The three pieces

The California Privacy Protection Agency finalized regulations under the CCPA covering three related areas: automated decision-making technology, risk assessments, and cybersecurity audits. Law-firm summaries of the rules describe compliance dates of 1 January 2027 for the ADMT requirements, 31 December 2027 for risk assessments of existing activities with submissions of summaries starting in April 2028, and cybersecurity audit deadlines staggered by revenue, beginning for the largest businesses on 1 April 2028.

These sources were largely written around the rules' adoption, so confirm the final approved text and any later amendments with the agency before treating a date as fixed.

ADMT is described as technology that processes personal information and uses computation to replace or substantially replace human decision-making. Whether a human reviewer counts as meaningful involvement depends on whether they can understand and change the outcome.

What product and engineering teams will actually build

For ADMT used in significant decisions, expect to need pre-use notices, ways for consumers to opt out or request information in applicable cases, and an explanation of how the tool is used. Each of those is a user-facing flow plus a back-office process.

Risk assessments are triggered by activities such as selling or sharing personal information, processing sensitive data, and using ADMT for significant decisions. They need to be documented, reviewed on a cycle, and in some cases submitted to the regulator, which means building a repeatable internal workflow instead of a one-off document.

Notices and requests

Build the in-product notices and the intake route for opt-outs and information requests.

A repeatable assessment workflow

Create a template, owners, and a review cadence so each assessment is consistent and auditable.

A sensible timeline

Work backwards from the earliest date. Identify which of your features count as ADMT, design the notices and request flows, and pilot them well before the deadline. In parallel, set up the risk-assessment process and decide how you will evidence security controls for the audit.

These obligations sit on top of the broader state privacy landscape and our earlier guidance on chatbot data handling; treat them as one privacy engineering program.

Selling to California consumers or employees? Talk to us about scoping the privacy engineering work.

Key takeaways

  • California's CCPA regulations cover ADMT, risk assessments, and cybersecurity audits, with reported dates in 2027 and 2028.
  • Reported ADMT compliance date is 1 January 2027; risk assessments of existing activities by 31 December 2027; audits staggered by revenue starting April 2028.
  • Expect user-facing notices, request flows, and a repeatable assessment workflow to build.
  • Verify the final approved text, since many summaries predate final approval.
This is general information, not legal advice. Dates come from secondary summaries written around the rules' adoption and may have been refined; confirm with the California Privacy Protection Agency before relying on them.