Appearance
Risk assessments and Agency submissions
Article 10 of the CCPA regulations (California Code of Regulations, Title 11, §§ 7150–7157) applies from January 1, 2026. Section 7150(a) tells a business that it must conduct a risk assessment before it initiates processing of personal information that "presents significant risk to consumers' privacy as set forth in subsection (b)". Section 7150(b)(3) applies to the use of ADMT for a significant decision. One part of § 7150(b)(6) applies to personal information that the business processes and intends to use to train ADMT for a significant decision. Article 11, on the use of ADMT, has different dates in § 7200(b) (When Article 11 applies).
Use and training
Section 7150(b) of the CCPA regulations gives six processing activities, and each of them "presents significant risk to consumers' privacy". A business must conduct a risk assessment before it initiates one of these processing activities:
- (1) Selling or sharing personal information.
- (2) Processing sensitive personal information. A business that processes the sensitive personal information of its employees or independent contractors "solely and specifically for purposes of administering compensation payments, determining and storing employment authorization, administering employment benefits, providing reasonable accommodation as required by law, or wage reporting as required by law, is not required to conduct a risk assessment for the processing of sensitive personal information for these purposes" (§ 7150(b)(2)(A)). Article 10 applies to all other processing of sensitive personal information.
- (3) "Using ADMT for a significant decision concerning a consumer".
- (4) "Using automated processing to infer or extrapolate a consumer’s intelligence, ability, aptitude, performance at work, economic situation, health (including mental health), personal preferences, interests, reliability, predispositions, behavior, location, or movements, based upon systematic observation of that consumer when they are acting in their capacity as an educational program applicant, job applicant, student, employee, or independent contractor for the business."
- (5) "Using automated processing to infer or extrapolate a consumer’s intelligence, ability, aptitude, performance at work, economic situation, health (including mental health), personal preferences, interests, reliability, predispositions, behavior, or movements, based upon that consumer’s presence in a sensitive location." In § 7150(b)(5), "“Infer or extrapolate” does not include a business using a consumer’s personal information solely to deliver goods to, or provide transportation for, that consumer at a sensitive location."
- (6) The processing of personal information of consumers that the business intends to use to train ADMT or a different technology (the two parts are below).
A business that uses ADMT for a significant decision must comply with Article 11 (§ 7200(a)), on the dates that § 7200(b) gives. It must also conduct a risk assessment (§ 7150(b)(3)).
Section 7150(b)(6) has two parts. It applies to the processing of personal information of consumers that the business intends to use for one of these purposes:
- to "train an ADMT for a significant decision concerning a consumer"
- to "train a facial-recognition, emotion-recognition, or other technology that verifies a consumer's identity, or conducts physical or biological identification or profiling of a consumer".
In § 7150(b)(6), "intends to use" applies when the business is "using, plans to use, permits others to use, plans to permit others to use, is advertising or marketing the use of, or plans to advertise or market the use of". For §§ 7150(b)(6) and 7153, "train" is "the process through which a technology discovers underlying patterns, learns a series of actions, or is taught to generate a desired output" (§ 7001(fff)).
Section 7150(b)(6) applies also when the business does not use the ADMT. It applies only to the processing of personal information of consumers. Article 11 applies to the use of ADMT to make a significant decision (§ 7200(a)), not to training. If a business trains such ADMT with personal information and uses it for a significant decision, Article 10 applies to the two processing activities.
Contents of the risk assessment
Section 7152(a) of the CCPA regulations tells a business that it must conduct the risk assessment "to determine whether the risks to consumers' privacy from the processing of personal information outweigh the benefits to the consumer, the business, other stakeholders, and the public from that same processing". Section 7154(a) gives this rule: "The goal of a risk assessment is restricting or prohibiting the processing of personal information if the risks to privacy of the consumer outweigh the benefits resulting from processing to the consumer, the business, other stakeholders, and the public".
The risk assessment must identify these items. The business must also record the items (1) to (3) and (6) to (9) in the risk assessment report.
| Item (§ 7152(a)) | The business must identify | In the risk assessment report |
|---|---|---|
| (1) Purpose | The purpose for the processing of personal information. The purpose "must not be identified or described in generic terms". | Yes |
| (2) Personal information | "the categories of personal information to be processed, including any categories of sensitive personal information", and "the minimum personal information that is necessary to achieve the purpose of processing consumers' personal information" | Yes |
| (3)(A) Method and sources | The "planned method for collecting, using, disclosing, retaining, or otherwise processing personal information, and the sources of the personal information" | Yes |
| (3)(B) Retention | "How long the business plans to retain each category of personal information, or if unknown, the criteria the business plans to use to determine that retention period" | Yes |
| (3)(C) Contact with consumers | The "method of interacting with the consumers whose personal information the business plans to process" and "the purpose of the interaction" | Yes |
| (3)(D) Number of consumers | "The approximate number of consumers whose personal information the business plans to process" | Yes |
| (3)(E) Disclosures | "What disclosures the business has made or plans to make to the consumer about the processing of their personal information and how these disclosures were or will be made" | Yes |
| (3)(F) Service providers, contractors, and third parties | "The names or categories of the service providers, contractors, or third parties to whom the business discloses or makes available the consumers' personal information for the processing", and the purpose for which the business discloses the personal information or makes it available to them | Yes |
| (3)(G) ADMT use | Only for the use of ADMT in § 7150(b)(3): see § 7152(a)(3)(G) below | Yes |
| (4) "Benefits" | "the benefits to the business, the consumer, other stakeholders, and the public from the processing of the personal information, as applicable". The "benefits" "must not be identified in generic terms". | No |
| (5) Negative impacts | "the negative impacts to consumers' privacy associated with the processing", and "the sources and causes of these negative impacts" | No |
| (6) Safeguards | "any safeguards that the business plans to implement for the processing, such as safeguards to address the negative impacts identified in subsection (a)(5)" | Yes |
| (7) Initiation | "whether it will initiate the processing subject to the risk assessment" | Yes |
| (8) Sources of the information | "the individuals who provided the information for the risk assessment, except for legal counsel who provided legal advice" | Yes |
| (9) Approval | "the date the assessment was reviewed and approved, and the names and positions of the individuals who reviewed or approved the assessment, except for legal counsel who provided legal advice". Also: "An individual who has the authority to participate in deciding whether the business will initiate the processing that is the subject of the risk assessment must review and approve the assessment". | Yes |
Section 7152(a)(3)(G) gives the item for the use of ADMT:
For the uses of ADMT set forth in section 7150, subsections (b)(3), the business must identify: (i) The logic of the ADMT, including any assumptions or limitations of the logic; and (ii) The output of the ADMT, and how the business will use the output to make a significant decision.
Section 7152(a)(3)(G) applies only to the use of ADMT in § 7150(b)(3). A risk assessment for training in § 7150(b)(6), without a use, contains the other items of § 7152(a). The time limits and the retention rule of § 7155 also apply to it.
In § 7001(zz), the "risk assessment report" is "the document that every business that is required to conduct a risk assessment must create as part of its risk assessment". The report "includes the information set forth in section 7152, subsections (a)(1)–(3), (6)–(9)". The business must identify the "benefits" (4) and the negative impacts (5), but § 7001(zz) does not include these items in the report.
Section 7152(a)(5) gives examples of negative impacts that a business "may consider". Two of them are "Discrimination upon the basis of protected characteristics that would violate federal or state law" and "Economic harms, including limiting or depriving consumers of economic opportunities, charging consumers higher prices, or compensating consumers at lower rates based upon profiling". Section 7152(a)(6)(A) gives examples of safeguards that a business "may consider". Two of the examples are:
- "Consulting external parties, such as those described in section 7151, subsection (b), to ensure that the business maintains current knowledge of emergent privacy risks and countermeasures; and using that knowledge to identify, assess, and mitigate risks to consumers' privacy" (
§ 7152(a)(6)(A)(iii)) - "Implementing policies, procedures, and training to ensure that the business's ADMT works for the business's purpose and does not unlawfully discriminate based upon protected characteristics" (
§ 7152(a)(6)(A)(iv))
Section 7151 of the CCPA regulations tells a business which persons it must include, and which persons it can include, in the risk assessment. A business's employees "whose job duties include participating in the processing of personal information that would be subject to a risk assessment must be included in the business's risk assessment process for that processing activity" (§ 7151(a)). The business "may include external parties in the process", for example "service providers, contractors, experts in detecting and mitigating bias in ADMT, a subset of the consumers whose personal information the business plans to process, or stakeholders that represent consumers' or others' interests, including consumer advocacy organizations" (§ 7151(b)).
Other persons must also give facts for a risk assessment:
- For personal information collected "pursuant to" its written contract with the business, a service provider or contractor must "cooperate with the business" in the business's risk assessment (§ 7050(h)(2)).
- A business that makes ADMT trained with personal information available for a significant decision must give the recipient-business all facts available to that business and necessary for the recipient-business's risk assessment (§ 7153).
Time limits, retention, and other assessments
Section 7155 of the CCPA regulations gives the time limits and the retention rule for each risk assessment. Section 7156 lets a business use one risk assessment for more than one processing activity. It also lets a business use a risk assessment that it prepared for a different purpose.
| Rule | The business | Provision |
|---|---|---|
| Before initiation | Must conduct and "document" the risk assessment before it initiates a processing activity in § 7150(b) | § 7155(a)(1) |
| Interval of "three years" | "At least once every three years, a business must review, and update as necessary, its risk assessments to ensure that they remain accurate in accordance with the requirements of this Article". | § 7155(a)(2) |
| Material change | Must "update" a risk assessment "whenever there is a material change relating to the processing activity". The time limit is "as soon as feasibly possible, but no later than 45 calendar days from the date of the material change". This rule does not wait for the interval of § 7155(a)(2). | § 7155(a)(3) |
| Processing activity in § 7150(b) that the business started before January 1, 2026 and that continues after January 1, 2026 | Must conduct and "document" the risk assessment on or before December 31, 2027, and comply with § 7157(a)(1) (see below) | § 7155(b) |
| Retention | Must "retain its risk assessments, including original and updated versions, for as long as the processing continues or for five years after the completion of the risk assessment, whichever is later". | § 7155(c) |
| "Comparable Set" | Can conduct "a single risk assessment for a comparable set of processing activities", that is "a set of similar processing activities that present similar risks to consumers' privacy". | § 7156(a) |
| Assessment for a different purpose | Can use "a risk assessment that it has prepared for another purpose to meet the requirements in section 7152", "provided that the risk assessment contains the information that must be included in, or is paired with the outstanding information necessary for, compliance with section 7152". | § 7156(b) |
In § 7155(a)(3), a change is material if it "creates new negative impacts or increases the magnitude or likelihood of previously identified negative impacts as set forth in section 7152, subsection (a)(5), or diminishes the effectiveness of the safeguards as set forth in section 7152, subsection (a)(6)". The examples of material changes in § 7155(a)(3) are changes to "the purpose of the processing", to "the minimum personal information necessary to achieve the purpose of the processing", or to "the risks to consumers' privacy raised by consumers". The example in § 7156(b)(1) is a business that uses "a data protection assessment that is compliant with another state law" and adds the § 7152 information that is not in that assessment.
The rule for processing that started before 2026 (§ 7155(b)):
For any processing activity identified in section 7150, subsection (b), that the business initiated prior to January 1, 2026 and that continues after January 1, 2026, the business must conduct, and document as set forth in section 7152, a risk assessment in accordance with the requirements of this Article no later than December 31, 2027. The business must comply with the submission requirements set forth in section 7157, subsection (a)(1).
The Article 11 dates in § 7200(b) do not change these time limits (When Article 11 applies). A business that starts to use ADMT for a significant decision in 2026 must comply with Article 11 on or before January 1, 2027. But the business must conduct the risk assessment before it initiates that use.
The Agency submissions — § 7157
Section 7157 of the CCPA regulations tells a business that it must submit information about its risk assessments to the Agency. The information is about the risk assessments for all the processing activities in § 7150(b), not only for ADMT. It does not include the risk assessments or the risk assessment reports. The Agency or the Attorney General can also tell the business to submit the reports (§ 7157(e)).
The two time limits (§ 7157(a)(1)–(2)):
For risk assessments conducted in 2026 and 2027, the business must submit to the Agency the information required by subsection (b) no later than April 1, 2028.
For risk assessments conducted after 2027, the business must submit to the Agency the information required by subsection (b) no later than April 1 following any year during which the business conducted the risk assessments.
The example in § 7157(a)(2): for risk assessments conducted in 2028, the business must submit the information on or before April 1, 2029.
The business must submit this information (§ 7157(b)):
| Item | Provision |
|---|---|
| "The business's name and a point of contact for the business, including the contact's name, phone number, and email address". | § 7157(b)(1) |
| "The time period covered by the submission, by month and year". | § 7157(b)(2) |
| "The number of risk assessments conducted or updated by the business during the time period covered by the submission, in total and for each of the processing activities identified in section 7150, subsection (b)". The count for § 7150(b)(6) includes the two parts of that processing activity. | § 7157(b)(3) |
| "Whether the risk assessments conducted or updated by the business during the time period covered by the submission involved the processing of each of the categories of personal information and sensitive personal information identified in Civil Code section 1798.140, subdivisions (v)(1)(A)-(L), (ae)(1)(A)-(G), and (ae)(2)(A)-(C)". | § 7157(b)(4) |
| The attestation (see below) | § 7157(b)(5) |
| "The name and business title of the person submitting the risk assessment information, and the date of the certification". | § 7157(b)(6) |
The attestation (§ 7157(b)(5)):
Attestation to the following statement: “I attest that the business has conducted a risk assessment for the processing activities set forth in California Code of Regulations, Title 11, section 7150, subsection (b), during the time period covered by this submission, and that I meet the requirements of section 7157, subsection (c). Under penalty of perjury under the laws of the state of California, I hereby declare that the risk assessment information submitted is true and correct.”
Section 7157(c) gives three conditions for the person who submits the information, and all of them apply. That person "must be a member of the business's executive management team who":
- "Is directly responsible for the business's risk-assessment compliance"
- "Has sufficient knowledge of the business's risk assessment to provide accurate information"
- "Has the authority to submit the risk assessment information to the Agency"
The business must submit the information "via the Agency's website at https://cppa.ca.gov/" (§ 7157(d)).
In § 7157(e), the Agency or the Attorney General "may require a business to submit its risk assessment reports to the Agency or to the Attorney General at any time". The business must submit the reports "within 30 calendar days of the Agency's or the Attorney General's request".
Article 10 in Modulos
In the CCPA ADMT Regulations Frameworks, MRF-495 in MFF-29 is the Requirement for the risk assessment of one ADMT. ORF-490 in OFF-29, the Framework for the Organization, is the Requirement for the § 7157 duties and the other risk assessment duties. The Requirements and the steps that Modulos recommends are on the Modulos section for the CCPA ADMT Regulations.
Where to go next
- The tests for business, consumer, ADMT, and significant decision tell you who the regulations apply to, and give the dates of Article 11.
- The Pre-use Notice, opt-out, and access section gives the Article 11 duties for the use of ADMT.
- The service provider and third party duties give the § 7153 facts and the duty of a service provider or contractor in the risk assessment.
- The CCPA ADMT Regulations in Modulos section gives the Requirements and the steps that Modulos recommends.
Disclaimer
This page gives general information. It is not legal advice. Article 10 applies from January 1, 2026. A business must submit the first § 7157 information, for risk assessments conducted in 2026 and 2027, on or before April 1, 2028.