California's privacy agency finalized CCPA regulations in September 2025 covering cybersecurity audits, risk assessments and automated decisionmaking technology. The rules took effect on 1 January 2026, with later phase in dates: ADMT requirements from 1 January 2027 and audit certifications from April 2028 to April 2030, depending on revenue.
The dates the agency published
According to the California Privacy Protection Agency announcement:
- Effective date: the regulations go into effect on 1 January 2026.
- Risk assessments: compliance begins on 1 January 2026. By 1 April 2028, businesses must submit an attestation that required assessments were completed, along with a summary of that information.
- ADMT: businesses using automated decisionmaking technology for significant decisions must comply beginning 1 January 2027.
- Cybersecurity audits: certifications are due 1 April 2028 for businesses making over $100 million, 1 April 2029 for those making $50 million to $100 million, and 1 April 2030 for those making under $50 million.
These dates come from the announcement. The regulation text and any later changes control, so confirm before you plan against them.
What each area asks you to do
This post uses the agency's summary and does not reproduce the rules. In general terms:
- Cybersecurity audits are an independent review of your security program, reported on a schedule.
- Risk assessments are written analyses of processing that carries significant risk to consumers, weighed against the benefits.
- ADMT rules concern technology that makes or heavily influences significant decisions about people. Expect notices and consumer choices around it.
Read the regulation text for definitions and thresholds. Terms like "significant decision" matter a lot and are defined there.
A planning timeline for a mid sized company
- Now: confirm whether you are covered, see the three thresholds.
- Inventory processing that involves profiling, scoring, hiring or lending decisions, and tools that automate them.
- Draft a risk assessment template and run it on your highest risk processing.
- Before 1 January 2027, decide how ADMT notices and consumer choices will work if you use it.
- Identify who would act as the independent auditor and when they would start, working back from your revenue tier date.
- Keep evidence of control operation throughout the year, not in a scramble before the audit.
How this compares to GDPR
Both regimes ask for documented risk analysis. The GDPR equivalent is the DPIA. They are separate legal duties, so one document may need adapting before it serves both.
Quick check
Do the audit rules apply to every business under the CCPA?
The announcement gives dates by revenue tier. Read the regulation to see which businesses must complete audits.
Are these rules in effect now?
The agency states the regulations went into effect on 1 January 2026, with later compliance dates for specific requirements.
Safeguard's compliance and evidence automation can collect control evidence continuously, which helps in any audit. It does not perform an independent audit.
Sources
- California Privacy Protection Agency, California finalizes regulations to strengthen consumers' privacy
- California Privacy Protection Agency, regulations
Last reviewed: 19 October 2026.
