California Privacy Protection Agency Draft Risk Assessment and Automated Decisionmaking Technology Regulations

• Authority: California
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Proposed
• Most recent activity date: 2024-03-08

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Compromise of privacy
• AI system security vulnerabilities
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• False or misleading information
• Fraud, scams, and targeted manipulation
• Loss of human agency and autonomy
• Increased inequality and decline in employment

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8-10 subdomains, with strong focus on discrimination and unfair treatment (1.1, 1.3), privacy compromise (2.1), AI system security (2.2), lack of transparency (7.4), and lack of robustness (7.3). Coverage is concentrated in discrimination/toxicity, privacy/security, and AI system safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Finance & Insurance
• Professional & Technical Services
• Educational Services
• Health Care & Social Assistance

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Trade, Transportation & Utilities
• Information
• Real Estate, Rental & Leasing
• Scientific Research & Development Services
• Arts, Entertainment & Recreation
• Accommodation, Food & Other Services

All other sectors had no coverage in this document.

Sectors Summary

This regulation applies broadly across all economic sectors where businesses process consumer personal information using AI or automated decisionmaking technology. It has particularly detailed coverage for sectors involving significant decisions: Finance and Insurance, Health Care, Educational Services, Professional and Technical Services, and Public Administration. The regulation is sector-agnostic in its core requirements but provides sector-specific examples throughout.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding regulatory instrument with mandatory language throughout ('must', 'shall', 'required'), explicit enforcement mechanisms, penalties for non-compliance, and formal regulatory authority from the California Privacy Protection Agency.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: California Privacy Protection Agency
• Summary: The document is a regulatory instrument proposed by the California Privacy Protection Agency (CPPA) to add provisions to existing California Consumer Privacy Act regulations. The title explicitly identifies this as a CPPA draft regulation.

Target

• Entity Types: AI_Developer, AI_Deployer
• Entities: Businesses that process consumer personal information using AI or automated decisionmaking technology, service providers, contractors
• Summary: The regulations apply to 'businesses' that use automated decisionmaking technology or AI to process consumer personal information, particularly for significant decisions, profiling, or training AI systems. Service providers and contractors are also subject to specific requirements.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: California Privacy Protection Agency; Attorney General
• Summary: The California Privacy Protection Agency has authority to receive risk assessment submissions and request unabridged assessments. The Attorney General is explicitly mentioned as having authority to request risk assessments and enforce compliance.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: California Privacy Protection Agency; Attorney General
• Summary: The Agency monitors compliance through mandatory risk assessment submissions, certifications of compliance, and has authority to review unabridged assessments. The Attorney General also has monitoring authority through request powers.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers multiple AI lifecycle stages with primary focus on Build and Use Model, Verify and Validate, Deploy, and Operate and Monitor stages. It addresses training of AI systems, evaluation and testing requirements, deployment decisions, and ongoing monitoring obligations. The Plan and Design stage is implicitly covered through risk assessment requirements before processing initiation.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Generative AI
• Predictive AI

Technical Scope Summary

The document explicitly defines and covers both AI and automated decisionmaking technology broadly. It addresses AI systems, AI models (including generative models like large language models), and various AI applications. It does not specifically mention frontier AI, general purpose AI, task-specific AI, foundation models, or compute thresholds. It does address deepfakes and covers both generative capabilities and predictive/decision-making applications.