A view from DC: Time is running out to prepare for privacy audits

On the long flight back to D.C. from Seattle, where the IAPP hosted its Privacy. Security. Risk. + AI Governance Global 2026 conference last week, I reflected on the panels, conversations and snippets of insights I'd absorbed across the three days of activity in the emerald city. If there was one theme of this conference, one resounding echo that stood out as a new topic when compared with prior years, it was audits.

Assurance, approaching

Whether in the form of assessments, assurance, evaluations or bone fide audits, conference speakers and attendees wouldn't stop talking about the new wave of oversight coming to privacy and artificial intelligence governance functions.

For starters, the emerging discipline of AI assurance was top-of-mind across a few panels at P.S.R. + AIGG. My colleague, IAPP Managing Director, AI Governance Center, Ashley Casovan, led an interesting discussion on this topic with other assurance experts. Among other things, they outlined some basic distinctions in assurance roles:

• An evaluator measures what the system does. Their work is empirical, including tests, benchmarks and red-teaming. 
• An investigator establishes what happened after an incident. They reconstruct events and identify causes.
• An assessor appraises risk, asking whether something is good enough for a stated purpose.
• An auditor concludes. An audit is a systematic, independent examination against fixed criteria, ending in a conclusion on whether those criteria are met. 

The auditor's new clothes

Of course, policymakers are already thinking about regulating the profession of AI auditors. In fact, after I wrote about California's new laws governing this emerging profession, Gov. Gavin Newsom, D-Calif., signed an executive order fast-tracking the deadlines under the law. 

Instead of California's GovOps agency having until 1 Jan. 2028 to promulgate regulations for independent verification organizations, as required under SB 813, the agency must now do so by 1 May 2027. And instead of building an AI auditor registry with fees and operating standards by 1 Jan. 2029, as under AB 1405, the agency must do so two years earlier.

Newsom paired these updates with a new convening of experts "in consultation with the Governor's Office of Emergency Services" to consider potential changes to strengthen state law. On the table are enhancements like embedding independent verification organizations onsite at frontier labs, mandatory third-party verification of the safety frameworks and risk assessments already required under SB 53, a frontier-model "kill switch" tested by independent verifiers and widening "critical safety incident" to cover loss-of-control events.

Together, the governor described these efforts as a response to recent prominent cybersecurity incidents from AI agents, promising to "speed up our work on substantial and responsible AI oversight before it's too late" and contrasting California's proactive structure with his perception of "the federal government's abject failure to create any form of meaningful AI oversight or accountability."

Under penalty of perjury

More pressing are the coming cybersecurity compliance deadlines.

For tens of thousands of organizations, the clock starts running for the CCPA cybersecurity audit requirements, 1 Jan. 2027. This means all controls should be in place and operating, so that later testing will show sufficient evidence of a robust program, and so that a member of executive management can sign their name to a certification by 1 April 2028 — after the first audit report is filed. 

The runway is longer for some covered organizations, but honestly the top tier starts at a pretty low revenue threshold of USD100 million. For those over USD50 million, the first report is due in 2029 with a lookback starting 1 Jan. 2028. And for everyone else covered by the CCPA, these deadlines are pushed back another year. 

The existing scope of CCPA applies, so the revenue thresholds are only applicable to covered businesses under the law, which only kicks in at an inflation adjusted USD26 million. The one exception to the minimum threshold: a business of any size must comply if it derives more than 50% of its revenue from the sale or sharing of personal data. 

In another excellent presentation at P.S.R. + AIGG, Hintze Law Partner Sam Castic, AIGP, CIPP/US, CIPM, FIP, PLS, led a discussion about how to prepare for these deadlines. The panel highlighted the urgent need to conduct gap analyses against existing cyber programs so that any needed remediation is conducted over the next year, rather than showing up on your first audit report. Conducting this under the privilege of legal counsel is recommended as a guardrail, and this gets tricky when using internal counsel.

FTI Consulting, in a sponsored P.S.R. + AIGG session, added even more detail about how to build CCPA controls against existing standards like SOC 2 and ISO 27001. The top action item from this session was for each privacy professional to check your SOC 2 report and find the "carve out" paragraph to examine what segments may not be covered by existing testing that could be required to be covered under the CCPA regulations. 

Both panels agreed, getting your internal structures in line with the requirements is another 2026 readiness item. This includes validating that internal auditing teams, if not using external auditors, are sufficiently independent from privacy and cybersecurity functions and identifying an executive to sign off on the eventual report. 

In the U.S. state compliance workshop I co-taught with Stauss founder David Stauss, CIPP/E, CIPP/US, CIPT, FIP, he also highlighted another action item: updating.

California Privacy Protection Agency Chief Auditor Sabrina Boyson Ross also spoke in Seattle. Earlier, she sat down with IAPP News Editor Joe Duball to outline her work and the plans the agency has. Importantly, in addition to overseeing mandatory cybersecurity audits — and requesting the required reports from any company with a 30-day shot clock — the agency has authority to conduct its own audits, which it is doing on a sector-by-sector basis starting with the gig economy.

Please send feedback, updates and your personal assurance to cobun@iapp.org.