California Forges A New Path On Automated Decision-Making Technology, Risk Assessments, And Cybersecurity Audits

Introduction

As the United States transitions to a new administration, federal policymaking is beginning to shift away from civil rights and other Biden-era AI governance priorities and towards AI policies focused on "out-innovating the rest of the world," securing US technological advantage, and national security, defense, and cybersecurity. In the meantime, states will play a critical role in technology policy, as they continue to innovate on privacy, AI, and cyber policymaking.

Among the raft of state-level AI, privacy, and cyber laws that passed in recent years – including Colorado's sweeping AI Act – and the many more proposals percolating within state legislatures as the 2025 legislative session opens, the California Privacy Protection Agency (CPPA) has proposed new regulations that would, if adopted, establish AI, privacy, and cybersecurity norms likely to ripple across the US market.