Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Admt Regulations topic
No spam. Unsubscribe anytime.
OAL approves CPPA omnibus rules on automated decision‑making, cybersecurity audits; effective Jan. 1, 2026
Summary
CPPA general counsel told the board that the Office of Administrative Law approved the agency’s omnibus rule package that updates 2023 regulations, adds ADMT requirements, cybersecurity audits and risk‑assessment timelines. Key compliance deadlines for businesses were announced.
The California Privacy Protection Agency informed the board on Sept. 26 that the Office of Administrative Law has approved the agency’s omnibus regulatory package covering automated decision‑making technology (ADMT), cybersecurity audits and risk assessments. General Counsel Philip Laird told the board the rules will "officially take effect on 01/01/2026," and staff outlined staggered compliance timelines for different sized businesses.
Nut graf: The approved package expands the agency’s 2023 regulations and adds new governance requirements, compliance on‑ramps and timelines intended to give businesses time to operationalize the new duties while enhancing consumer protections for ADMT and cybersecurity.
Major compliance dates provided by staff: - Cybersecurity‑audit certification submissions to the CPPA: April 1, 2028 for businesses with more than $100,000,000 in annual gross revenue; April 1, 2029 for businesses with $50–$100 million revenue; April 1, 2030 for businesses under $50 million. - Risk assessments: businesses must begin compliance on Jan. 1, 2026; attestations and summaries of risk assessments must be submitted to CPPA by April 1, 2028. - ADMT (automated decision‑making technology) requirements: businesses that use ADMT to make significant decisions must comply beginning Jan. 1, 2027.
Staff said a business education initiative will accompany the rollout: guidance documents, presentations for trade groups, and web resources on privacy.ca.gov. Board members praised staff for the rulemaking; several members described the package as a capstone moment for the agency’s regulatory work.
Ending: Laird and other staff thanked the legal division and policy teams for extensive stakeholder engagement and public comment rounds. The board did not take a vote because the OAL decision had already been issued.
