CCPA cybersecurity audits, risk assessments and ADMT rules: dates

The short answer

The two California Privacy Protection Agency (CPPA) documents behind this guide give the scope of the new rules and the compliance dates. They do not reproduce the text of the audit, risk assessment or ADMT requirements. The Agency's announcement of September 23, 2025 says the California Office of Administrative Law approved regulations covering cybersecurity audits, risk assessments, automated decisionmaking technology (ADMT), insurance companies, and updates to existing CCPA regulations.

This guide covers what those documents state: who files what, and by when. For the detailed duties, the Agency's rulemaking page lists the approved regulation text among its final documents.

What the Agency adopted, and when

The rulemaking page says the Agency Board adopted the regulations on July 24, 2025. The page describes four parts. The first updates existing CCPA regulations.

The second part, according to the page, implements requirements for certain businesses to conduct risk assessments and complete annual cybersecurity audits. The word "certain" matters. The page does not say every business is covered. It does not list the criteria here.

The third part, the page says, implements consumers' rights to access and opt out of businesses' use of ADMT. The fourth clarifies when insurance companies must comply with the CCPA.

The page reports the approval step. On September 22, 2025, the Office of Administrative Law approved the regulations and filed them with the Secretary of State.

The announcement says the regulations take effect January 1, 2026, with additional time for some requirements. The announcement names the areas that get extra time: cybersecurity audits, risk assessments and ADMT.

Cybersecurity audits: certification deadlines by revenue

For audits, the announcement gives the first filing dates, which depend on the size of the business. These are dates for submitting certifications to the CPPA. They are not dates for starting audit work. The announcement does not say when audit work must begin.

The announcement says businesses that must complete cybersecurity audits have to submit certifications to the CPPA by April 1, 2028 if the business makes over $100 million.

The date is April 1, 2029 for a business that makes between $50 million and $100 million.

The date is April 1, 2030 for a business that makes less than $50 million.

The announcement uses the word "makes" for these tiers. It does not define the measure here, and it does not say which figure places a business in a tier. A security leader who needs to know which tier applies should check the approved regulation text for that definition.

Risk assessments: compliance starts January 1, 2026

Risk assessments have an earlier start than audits. The announcement says businesses subject to the risk assessment requirements must begin compliance by January 1, 2026.

The announcement also sets a first submission date. By April 1, 2028, those businesses must submit two items to the CPPA: an attestation that required risk assessments were completed, and a summary of their risk assessment information.

Read together, these dates separate the work from the filing. Compliance with the risk assessment requirements starts on January 1, 2026. The announcement gives April 1, 2028 as the date for the attestation and summary. The announcement does not say what a risk assessment must contain, which processing activities trigger one, or how often one must be redone.

Automated decisionmaking technology: January 1, 2027

The ADMT date is later than the risk assessment date. The announcement says businesses that use ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027.

The condition in that sentence is use of ADMT to make significant decisions. The announcement does not define either term. The rulemaking page links the approved text for readers who need the definitions. The page's summary of the ADMT rules refers to consumers' rights to access and to opt out. That is the only description of the ADMT requirements in these two documents.

What a security leader can take from these documents

The documents do not give a step-by-step compliance checklist, and this guide does not add one. They do support a few plain points.

First, the dates differ by topic. Risk assessment compliance begins January 1, 2026. ADMT compliance begins January 1, 2027. Audit certifications are due on April 1 of 2028, 2029 or 2030, depending on revenue. The risk assessment attestation and summary are due April 1, 2028.

Second, the final text is where the detailed duties sit. The announcement says the final regulations and supporting materials will be posted on the CPPA website as soon as they are processed. The rulemaking page, which lists the approved text, is the place to read them.

Third, the Agency invites questions. The announcement says to use its Contact form.

The Agency also described its intent in the announcement. Jennifer Urban, Chair of the Agency Board, said the rules "ensure that Californians continue to have the strongest privacy protections in the country while being responsive to the realities of business implementation." Phil Laird, the Agency's General Counsel, said the Agency's goal "has always been to give consumers meaningful rights and also provide practical compliance pathways for businesses."

How the rules were made, and a note on the rulemaking page

The announcement says the rulemaking included multiple hearings and a review of hundreds of public comments before the Board adopted the regulations. That history is why the rulemaking page carries so many comment files and hearing transcripts. Those files are the public record of the process. The announcement does not say whether any one comment changed the final text.

One caution on reading the rulemaking page. It still displays an alert that the open public comment period was extended to February 19, 2025. The same page also states that the rulemaking is complete. The alert should not be read as a sign that the process is still open. The Office of Administrative Law approval of September 22, 2025 and the announcement of September 23, 2025 are the later events.

For the question of what to do before the deadlines, the documents answer only part of it. They give the dates, the revenue tiers for audit certifications, and the filing items for risk assessments. The scope of each requirement is in the approved regulation text, which these two documents point to but do not quote.