California is regulating the audit layer

California has signed two laws that address a quieter part of AI governance: the people and organisations that say they can audit an AI system. SB 813 concerns independent verification organisations. AB 1405 creates a registry and operating rules for AI auditors. Both were approved by the governor and filed with the Secretary of State on 9 September.

The distinction is important. Neither law says every company must have an AI system audited. Neither gives the state a general stamp of approval for a model. Instead, they begin to set rules for a market that is likely to matter more as companies, governments and courts ask whether a claimed assessment was actually independent and competently performed.

Calling an assessment an AI audit does not by itself establish that it examined the right system, had enough evidence or was free to issue an inconvenient conclusion. A report is only as useful as the access, methods and incentives behind it.

SB 813 sets up a route to designated verification organisations

SB 813 requires California’s Government Operations Agency to develop designation requirements for independent verification organisations by 1 January 2028. The law describes these organisations as AI auditors with demonstrated expertise in assessing risk and identifying the metrics and methods behind an assessment.

The agency must consider technical expertise, documentation, cybersecurity, conflicts of interest and independence from the organisation being assessed. The legislation also calls for working groups, including auditors, academics, companies, civil-society groups and standards bodies. Designated organisations would later submit annual reports about their methods and governance.

But SB 813 has a deliberately narrow limit. It does not compel a company to hire a designated organisation or submit an AI system to an audit. It also says the state’s publication of criteria is not an endorsement of any model or system. The law builds possible verification infrastructure. It does not automatically create demand for every part of it.

AB 1405 regulates the auditor as a service provider

AB 1405 takes a more direct route. It requires the agency to create an online AI Auditor Registry by 1 January 2029. From that date, an unregistered person may not offer, sell or conduct a covered AI audit in the state. A covered audit is defined as one that assesses the internal controls, processes or systems needed for compliance with state law.

Registered auditors must disclose the standards they use and the basis for claims about their protocols. Their reports must describe scope, results, evidence, deficiencies, proposed measures where appropriate and important limitations. The law also requires independence and objectivity, including limits on auditing one’s own work or taking an engagement where a financial or employment relationship could compromise judgment.

Those rules address a familiar assurance problem. An auditor paid by a client is not automatically conflicted. But payment terms tied to the outcome, close operational dependence or revolving-door employment can change the value of the report. The new statute makes those questions explicit rather than leaving AI audit as a loose marketing label.

A registry is not a safety verdict

The laws provide useful guardrails, but their dates matter. The verification-organisation process is due in 2028. The auditor registry and registration condition begin in 2029. California still has to write criteria, decide how it will handle complaints and turn broad references to recognised standards into procedures that work on real systems.

The two laws also make several limits clear. SB 813 does not create liability solely because a standard was missed, and an audit performed under a recognised standard is only relevant, not conclusive, in a harm case. AB 1405 says registration is not a state recommendation or endorsement of an auditor.

An audit can be well run and still be narrow. It can miss changes made after the review, depend on incomplete access or answer a legal-compliance question rather than a broader safety question. The value of California’s move will depend on whether reports become legible enough for customers, regulators and affected people to understand what was actually checked.

What is confirmed, what the laws require, and what remains open

Confirmed: California’s official bill texts show that SB 813 and AB 1405 were approved on 9 September 2026. They establish future obligations for the Government Operations Agency, rules for audit providers and explicit non-endorsement language.

What the laws require: SB 813 directs the state to create criteria and a designation process for independent verification organisations. AB 1405 requires a public registry, auditor registration and specified independence and reporting practices for covered audits, on the timelines written into the statutes.

Open questions: what counts as a robust audit method for different AI uses, how the agency will enforce the rules, how much auditor access clients will provide, whether registered auditors will be available at a reasonable cost, and whether future laws will require particular systems to be audited in the first place.

Sources

  1. California Legislative Information — SB 813, Independent verification organizationsOfficial enacted bill text. Source for approval date, the 2028 designation process, independence criteria, working groups and the statute’s limits.
  2. California Legislative Information — AB 1405, Artificial intelligence: auditors: registrationOfficial enacted bill text. Source for approval date, the 2029 registry, registration condition, audit-report requirements, independence rules and enforcement provisions.