Topic starter
12/07/2026 12:17 pm
TL;DR: California’s updated CCPA regulations add new obligations for automated decision-making, cybersecurity audits, and risk assessments, with staged compliance dates beginning in 2027 and audit attestations from 2028, according to OneTrust. The practical shift is from policy awareness to evidence-backed governance across automated systems, vendor contracts, and recordkeeping.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “CCPA Adopts New CCPA Regulations: What Businesses Need to Know”.
By the numbers:
- Automated decision-making technology compliance is effective January 1, 2027, according to OneTrust.
- Businesses with annual gross revenue of $100M or more face cybersecurity audits effective April 1, 2028, according to OneTrust.
- Businesses with annual gross revenue between $50M and $100M face cybersecurity audits effective April 1, 2029, according to OneTrust.
Key questions
Q: What fails when automated decision-making rules are not mapped to real business workflows?
A: The failure mode is hidden scope.
Q: Why do privacy audits require evidence, not just policies, under the new CCPA rules?
A: Because the regulation is testing whether controls actually operated, not whether they were described.
Q: What are the signs that an ADMT governance programme is underdeveloped?
A: Common signs include missing inventories, informal human review, unclear opt-out handling, weak vendor clauses and assessments that exist only as templates.
Practitioner guidance
- Inventory all ADMT use cases Document every automated decision workflow, including rule-based tools, third-party systems and any process that affects high-impact consumer outcomes.
- Build consumer disclosure and appeal workflows Create pre-use notices, opt-out handling and human review paths that map directly to the decisions the system makes.
- Rewrite vendor terms for ADMT accountability Add contractual obligations for transparency, assessment support, record sharing and remediation when a supplier participates in decision-making.
Bottom line: CCPA’s ADMT rules turn automated decision-making into an operational governance issue that spans disclosures, appeals, vendor oversight and evidence retention.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:31 pm
CCPA ADMT is really a governance evidence problem, not just a privacy notice problem: the new rules force organisations to prove how automated decisions are controlled, reviewed and challenged. That shifts privacy from static disclosure into operational accountability, which is where identity governance, workflow ownership and evidence retention begin to overlap. The practical conclusion is that teams should stop treating ADMT as a niche legal overlay and start treating it as a control environment.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- Only 37% of organisations had policies for managing AI or detecting shadow AI, according to IBM's 2025 Cost of a Data Breach Report.
A question worth separating out:
Q: Which teams should own ADMT compliance when automated decisions involve third-party tools?
A: Ownership should be shared across privacy, legal, security, procurement and the business team running the decision process. Privacy defines the control requirement, procurement secures contractual support, security protects the environment and the business owns the actual decision workflow. Shared responsibility is essential because the obligation follows the outcome, not the tool vendor.
👉 Read our full editorial: CCPA’s ADMT rules raise the bar for privacy governance