California's CPPA Regulations: ADMT by 1 January 2027, Risk-Assessment Submissions by 1 April 2028

The California Privacy Protection Agency's regulations were approved by the state's Office of Administrative Law on 23 September 2025 and took effect on 1 January 2026. They add three distinct obligations to the CCPA, and each one runs on its own schedule.

Risk assessments are already live. Since 1 January 2026 a covered business has had to complete and document a risk assessment before it begins a processing activity the regulations treat as presenting significant risk to consumer privacy. Processing that was already running on that date is not exempt. It gets a grace period, and those assessments have to be conducted and documented by 31 December 2027.

Automated decision-making technology, which the regulations abbreviate to ADMT, is the clock that has not started. From 1 January 2027, a business that uses ADMT to make a significant decision about a consumer must give a pre-use notice at or before the point of collection, offer an opt-out subject to a few narrow exceptions, and be able to answer a request for access to information about how the technology was used.

1 April 2028 is a filing date, not a starting gun. That is when, for the risk assessments you conducted during 2026 and 2027, you submit a report to the agency: a named contact, the period covered, how many assessments you carried out, whether they concerned personal information under the CCPA, and an attestation. Not the assessments themselves, which stay with you. After that the submission is annual.

Cybersecurity audit certifications use the same April date but stagger by revenue, which is covered below. Everything here is our engineering reading of the published regulations and the law-firm analysis of them, written for people who have to build something before the dates. It is not legal advice, and your counsel decides what actually applies to you.

Whether any of this reaches you is decided by three separate tests, and clearing one tells you very little about the others.

The first is whether you are a business under the CCPA at all. You do business in California and either your annual gross revenue exceeds $26,625,000, or you buy, sell or share the personal information of 100,000 or more California consumers or households, or you derive 50 percent or more of your annual revenue from selling or sharing personal information. That revenue figure is the inflation-adjusted number in force since 1 January 2025, due for its next biennial adjustment in January 2027, and it is measured company-wide rather than on California turnover.

The second is whether a particular processing activity triggers a risk assessment. The triggers are narrower than handling personal data in general: selling or sharing personal information, processing sensitive personal information, using ADMT to make a significant decision about a consumer, and processing personal information in order to train an ADMT for such a decision or to train facial-recognition, identification or profiling technology. Third-party advertising and analytics cookies on a marketing site can amount to selling or sharing, which is how companies that assumed they were nowhere near this end up in scope.

The third test, for cybersecurity audits, is the narrowest: a covered business whose processing presents significant risk to consumer security, which in practice means revenue above the business threshold combined with processing the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more, in the prior calendar year. The certification deadlines stagger: 1 April 2028 above $100 million in annual gross revenue, 1 April 2029 between $50 million and $100 million, and 1 April 2030 for everyone else in scope.

Answering all three starts with knowing what personal data you hold and where it lives, which is a discovery exercise before it is a legal one and the same inventory work a GDPR data discovery engagement produces for European obligations.

A significant decision has a closed list in the regulations: the provision or denial of financial or lending services, housing, education enrolment or an education opportunity, employment or independent contracting opportunities or compensation, and healthcare services. Advertising is deliberately not on that list.

In a Microsoft estate the candidates are rarely labelled as artificial intelligence. A Power Automate flow that scores job applications and routes the low scorers to a rejection template. A Copilot Studio agent that triages benefits or eligibility questions and gives an answer people act on. A payroll or lending tool from a vendor, signed in through Entra ID, that a business unit bought without a privacy review. If a system of that kind replaces or substantially replaces human decision-making about one of those five categories, 1 January 2027 applies to it, and using it also triggers a risk assessment.

So the first piece of work is an inventory of where automated decisions already happen, including agents somebody built without telling IT. That inventory is the opening deliverable of an AI security review for Copilot and agents. If you also need a management system wrapped around it, because customers or insurers are asking, the broader framing sits in an ISO/IEC 42001 readiness assessment.

One warning about timing. A pre-use notice has to describe the specific purpose in plain terms and explain how the decision would be made if the consumer opts out. Building that opt-out path is a product change, not a privacy-notice edit, and seventeen weeks is short for one that touches hiring or lending.

The risk assessment, the ADMT notice and the cybersecurity audit all ask variants of the same question: what personal information do you hold, where does it sit, who can reach it, and what stops it leaving. Build that record once and maintain it, rather than rebuilding it three times under three headings.

In a Microsoft 365 tenant the raw material is already there. Purview classification and content explorer show which sites, mailboxes and OneDrive accounts hold which sensitive information types, which is the honest version of the data map. Sensitivity labels record the decision about each category and then enforce it; the practical scope of an information protection implementation is a small, defensible label set people actually apply, not a taxonomy nobody uses. Data loss prevention policies turn the question of what stops it leaving into a control with logs behind it, which is what a DLP policy configuration delivers. Retention and disposition through Purview data lifecycle management answer the retention column in the record and, more usefully, shrink the volume of data you have to assess at all. Pulling those together across SharePoint and OneDrive, with posture management and remediation of the oversharing an assessment inevitably surfaces, is the scope of Purview data governance work.

Two practical notes. Check your unified audit log retention now: an assessment written in 2027 about processing that ran in 2026 needs 2026 evidence, and the default retention on some licences is shorter than that gap. And do not run Copilot governance as a separate privacy project: Copilot reads what your existing permissions already allow, so the oversharing it exposes is exactly the oversharing your risk assessment has to describe.

The submission is not a form-filling exercise at the end. The attestation is made under penalty of perjury and signed by a member of executive management, which means someone senior has to be willing to stand behind the underlying documents. The assessments have to be retained for at least five years, or for as long as the processing continues. They have to be reviewed and updated at least once every three years. And when something material changes, a new negative impact, an existing one that becomes larger or likelier, or a safeguard that no longer works as well as it did, the update is due within 45 calendar days of that change.

The 45-day rule is the part that converts this from a project into an operating routine. A tenant changes constantly: a new site, a new connector, a new agent, a new vendor with single sign-on. Someone has to notice it, decide whether it was material, and write the update. Refreshing control evidence monthly and checking the tenant for drift against a known baseline is the job a compliance evidence and audit readiness retainer exists to do.

If the cybersecurity audit test catches you, the useful first step is measuring the control state you will eventually be audited on, while there is still time to fix it cheaply. A free Microsoft 365 security assessment for existing clients produces the current picture, Secure Score included, with a prioritised list rather than a compliance verdict.

Sequence matters more than speed, because each stage is the input to the next and doing them out of order means doing them twice.

Answer the threshold questions first, on paper, with finance in the room for the revenue numbers and marketing in the room for the cookies. Then inventory the data and the automated decisions in parallel, because the second one has the earlier deadline. Then write the ADMT notices and build the opt-out path, aiming to have them live well before 1 January 2027 so you are testing rather than launching in December. Then work through the backlog of assessments for pre-existing processing against 31 December 2027, with the cheapest wins first: processing you can stop, data you can delete, and stores you can bring under retention. Only then assemble the submission for 1 April 2028, which should be a summary of work already finished rather than the work itself.

The table sets out the decision paths. If you are tracking several regulatory and Microsoft dates at once, our Microsoft deadlines hub keeps them in one place.