Faulkner Governance Risk & Compliance Faulkner Governance Risk & Compliance

AI controls

California: the dates, and the controls that answer them

Risk assessments since 1 January 2026. Automated decisionmaking duties from 1 January 2027. Independent cybersecurity audits from 1 April 2028.

I

The dates

The California Privacy Protection Agency approved its regulations on risk assessments, automated decisionmaking technology and cybersecurity audits on 23 September 2025. Risk assessments have been required since 1 January 2026 and are filed with the agency by 1 April 2028. The notice, opt out and access duties for automated decisionmaking take effect on 1 January 2027. Independent cybersecurity audits are due by 1 April 2028 for businesses with more than one hundred million dollars of annual revenue, by 1 April 2029 for those between fifty and one hundred million, and by 1 April 2030 for those under fifty million. The audit has to rest on documented evidence, not on management’s say so. The rules reach any company of size that sells to Californians, wherever it sits.

II

The control test

The control test is the one a financial statement auditor runs, applied to a different population. We inventory every system that makes or materially shapes a decision about a Californian, by use case; write the risk assessment the regulation describes, with an owner, the evidence and a date on every line; design the notice, opt out and access controls and test that they operate; and build the evidence file a cybersecurity audit will ask for in 2028, so the audit finds a program that was already running rather than one assembled for it. You receive the assessment, the control matrix, the test workpapers and a gap list with an owner and a date on every line.

AI controls and governance, the full line

Start with a scoping call

Send the date on your calendar and a sentence on what is coming up.