California · CCPA · Risk assessments
CCPA risk assessments: who needs one, what goes in it, and when it is due
The CCPA regulations, in force since 1 January 2026, require a documented risk assessment before a business starts certain kinds of processing. For processing that was already running, the deadline is 31 December 2027, and the first filing with the CPPA follows on 1 April 2028.
Counsel writes the weighing of risk against benefit. The report also has to describe what your systems actually do: what a tool reads, what its output triggers, which safeguards run and how you know. That part comes out of your code and logs, and it is what we build.
This page is a builder’s read of the adopted regulation, with section numbers. It is not legal advice. Where we are giving our reading and not the text, it is labelled.
Who has to do one
You need to pass two tests. First, you are a covered business. Second, some of your processing is on the section 7150(b) list.
1. Are you a covered business?
Civil Code section 1798.140(d)(1) defines a business as an entity run for profit that collects consumers’ personal information, does business in California and meets at least one of three thresholds. One is enough.
Gross annual revenue above $26,625,000
The inflation-adjusted version of the original $25 million, in force since January 2025 and revisited every two years against CPI. Generally read as total global gross revenue, not California revenue. So a company with modest California business can clear it on the strength of everywhere else.
Buying, selling or sharing the personal information of 100,000 or more California consumers or households in a year
A company well under the revenue line can still be covered this way. Checking only the revenue figure and stopping is the common miss.
Deriving 50% or more of annual revenue from selling or sharing personal information
Independent of company size.
2. Is any of your processing on the list?
Section 7150(b) names six kinds of processing that present significant risk to consumers’ privacy. A business that does any of them must conduct a risk assessment before it starts.
- Selling or sharing personal information Section 7150(b)(1)
- Processing sensitive personal information Section 7150(b)(2)Carve-out at (b)(2)(A): an employee’s or contractor’s sensitive personal information used solely and specifically to administer pay, determine and store work authorization, administer benefits, provide legally required accommodation or meet legally required wage reporting.
- Using ADMT for a significant decision concerning a consumer Section 7150(b)(3)
- Automated processing that infers traits such as ability, performance at work, reliability or behavior from systematic observation of an applicant, student, employee or contractor Section 7150(b)(4)
- Automated processing that infers those traits from a consumer’s presence in a sensitive location Section 7150(b)(5)
- Processing personal information the business intends to use to train an ADMT for a significant decision, or to train facial-recognition, emotion-recognition or similar identification or profiling technology Section 7150(b)(6)“Intends to use” includes already using, planning to use, permitting others to use, and advertising or marketing the use.
What has to be produced
Section 7152(a) lists what the report must contain. It rejects generic purposes and generic benefits by name, so “to improve our services” does not pass.
The report
- The purpose of the processing, stated specifically. The text rejects “to improve our services” and “security purposes” as too generic. Section 7152(a)(1)
- The categories of personal information processed, sensitive ones included, and the minimum necessary for the purpose. Section 7152(a)(2)
- The operational elements: how the information is collected, used, disclosed and retained, and its sources; retention periods or the criteria for them; how the business interacts with the consumers; the approximate number of consumers; the disclosures made to them; the service providers, contractors or third parties that receive it, and why. Section 7152(a)(3)
- For ADMT used for a significant decision: the logic, including its assumptions and limitations, and the output and how the business uses it to make the decision. Section 7152(a)(3)(G)
- The benefits to the business, the consumer, other stakeholders and the public, again not in generic terms. Section 7152(a)(4)
- The negative impacts on consumers’ privacy, with their sources and causes. Section 7152(a)(5)
- The safeguards the business plans to implement, such as safeguards that address the impacts named above. Section 7152(a)(6)
- Whether the business will initiate the processing. Section 7152(a)(7)
- The individuals who provided the information, other than legal counsel giving legal advice. Section 7152(a)(8)
- The date of review and approval, and the names and positions of the reviewers and approvers. Someone with authority to participate in deciding whether to start the processing must approve it. Section 7152(a)(9)
The filing to the CPPA
Section 7157(b). A submission about your assessments, made through the Agency’s website. The reports themselves stay with you until the Agency or the Attorney General asks for them.
- The business name and a point of contact
- The time period covered, by month and year
- The number of assessments conducted or updated, in total and for each 7150(b) activity
- Whether those assessments involved each listed category of personal information and sensitive personal information
- An attestation under penalty of perjury, signed by a member of executive management (7157(c))
- The name and title of the person submitting, and the date
The dates
Four dated milestones, each from a numbered section. The assessment also has clocks that keep running after the first one is met.
| Date | Milestone | Applies to | Section |
|---|---|---|---|
| CCPA regulations take effect | All covered businesses | 7001 | |
| ADMT rights live: pre-use notice, opt-out, access, appeal | All covered businesses using ADMT for a significant decision | 7200(b) | |
| Risk assessments documented | Processing that began before 1 January 2026 and continues past it | 7155(b) | |
| First risk-assessment filing to the CPPA | Businesses with documented assessments covering 2026 and 2027 | 7157(a)(1) |
The clocks that keep running
- Conduct and document the assessment before starting any processing activity on the 7150(b) list. Section 7155(a)(1)
- Review, and update as necessary, at least once every three years. Section 7155(a)(2)
- Update after a material change as soon as feasibly possible, and no later than 45 calendar days from the date of the change. Section 7155(a)(3)
- Keep every assessment, original and updated versions, for as long as the processing continues or five years after the assessment is completed, whichever is later. Section 7155(c)
- For assessments conducted after 2027, submit the required information by 1 April following each year in which assessments were conducted. Section 7157(a)(2)
- Submit the assessment reports within 30 calendar days of a request from the Agency or the Attorney General. Section 7157(e)
What ivector builds
Your counsel and executives own the judgment calls: the purpose, the weighing of benefits against risks, whether to proceed, and the signature. We build the part that has to be true of your systems, and the means of keeping it true.
- 01
The data inventory for the tool, taken from the system
What the tool reads and stores, drawn from schemas, queries and logs rather than the design document. It feeds the categories of personal information, the sources, the retention settings and the vendors that receive the data.
Section 7152(a)(2)Section 7152(a)(3)
- 02
The logic and the output, described as built
For an automated decision: the inputs, the thresholds, what sits behind the score, its stated assumptions and limits, and what the system does with the output next. The person on the receiving end experiences the consequence, so the description follows the consequence.
Section 7152(a)(3)(G)
- 03
Safeguards as implemented, with the evidence that they operate
Human review that exists in the product and not only in a process document, access controls, logging. Each safeguard comes with the records that show it running, such as the override rate for a review step.
Section 7152(a)(6)
- 04
A registry and a release gate for the 45-day update
One row per assessed activity: the model version, input fields, thresholds and named safeguards. A required question on the release ticket asks whether a change touches anything in the registry, and a yes opens a ticket due 45 days after the change. Counsel decides what is material. The gate makes sure counsel is asked.
Section 7155(a)(3)
- 05
Versioned, findable assessments and the filing numbers
Each version stored as a dated, read-only file, kept where someone who did not write it can find it inside the 30-day window. The counts the Agency filing asks for come out of the registry by processing activity and category, not out of a spreadsheet hunt.
Section 7155(c)Section 7157(b)(3)Section 7157(b)(4)Section 7157(e)
What we do not do
We do not give legal advice. We do not decide whether you are a covered business or whether a change is material. We do not write the judgment that benefits outweigh risks, and we do not approve or attest. Those belong to your counsel and to the people named in sections 7152(a)(9) and 7157(c).
The assessment draws on the same decision inventory as the notice, opt-out, access and appeal work. The ADMT compliance engineering page describes how an engagement starts, with a scoped readiness pass before any code. The audit that sits next to this obligation, with its own dates and its own evidence, is covered on the CCPA cybersecurity audit page.
Read next
Longer treatments of the parts above, from our blog.
- CCPA risk assessment: what it must contain
California requires a documented risk assessment for high-risk processing, signed by an executive and producible in 30 days. Here is what it has to contain.
- Shadow AI and California's ADMT risk assessment gap
Verizon's 2026 breach report found unapproved AI tool use tripled to 45% of employees in a year, breaking the inventory an ADMT risk assessment assumes exists.
- CCPA vendor contract requirements for AI tools
California's rules for service-provider contracts already cover AI vendors, and they took effect a year before the ADMT deadline everyone is watching.
- What Counts as ADMT Under California Law
California's ADMT definition never mentions AI. It turns on whether a system replaces human decisionmaking, which is why most scoping passes miss things.
Common questions
A business that meets one of the CCPA’s three business thresholds and does any processing listed in section 7150(b): selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, two kinds of automated inference, or training certain technology on personal information. Your counsel decides whether you are covered.
Before the processing starts (section 7155(a)(1)). For processing that began before 1 January 2026 and continues, by 31 December 2027 (section 7155(b)). The first filing of information with the CPPA is due 1 April 2028 (section 7157(a)(1)).
Yes. At least every three years, and within 45 calendar days of a material change (section 7155(a)(2) and (a)(3)). A change is material if it creates new negative impacts, makes known ones larger or likelier, or weakens a safeguard the assessment relied on. Counsel decides whether a particular change meets that test.
Someone with authority to take part in deciding whether to start the processing reviews and approves the assessment (section 7152(a)(9)). A member of executive management responsible for risk assessment compliance submits the information to the CPPA, attesting under penalty of perjury (section 7157(c)).
No. Your counsel and executives own the purpose, the weighing of benefits against risks, the decision to proceed and the signature. We build the engineering inputs: the data inventory from the system, the description of the logic and output, the safeguards and their evidence, and the registry that catches material changes. We do not give legal advice.
Start with the tool, not the template
Tell us which tool makes the decision and what it reads. We will tell you which parts of the report would come from your system and what we would instrument first. If you turn out to be out of scope, we will say so and stop.
Source for every section number on this page: CCPA regulations, Title 11 Division 6 Chapter 1, effective 1 January 2026. Not legal advice.