Sarah L. Bruno and Grace D. Wiley of Reed Smith LLP examine California’s finalized CCPA regulations governing automated decision-making technology and mandatory cybersecurity audits, focusing on the legal and compliance questions attorneys are most likely to encounter, particularly in light of recent CPPA enforcement actions. The discussion addresses when these rules apply, how regulators evaluate risk, oversight, and accountability, and the practical implications for advising clients on governance, vendor relationships, and compliance timelines.