Risk Assessments: What Must Be Done and When
Risk assessments are a separate obligation. Different timeline.
Businesses must complete assessments before initiating processing activities that present significant privacy risk — including ADMT for significant decisions, personal information used to train ADMT, and automated processing used to infer sensitive personal information.
For processing already underway before January 1, 2026: assessments due by December 31, 2027.
For new processing beginning on or after January 1, 2026: assessments due before processing begins.
Each assessment must evaluate: the ADMT's purposes and benefits, its logic, foreseeable negative impacts, planned safeguards, and policies to limit those impacts. If privacy risks outweigh benefits, the business may not proceed unless risks can be sufficiently mitigated. Assessments must be certified by a senior executive and retained for five years. Review required every three years minimum, or within 45 calendar days of any material change.
By April 1, 2028, businesses must submit an attestation to the CPPA confirming assessments were completed, alongside a summary of assessment findings. The CPPA will know who has and hasn't done this. Enforcement investigators will cross-reference it.
Structuring these risk assessments as integrated documentation that satisfies both California requirements and EU AI Act obligations for organisations operating transnationally reduces duplicated effort and produces governance infrastructure that serves multiple regulatory frameworks simultaneously.
The Compliance Workflow: Five Practical Steps
Most organisations' AI inventories don't exist in a form that makes these obligations easy to assess. Models are owned by different teams, documented inconsistently, and described by their technical architecture — not their regulatory function. Compliance begins with clarity.
Step one: Inventory every AI system and algorithmic tool that processes personal information of California residents. Engineering, product, and legal must work through the actual deployed technology stack together — not documentation that may not reflect reality. Capture: what personal information each system uses as input, what outputs it produces, how those outputs feed into decisions, and what decision domain applies.
Step two: Map each system against the ADMT definition and significant decision taxonomy. Systems processing personal information and producing outputs that replace or substantially replace human judgment in finance, employment, housing, healthcare, or education are in scope. Systems supporting advertising, content recommendation, or internal analytics without making significant decisions about individual consumers are likely out of scope for consumer rights provisions — though they may still trigger risk assessment obligations if they infer sensitive personal information.
Step three: Assess risk level for each in-scope system. Does it use sensitive personal information — health data, racial or ethnic origin, biometric identifiers, precise geolocation, sexual orientation, immigration status? Does it operate on protected class characteristics in employment? Does it affect large numbers of California consumers? High-risk systems require completed assessments before deployment (new systems) or by December 31, 2027 (existing systems).
Step four: Implement consumer-facing infrastructure. Pre-use notices that accurately describe the ADMT. Opt-out mechanisms that are accessible and functional — not buried in privacy policy sub-pages. An alternative decision-making pathway for consumers who opt out. An access request handling workflow for ADMT-specific inquiries. Required for all covered ADMT by January 1, 2027 for existing systems; prior to deployment for systems implemented after that date. Implementing AI consent and control workflows that actually enforce opt-out choices at the processing layer — not just record them in a database — is the technical implementation challenge most legal teams underestimate.
Step five: Build documentation and audit readiness. Risk assessments must be retained, certified, reviewed, and updated on schedule. ADMT inventories must stay current as deployments evolve. Third-party vendors providing ADMT to your business don't absorb your compliance obligation — you remain responsible and must collaborate with vendors to access the information about ADMT logic that consumer access rights require.
California vs the EU AI Act: Two Different Logics
Same high-risk domains. Structurally different compliance mechanisms.
The EU AI Act is product-focused and provider-centric. It classifies AI systems by inherent risk tier and regulates the systems themselves — conformity assessments, technical documentation, EU database registration, human oversight requirements. Primary obligations fall on providers. High-risk categories under Annex III substantially overlap California's significant decision domains — employment, credit, healthcare, education — and additionally cover biometric identification, critical infrastructure, and law enforcement.
California's ADMT framework is consumer-focused and deployer-centric. It doesn't regulate AI systems as products or require conformity assessments. It grants California consumers specific rights regarding how businesses use ADMT against them — and requires businesses to document that ADMT use is justified. Obligations fall on deployers: businesses using the technology, not developers building it.
The practical consequence for businesses subject to both: EU AI Act technical documentation, risk assessment, and human oversight requirements are more demanding for in-scope systems than California's. But California's consumer-facing obligations — pre-use notice, opt-out mechanisms, access rights — require operational implementation the EU conformity framework doesn't specifically mandate in the same form.
Build a complete EU AI Act compliance programme for a high-risk system and you'll satisfy a significant portion of California's risk assessment requirements as a byproduct. You'll still need to implement California-specific notice and opt-out infrastructure separately.
Integrate the assessments. Don't run parallel programmes.
Common Mistakes That Generate Compliance Risk
Assuming vendor use transfers compliance obligation. It doesn't. California's ADMT regulations are explicit: a business cannot escape liability by contracting with a third-party ADMT provider. The business using that vendor's system to make significant decisions remains responsible for pre-use notices, opt-out mechanisms, access rights, and risk assessments. And must collaborate with the vendor to access ADMT logic information that access rights require.
Classifying systems by internal name, not regulatory function. Teams describe their tools as "recommendation engines," "scoring tools," "efficiency platforms." The regulations don't care. A performance management tool that assigns numeric scores to employees — and that managers routinely accept without independent analysis — is making a significant employment decision. Internal naming changes nothing.
Deploying ADMT before building the alternative pathway. The opt-out right is meaningful only if a genuine non-ADMT alternative exists. Businesses with no process for making employment or credit decisions without ADMT cannot legally offer an opt-out they cannot honour. The alternative pathway must exist before the ADMT pathway goes live.
FAQ
Does California regulate AI?
Yes. California regulates AI through multiple laws: the CCPA's ADMT regulations (effective January 1, 2026 for risk assessments, January 1, 2027 for consumer rights), the Transparency in Frontier AI Act (effective January 1, 2026 for frontier model developers), and the Generative AI Training Data Transparency Act (effective January 1, 2026 for generative AI developers).
What is ADMT under CPRA?
Automated Decision-Making Technology is any technology that processes personal information and uses computation to replace or substantially replace human decision-making. It includes profiling technologies that analyse or predict human characteristics.
Do I need to disclose AI usage to users?
Yes, if your ADMT makes significant decisions concerning California consumers. Pre-use notices are required before collecting personal information for ADMT use, or before using already-collected data for a significant decision via ADMT.
Can users opt out of AI decisions?
Yes, for significant decisions. Businesses must provide at least two accessible opt-out methods and must have a non-ADMT alternative process in place for consumers who exercise that right.
How does California compare to the EU AI Act?
The EU AI Act is product-focused and provider-centric, regulating AI systems through conformity assessments and technical documentation. California's ADMT framework is consumer-focused and deployer-centric, granting consumer rights and requiring risk justification. Both cover similar high-risk decision domains through structurally different compliance mechanisms. Organisations subject to both should integrate their assessments rather than running parallel programmes.
California's AI compliance obligations aren't approaching.
They're here. Risk assessments required from January 1, 2026. Consumer rights infrastructure due by January 1, 2027. CPPA attestations due by April 1, 2028. A regulator with active investigations in the hundreds and the institutional knowledge to find compliance gaps.
The window for proactive preparation is now — not after the first enforcement action lands.
See how Secure Privacy's AI governance platform and consent management tools help businesses inventory their ADMT systems, implement consumer-facing controls, and maintain the audit-ready documentation California's new regime demands.
