-out methods (at least two) | Human reviewer (if appeal exception) | Access response template | Owner |
|---|---|---|---|---|---|---|---|---|---|
| Rows are yours to fill; the dropdowns, formulas and colour rules are already in place. | |||||||||
One row per use of ADMT for a significant decision. Your assessment; this kit does not decide whether a use is in scope.
Sheet: Opt-out log
| Request received | System | Before or after processing began ▾ | Processing stopped on | Stop by (15 business days) ƒ | Late? ƒ | Service providers notified on | Earliest date to ask consent again ƒ |
|---|---|---|---|---|---|---|---|
| Rows are yours to fill; the dropdowns, formulas and colour rules are already in place. | |||||||
Do not record more personal information here than you need to track the request.
Sheet: Risk assessments
| Processing activity | Why it needs an assessment (§ 7150(b)) ▾ | Processing started | Assessment completed | Assessment due ƒ | Review by (3 years) ƒ | Material change on | Update by (45 days) ƒ | Submit to the CPPA by ƒ | Owner |
|---|---|---|---|---|---|---|---|---|---|
| Rows are yours to fill; the dropdowns, formulas and colour rules are already in place. | |||||||||
Keep every version for as long as the processing continues or five years after completion, whichever is later (§ 7155(c)).
Sheet: Dates
| Date | Milestone | Instrument | Jurisdiction | Source reference | Status | Confidence | Note | Record |
|---|---|---|---|---|---|---|---|---|
| 2026-01-01 | Regulations take effect; risk assessments required before new in-scope processing | California CPPA automated decision-making rules | California (United States) | CPPA announcement, 23 September 2025 | passed | medium | Effective date as stated in the CPPA announcement of 23 September 2025; the approved text leaves it for the Office of Administrative Law to fill in. | https://aipolicytracker.org/policies/us-california-cppa-admt-regulations |
| 2027-01-01 | ADMT duties apply to significant decisions (Pre-use Notice, opt-out, access) | California CPPA automated decision-making rules | California (United States) | Cal. Code Regs. tit. 11, § 7200(b) | scheduled | high | A business already using ADMT for a significant decision must comply no later than this date; one that starts later must comply whenever it uses it. | https://aipolicytracker.org/policies/us-california-cppa-admt-regulations |
| 2027-12-31 | Risk assessments due for processing that began before the regulations took effect | California CPPA automated decision-making rules | California (United States) | Cal. Code Regs. tit. 11, § 7155(b) | scheduled | high | Processing in a § 7150(b) category that began before the effective date and continues must have a documented risk assessment by this date. | https://aipolicytracker.org/policies/us-california-cppa-admt-regulations |
| 2028-04-01 | First submission of risk assessment information to the CPPA | California CPPA automated decision-making rules | California (United States) | Cal. Code Regs. tit. 11, § 7157(a)(1) | scheduled | high | Covers risk assessments conducted in 2026 and 2027; later years are due by 1 April of the following year. | https://aipolicytracker.org/policies/us-california-cppa-admt-regulations |
Document outline (DOCX)
- California automated decision-making technology (ADMT) and risk assessment kit
- Give consumers a Pre-use Notice before using automated decision-making technology for a significant decision
- Pre-use Notice to adapt
- Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal
- Opt-out handling procedure
- Answer consumers' requests to access information about how automated decision-making technology was used about them
- Access response template
- Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions
- Risk assessment procedure
- Submit risk assessment information to the California Privacy Protection Agency each year
- Annual submission procedure
How to use it
- 1Request the files. Enter your name, company and work email in the form on this page. The DOCX and XLSX download links arrive by email and work for 7 days.
- 2Read the README page. It states the version (v1), the dataset it was built from and the licence, so anyone reviewing your copy knows which records it reflects.
- 3Fill in your rows. Complete the "ADMT uses", "Opt-out log" and "Risk assessments" sheets for your own systems. Dropdowns, formulas and colour rules are already set.
- 4Check the duties against your situation. The "Checklist" and "Dates" sheets list the recorded duties with their source references. Mark which apply to you and follow each link to the official text.
- 5Complete the document. Work through the DOCX sections (California automated decision-making technology (ADMT) and risk assessment kit) and replace each placeholder with your organisation's answer.
- 6Keep the evidence and watch for new versions. Link each completed row to the evidence that supports it. When the law on record changes, this template gets a new version and a changelog on this page.
Duties this template covers (5)
Each is cited in the file with its source reference and a link back to the record.
- Give consumers a Pre-use Notice before using automated decision-making technology for a significant decision
- Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal
- Answer consumers' requests to access information about how automated decision-making technology was used about them
- Conduct and document a risk assessment before processing that presents significant risk, including ADMT for significant decisions
- Submit risk assessment information to the California Privacy Protection Agency each year
Legal basis
Version history
| Version | Built | Dataset | What changed |
|---|---|---|---|
| v1 | d56995931cf8 | First version, built from dataset d56995931cf8. |
Only the latest version is served. A rebuild that changes the content adds a version; a rebuild that does not is skipped.
Frequently asked questions
What is in the California ADMT and Risk Assessment Kit (CPPA)?
Document: a notice, template or procedure for each recorded duty, citing its section and record. ADMT uses sheet: system, significant decision, opt-out or exception, methods, reviewer, owner. Opt-out log: received, stop-by date (15 business days), late flag, vendors notified, re-ask date. Risk assessments sheet: § 7150 category, due date, three-year review, 45-day update, CPPA submission date. Checklist and dates sheets from the record, with its review status.
Which duties does it cite?
5 recorded duties from California CPPA automated decision-making rules, including Cal. Code Regs. tit. 11, § 7220, Cal. Code Regs. tit. 11, § 7221, Cal. Code Regs. tit. 11, § 7222, Cal. Code Regs. tit. 11, §§ 7150, 7155 and Cal. Code Regs. tit. 11, § 7157. Each row links to the record, and the record to the official source.
Who is it for?
The duties it cites fall on deployer / user organisation. Whoever owns AI governance for those roles usually completes it, with the system owner supplying the facts.
Is it free?
Yes. Request the DOCX and XLSX with your work email on this page; the download links arrive by email, valid for 7 days. No account and no charge. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
How will I know when it changes?
Version v1 was built on 12 November 2026. The library is rebuilt daily; when a change to the records reaches this template it gets the next version, a changelog below and an entry in the templates feed.
Are the dates in it current?
Dates are as recorded on the build date. California CPPA automated decision-making rules: Recorded on 15 October 2026 from search-engine extracts. On 11 November 2026 the duties, deadlines and dates below were read from the approved regulation text on the CPPA site (sections cited on each). No reviewer has yet confirmed them, so the record stays pending review.
Does completing it make us compliant?
No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.