Cybersecurity Policy Report, Rules on ADMT, Risk Assessments, Cyber Audits Get Legal Clearance in California, (Sep 23, 2025)
By Tony Foley
The California Privacy Protection Agency announced today that its recently finalized regulations on automated decision-making technology (ADMT), cybersecurity audits, risk assessments, and insurance companies had been approved by the California Office of Administrative Law (OAL).
The CPPA finalized the rules in July, and they are scheduled to take effect on Jan. 1, 2026, although the rules themselves provide for delayed compliance dates for particular provisions (CPR, July 30). In an announcement today, the CPPA said the OAL’s approval concluded what it called “robust engagement” with stakeholders, including holding several public hearings and reviewing hundreds of public comments.
“These rules ensure that Californians continue to have the strongest privacy protections in the country while being responsive to the realities of business implementation,” said Jennifer Urban, chair of the CPPA board. “I'm deeply grateful to our team and to members of the public whose contributions helped to shape these regulations.”
“The regulations provide clarity for businesses, while ensuring strong protections for Californians,” added Phil Laird, CPPA’s general counsel. “Our goal has always been to give consumers meaningful rights and also provide practical compliance pathways for businesses.”
The announcement outlines the specifics of the provisions that have delayed compliance dates, as follows:
Businesses required to complete cybersecurity audits must submit certifications to the CPPA by April 1, 2028, for businesses making over $100 million; April 1, 2029, for businesses making between $50 million and $100 million; and April 1, 2030, for businesses making less than $50 million;
Businesses subject to risk assessment requirements must begin compliance by Jan. 1, 2026, but by April 1, 2028, they must submit an attestation that required assessments had been completed and a summary of their risk assessment information to the CPPA; and
Businesses that use ADMT to make significant decisions must comply with the ADMT requirements beginning Jan. 1, 2027.
The CPPA will post the final regulations and supporting materials on its law and regulations web page as soon as they are processed.
News: StateLegislation DataPrivacy DataSecurity CCPA