What happened
On September 9, 2026, California Governor Gavin Newsom signed SB 813 (authored by Sen. Jerry McNerney) and AB 1405 (authored by Assm. Rebecca Bauer-Kahan) into law. SB 813 establishes a first-in-the-nation framework directing the Government Operations Agency (GOA) to create procedures for designating and overseeing independent verification organizations (IVOs) that assess AI-system and model risks and compliance with California law; GOA procedures are due by January 1, 2028. AB 1405 creates a state AI Auditor Registry with mandatory registration (beginning January 1, 2029) for anyone offering, selling, or conducting covered AI audits, and sets standards for auditor independence, transparency, and integrity. The framework is voluntary for developers/deployers (does not require them to undergo an audit) but regulates the assurance/audit ecosystem itself.
Why it matters
This is the first US state-level statutory framework creating an official AI-auditor ecosystem and independent-verification regime, filling a vacuum left by stalled EU AI Act Article 50 enforcement and delayed Colorado ADMT enforcement. Organizations that commission California-facing AI assessments must now validate auditor independence, methodology, evidence retention, and conflicts — turning AI-audit vendor selection into a compliance-relevant decision. OpenAI publicly endorsed the bills same-day, signaling industry-side momentum for state-driven AI safety infrastructure absent federal action.
Action needed
Organizations conducting or commissioning California-relevant AI risk assessments/audits should track GOA's forthcoming IVO certification criteria (due by Jan 1, 2028) and AB 1405 registry requirements (mandatory registration for auditors from Jan 1, 2029), and begin evaluating current/prospective auditors against anticipated independence and evidentiary standards.