Artifact GuideUSRisk Assessments Cybersecurity Audits and ADMT
US CPRA Risk Assessments Cybersecurity Audits and ADMT
Run three separate tests for section 7150 risk assessments, section 7120 cybersecurity audits, and Article 11 ADMT rights; a yes under one test does not answer either of the others.
The final CPPA regulations became effective January 1, 2026 and use different activity, entity, decision, transition, evidence, and consumer-rights rules.
processes personal information and uses computation to replace or substantially replace human decisionmaking. exists only when the reviewer knows how to interpret and use the output, analyzes it with other relevant information, and has authority to make or change the decision. The final CPPA regulations governing ADMT, risk assessments, and cybersecurity audits became effective January 1, 2026, but each article has a separate trigger and transition rule.
1
Section 1
Who must follow the US CPRA risk assessment, cybersecurity audit, and ADMT rules?
Risk assessments occur before new processing in any of the six section 7150 categories starts. The categories are selling or sharing personal information; processing sensitive personal information; using ADMT for a ; specified automated profiling based on systematic observation of educational-program applicants, job applicants, students, employees, or independent contractors; specified automated profiling based on presence in a ; and processing personal information intended to train ADMT for significant decisions or facial-recognition, emotion-recognition, identity-verification, or physical or biological identification or profiling technology. Covered processing begun before January 1, 2026 and continuing afterward must be assessed by December 31, 2027.
For the two automated-profiling branches, check the traits listed in section 7150(b)(4)-(5), such as intelligence, aptitude, work performance, health, interests, reliability, behavior, or movements. The observation branch also lists location. The sensitive-location branch excludes using information solely to deliver goods or provide transportation there. The sensitive-information exception applies only when employee or independent-contractor information is processed solely and specifically to administer compensation payments, determine and store employment authorization, administer benefits, provide legally required reasonable accommodation, or report wages as required by law; other sensitive-information processing remains subject to the assessment test.
Cybersecurity audits use the separate section 7120 entity test: at least 50 percent of preceding-year revenue from sale or sharing, or annual gross revenue above $26,625,000 effective January 1, 2025 plus processing of at least 250,000 consumers or households or sensitive information of at least 50,000 consumers. First audit reports must be completed by April 1, 2028, 2029, or 2030 under the revenue-tier phase-in.
Article 11 applies when ADMT makes a : provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services. Ordinary hosting, networking, storage, security tools, spellchecking, calculators, databases, and spreadsheets are excluded only when they do not replace human decisionmaking.
Give a plain-language pre-use notice at or before collecting personal information intended for covered ADMT use. If information was already collected for another purpose, give the notice before processing it for the covered ADMT purpose. Describe the specific purpose, opt-out or appeal route or other claimed exception, access right, non-retaliation, categories affecting output, output type and use, and, where an opt-out must be offered, the alternative decision process. Businesses using covered ADMT before January 1, 2027 must comply by that date; uses beginning on or after that date must comply whenever used.
Risk assessment: identify the activity and exact trigger, document required operations, benefits, negative impacts and safeguards, refuse processing when risks outweigh benefits, review at least every three years, and update within 45 days after a material change.
Cybersecurity audit: calculate entity scope, appoint a qualified and impartial auditor, test the required cybersecurity-program areas, remediate or document findings, and obtain the executive certification.
ADMT: identify the and human role, give the pre-use notice, provide access, and implement the opt-out unless a section 7221 exception applies. The human-appeal exception requires a reviewer who knows how to interpret and use the output, considers relevant information and the consumer's submission, and can overturn the decision.
Link the three records when one system triggers more than one article, but preserve separate trigger conclusions, owners, deadlines, evidence, and consumer-facing duties.
Articles 9, 10, and 11 establish the separate cybersecurity-audit, risk-assessment, and ADMT trigger tests, duties, transition dates, and evidence requirements.
The CPPA regulations page is the official rulemaking hub for CCPA updates covering cybersecurity audits, risk assessments, ADMT, and insurance regulations.
implemented requirements for certain businesses to conduct risk assessments and complete annual cybersecurity audits
CPPA FAQ confirms CPRA added consumer privacy rights and business obligations, which frames the California privacy workflow.
The CPRA amended the CCPA by adding additional consumer privacy rights and obligations for businesses
2
Section 2
What fields should the Risk Assessments Cybersecurity Audits and ADMT template capture?
The privacy, security, product, and decision owner may share one intake, but they must record three separate determinations. A yes for one article does not establish scope for either of the others.
Entity and activity: business, product, system, consumers, data, purpose, recipients, launch date, revenue and volume evidence, and owners.
Risk assessment: section 7150 trigger and exception, report, safeguards, balance, approval, three-year review, 45-day material-change update, and summary submission.
Cybersecurity audit: section 7120 calculation, audit period, auditor and independence, tests, findings, remediation, certification, and submission.
ADMT: significant-decision category, human-involvement test, purpose, inputs, output and use, pre-use notice, access response, opt-out or appeal path, exception evidence, downstream instructions, and January 1, 2027 transition.
Nonbinding guidance for protecting personally identifiable information; it can inform evidence design but does not establish California scope or consumer rights.
PII should be protected from inappropriate access, use, and disclosure
Articles 9-11 specify the separate assessment, audit, and ADMT intake fields, owners, notices, request paths, approvals, certifications, and submissions.
3
Section 3
How should teams review and improve the Risk Assessments Cybersecurity Audits and ADMT workflow?
Review intake when a model, decision, human-review process, data source, use, recipient, entity threshold, or safeguard changes. Sample live outcomes and consumer requests; policy text alone cannot show that an ADMT opt-out, risk safeguard, or audit control operates as described.
Reopen the risk assessment within the 45-day material-change window and preserve the next three-year review date; these are different triggers.
Recalculate section 7120 every year from finance and data-volume evidence, and test auditor independence before each annual audit.
For ADMT, test notice delivery before use, response accuracy, the 15-business-day opt-out completion deadline, downstream instructions, and whether any claimed exception still applies.
Keep binding CPPA duties separate from NIST control or assessment publications, which can organize evidence but do not replace California scope, notice, rights, reports, or deadlines.
The CPPA regulations page is the official rulemaking hub for CCPA updates covering cybersecurity audits, risk assessments, ADMT, and insurance regulations.
Sections 7120-7124, 7150-7157, and 7200-7222 support the annual scope check, risk-assessment update, ADMT notice, 15-business-day opt-out, and exception review.
Recommended next step
Assign the US CPRA assessment, audit, and ADMT work
Use Sorena to assign separate owners, request evidence, set phase-in and review dates, and retain notices, decisions, approvals, and certifications.
Controlling regulatory text for the separate risk-assessment, cybersecurity-audit, and ADMT trigger tests, duties, evidence, phase-in dates, and consumer rights.
Articles 9, 10, and 11 establish the separate cybersecurity-audit, risk-assessment, and ADMT trigger tests, duties, transition dates, and evidence requirements.
Articles 9-11 specify the separate assessment, audit, and ADMT intake fields, owners, notices, request paths, approvals, certifications, and submissions.
Show 1 more
Sections 7120-7124, 7150-7157, and 7200-7222 support the annual scope check, risk-assessment update, ADMT notice, 15-business-day opt-out, and exception review.
Nonbinding guidance for protecting personally identifiable information; it can inform evidence design but does not establish California scope, duties, or consumer rights.
Nonbinding guidance for protecting personally identifiable information; it can inform evidence design but does not establish California scope or consumer rights.
Nonbinding guidance for protecting personally identifiable information; it does not replace the California review, opt-out, or audit rules.
"PII should be protected from inappropriate access, use, and disclosure"
The CPPA regulations page is the official rulemaking hub for CCPA updates covering cybersecurity audits, risk assessments, ADMT, and insurance regulations.