Regs (risk assessments) — Risk assessments for significant-risk processing

Requirement

From 1 January 2026, a business must conduct a risk assessment before processing that presents significant risk to consumers' privacy — including selling or sharing personal information, processing sensitive personal information, using automated decision-making technology for significant decisions, and certain profiling or AI training — and must submit an attestation and summary to the CPPA by 1 April 2028 for assessments conducted in 2026–2027.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.