CCPA's New ADMT and Risk-Assessment Rules: What Your Business Must Do in 2026

On September 23, 2025, the California Privacy Protection Agency (CPPA) announced that California's Office of Administrative Law had approved a package of regulations that most privacy teams outside of California have not yet fully absorbed. The rules cover three areas: automated decision-making technology (ADMT), privacy risk assessments, and cybersecurity audits. They took effect on January 1, 2026.

These regulations create concrete obligations with staggered compliance deadlines through 2030, and they apply to any business that meets the CCPA/CPRA's existing thresholds and uses automated systems to make decisions about people, processes personal information at scale, or handles sensitive data. For mid-market companies that focus on cookie consent and DSAR workflows, the ADMT and risk-assessment rules introduce a new category of compliance work that touches how the business uses AI, algorithmic scoring, and automated profiling.

This article covers what the rules require, who they apply to, key deadlines, and what compliance teams should do now to prepare.

What the ADMT Rules Actually Say

The CPPA's ADMT regulations (Cal. Code Regs. tit. 11, §§ 7200-7222) govern the use of "automated decisionmaking technology," defined as technology that replaces or substantially replaces human decision-making. The scope is intentionally narrow: it applies only when ADMT is used to make "significant decisions" about consumers.

What Counts as a "Significant Decision"

The regulations define significant decisions as those that result in the provision or denial of:

• Financial or lending services
• Housing
• Education enrollment or opportunities
• Employment or independent contracting opportunities, including compensation
• Healthcare services

Advertising is not on the list: earlier drafts of the rules included it, and the final version dropped it. A recommendation engine that suggests products is not covered. A scoring model that determines whether someone qualifies for a loan is.

The narrow list may give mid-market companies a false sense of safety. Many use automated systems in hiring pipelines, lending workflows, insurance underwriting, or customer eligibility determinations without recognizing those uses as "automated decision-making" under this definition. If your business uses an algorithm, an AI model, or a rules engine to screen applicants, approve credit, set pricing for financial products, or determine eligibility for services, the ADMT rules apply.

Three Consumer Rights, Three Obligations

When a business uses ADMT to make a significant decision, it must provide:

1. Pre-use notice. Before the ADMT processes a consumer's personal information for a significant decision, the business must provide a clear notice explaining the specific purpose for which it plans to use the ADMT, the consumer's right to opt out and how to exercise it, and the consumer's right to access information about the ADMT. A generic statement that the business "uses automated tools" is not sufficient. The notice must describe the specific use and the specific decision it informs.
2. Right to opt out. Consumers can refuse ADMT processing for significant decisions. The business must offer at least two methods to opt out, and they must be easy to use. If the consumer opts out before processing begins, the business must not start. If the request comes after processing has already begun, the business must stop as soon as feasibly possible and no later than 15 business days after receiving the request, and tell its service providers and contractors to do the same. A cookie banner does not count as an opt-out method for ADMT.
3. Right to access. Consumers can request information about the business's ADMT use, including the specific purpose, the logic involved, how the ADMT's output fed into the decision, and how the decision applied to them specifically. This goes beyond a general description of the algorithm. It requires a consumer-specific explanation.

The main exception: a business does not have to offer the opt-out if it lets the consumer appeal the decision to a human reviewer who knows how to interpret the ADMT's output, considers the information the consumer provides, and has the authority to change the decision. Narrower exceptions cover some admission, hiring, and work-allocation decisions where the ADMT works for its purpose and does not unlawfully discriminate.

The Risk-Assessment Obligation Is Broader Than ADMT

While the ADMT rules apply to significant decisions, the risk-assessment requirements (Cal. Code Regs. tit. 11, §§ 7150-7157) sweep more broadly. A business must complete a privacy risk assessment before engaging in any processing activity that presents a "significant risk to consumers' privacy."

What Triggers the Requirement

Risk assessments are required for:

• Selling or sharing personal information (including sharing for cross-context behavioral advertising)
• Processing sensitive personal information
• Using ADMT for a significant decision (overlap with the ADMT rules)
• Using automated processing to infer traits such as performance, health, or behavior from systematic observation of job applicants, employees, contractors, students, or educational applicants
• Using automated processing to infer those traits from a consumer's presence at a sensitive location
• Processing personal information to train ADMT for significant decisions, or to train facial-recognition, emotion-recognition, or other identification technology

The trigger is based on the type of processing, not the size of the company. A 200-person SaaS company that processes sensitive personal information or runs behavioral advertising faces the same obligation as a large enterprise.

What the Assessment Must Contain

Each risk assessment must weigh the benefits of the processing activity against its risks to consumer privacy. Specifically, it must document:

• The categories of personal information to be processed
• The purpose of the processing
• The benefits to the business, the consumer, the public, and any other stakeholders
• The potential negative impacts on consumers' privacy and other rights
• The safeguards the business will implement to mitigate identified risks
• Whether the benefits outweigh the risks, and the reasoning behind that conclusion

These assessments must be reviewed at least every three years and updated within 45 calendar days of a material change in the processing activity. Processing activities that existed before January 1, 2026 must have a completed assessment by December 31, 2027.

Submission and Retention

By April 1, 2028, businesses must submit to the CPPA information about the risk assessments they conducted in 2026 and 2027, with an attestation signed by a member of the executive team. The CPPA or the California Attorney General's Office can request the full assessments at any time, and the business must produce them within 30 calendar days.

Cybersecurity Audits: Threshold-Based, Not Universal

The cybersecurity audit regulations (Cal. Code Regs. tit. 11, §§ 7120-7124) are the narrowest of the three rule sets. They apply only to businesses that meet one of the following two tests.

Revenue-from-data test: The business derived 50% or more of its annual revenue in the prior year from selling or sharing consumers' personal information.

Volume-plus-revenue test: The business meets the CCPA's annual gross revenue threshold ($26,625,000 since January 1, 2025, adjusted for inflation every two years) and in the prior year met at least one of these volume thresholds:

• Processed the personal information of 250,000 or more consumers or households
• Processed the sensitive personal information of 50,000 or more consumers

The revenue floor means most small businesses are excluded even if they handle significant volumes of personal information. But mid-market companies above that threshold should evaluate whether their data volumes put them in scope.

Covered businesses must complete an annual cybersecurity audit conducted by an independent, qualified professional. The audit must assess whether the business's cybersecurity program is appropriate for the size and complexity of the business and the nature and scope of its processing activities.

Certification Deadlines Are Staggered by Revenue

A business does not file the full audit report with the CPPA. It submits a certification of completion. However, the CPPA or Attorney General can request the full audit documentation, and businesses must retain audit records for at least five years.

The Timeline at a Glance

What This Means for Mid-Market Compliance Teams

The practical impact of these rules depends on what your business does with personal information and automated systems. Here is how to think about exposure:

If You Use Automated Systems in Decisions About People

Any AI model, algorithmic scoring system, rules engine, or automated workflow that contributes to decisions about employment, lending, housing, education, or healthcare is within scope. This includes:

• Applicant tracking systems with automated screening or ranking
• Credit scoring or risk models
• Automated insurance underwriting
• Customer eligibility determinations based on algorithmic analysis
• AI-powered fraud detection that affects individual account access

For each of these uses, you need a pre-use notice mechanism, an opt-out workflow (or a qualifying human appeal), and an access-request process by January 1, 2027. The infrastructure for consumer rights requests (intake, tracking, response) is the same infrastructure you already need for DSARs. The ADMT access right adds a layer: you must be able to explain not just what data you hold, but how the automated system used it in the decision about a specific consumer.

If You Process Sensitive Personal Information or Run Behavioral Advertising

The risk-assessment obligation applies regardless of whether you use ADMT. If your marketing stack shares personal information for behavioral advertising, or if your product collects sensitive personal information (health data, precise geolocation, financial account details, racial or ethnic origin), you need a documented risk assessment for each of those processing activities.

The assessment is not a one-time checkbox. It must be reviewed every three years or updated within 45 days of a material change. "We process this data because we always have" is not a valid weighing of benefits against risks.

If You Meet the Cybersecurity Audit Thresholds

Many mid-market companies above the revenue floor will need to evaluate whether their consumer volumes put them in scope. Companies approaching the thresholds should plan early: a qualified independent audit takes months to scope, execute, and document, and the five-year retention requirement means the documentation standard matters from the first audit forward.

What to Do Now

The compliance work these rules require is not exotic. It maps to capabilities most privacy programs already need or are building toward. The challenge is that it requires documentation, process design, and data mapping that many mid-market teams have not yet formalized.

Map your automated decision-making. Start with an inventory: where does your organization use algorithms, AI models, scoring systems, or automated workflows that contribute to decisions about people? For each use, document what data the system processes, what decision it informs, and who is affected. This is a data-mapping exercise, and it requires the same system-by-system inventory your DSAR workflow depends on.

Build pre-use notice and opt-out mechanisms. ADMT consumer rights require notice and opt-out infrastructure specific to each ADMT use case. This is privacy-request workflow design: intake forms, tracking, response templates, and an audit trail. If you already run a DSAR process, extend it. If you do not, the January 2027 deadline applies either way.

Conduct risk assessments for high-risk processing. Identify every processing activity that involves selling or sharing, sensitive personal information, ADMT for significant decisions, profiling of applicants and employees, or training identification technology. For each, document the purpose, the benefits, the risks, the safeguards, and the conclusion. Use a structured assessment framework rather than a narrative memo. These documents must be producible on 30 days' notice.

Review your privacy disclosures. The ADMT pre-use notice requirement means your privacy policy and any consumer-facing disclosures must accurately describe your automated decision-making practices. If your current policy uses generic language about "analytics" or "personalization," it will not meet the specificity standard these rules require.

Set calendar milestones. January 1, 2027, December 31, 2027, and April 1, 2028 are the dates that matter. Work backward from each. The ADMT consumer-rights deadline is about three months away. The risk-assessment completion deadline for pre-existing processing is 15 months out. The first CPPA submission is 18 months out. None of these will compress well.

California Is Writing the Rules Everyone Else Will Reference

The ADMT regulations matter beyond California for two reasons. First, the CCPA/CPRA's reach extends to any business that meets its thresholds and does business in California, not just businesses based there. A SaaS company in Austin with California customers is subject to these rules.

Second, California has historically set the template for US state privacy legislation. The original CCPA catalyzed the wave of comprehensive privacy laws now in effect in about 20 states. The ADMT regulations are among the first state rules on automated decision-making to actually take effect. Colorado's AI Act, originally set for 2026, was delayed and scaled back, and the EU AI Act's high-risk obligations slipped to 2027 and 2028. California's rules are live now, and they provide the clearest signal of where US regulation of automated decision-making is heading.

For organizations building privacy programs, the investment in ADMT compliance is not California-specific infrastructure. The data mapping, risk assessment, and consumer-rights workflows these rules require overlap with GDPR's DPIA requirements, the EU AI Act's transparency obligations, and what the next wave of US state laws is likely to demand.

Key Takeaways

• California's ADMT, risk-assessment, and cybersecurity-audit regulations have been in force since January 1, 2026. These are not proposals.
• ADMT consumer rights (pre-use notice, opt-out, access) apply from January 1, 2027 for businesses already using automated decision-making in significant decisions.
• Risk assessments are required before any high-risk processing and must be producible on 30 days' notice. The first CPPA submission is due April 1, 2028.
• The compliance work maps to existing privacy-program capabilities: data mapping to inventory automated systems, privacy-request workflows to handle the new consumer rights, and risk-assessment documentation to satisfy the regulatory obligation.
• California is the template. Building for these rules now means building the infrastructure other jurisdictions will require next.

Concord brings data mapping, privacy requests, and policy generation together on one platform, so the inventory, the consumer-rights workflow, and the disclosures these rules call for stay in sync. Book a demo to see how it works.

Sources

• CPPA: Approved regulations text (CCPA updates, cybersecurity audits, risk assessments, ADMT)
• CPPA: California finalizes regulations to strengthen consumers' privacy (September 23, 2025)
• CPPA: Adjusted CCPA monetary thresholds (December 17, 2024)