California CCPA regulations on automated decisionmaking technology, risk assessments, and cybersecurity audits
A business using technology that replaces or substantially replaces human decision-making for significant decisions about consumers (finance, housing, education, employment, health care) must assess risk, give notice before use, offer an opt-out or a human appeal, and explain the logic on request; larger businesses must also commission independent cybersecurity audits.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Mandate disclosed to supervisor C-M1 | Required by the text | pre-use notice describing the technology and how its output is used | high | 1 case |
| Authority limit on automation over humans C-E6 | Required by the text | opt-out, or an appeal to a human reviewer who can overturn the decision | medium | 1 case |
| Pre-execution validation C-D1 | Implied | a risk assessment before the processing begins | medium | 3 cases |