The CCPA package’s effective date is not a single deadline for every obligation. CPPA says covered risk-assessment compliance begins in 2026, significant-decision ADMT compliance begins in 2027, and first cybersecurity-audit certifications are staggered from 2028 to 2030 by the specified revenue bands. Scope still depends on the regulatory definitions and thresholds.
Build an inventory covering personal information, processing purpose, decision use, suppliers and retention. Ask counsel which activities require assessments and which consumer requests the product must support. A support classifier and a credit-eligibility recommendation should not share an unexamined classification.
For generative systems, the California Attorney General’s official advisory also identifies AB2013 training-data disclosure requirements from January 2026. This pass verified that official summary, but the legislature host blocked direct retrieval. Do not treat this as a complete interpretation of substantial modifications, exemptions or subsequent court rulings; obtain a current legal review for your release.