California ADMT — risk assessments for existing processing due
CPPA (California) · US
What changes
Businesses that began using ADMT for significant decisions before 2026 must have completed a risk assessment covering that processing (§ 7155(b)); the first summary goes to the CPPA by 1 Apr 2028 (§ 7157).
What to do
Finish and document the ADMT risk assessment; keep it for as long as the processing continues or for five years after completing it, whichever is later (§ 7155(c)).
Who it applies to
systems involving personal data or automated decisions
Does this apply to you? Free checker
California ADMT rules (CCPA Article 11) checker (California CCPA regulations, Article 11). 8 questions, no sign-up and nothing saved: your answers live only in the address of this page, so you can bookmark or share the result. It covers the ADMT rules in Article 11 of the CCPA regulations and the risk-assessment dates that go with them.
The questions
Educational aid, not legal advice. A short checker cannot see all your facts; confirm with counsel before relying on it. Research date: . Our integrity agent alerts us when the research behind this checker is more than 120 days old.
What you must be able to show
From the obligation clock the Workbench runs against your own systems.
- Risk assessment for ADMT used for significant decisions, covering processing that began before 2026 (§ 7155(b)); summary submitted to the CPPA by 1 Apr 2028 (§ 7157)