California has created a framework for independent AI auditing, with two laws that set up a state-run registry for people who audit AI systems and a voluntary verifier tier above it. Governor Gavin Newsom signed Senate Bill 813 and Assembly Bill 1405 on September 9, 2026. The laws do not require companies to buy audits, but they set rules for anyone who sells them, and they will be enforced by the California Government Operations Agency.
What AB 1405 Requires
AB 1405 is the mandatory half. Starting January 1, 2029, anyone in California who offers, sells or conducts a covered AI audit must be registered with the Agency. Covered audits concern the internal controls, processes or systems an AI model uses to comply with state law, which means the registry is aimed at the people doing compliance work, not at the companies building models.
Registered auditors must meet standards for independence, transparency and integrity. Those rules matter because audit firms are typically paid by the parties they assess, a conflict that regulators have long worried about in financial audit.
The law applies to auditors, not to AI developers or deployers. A company that uses an AI system is not required to commission an audit under these laws.
Who Is Affected
The direct obligations fall on three groups. The first is auditors who want to work on covered audits in California, who will need to register before 2029. The second is the Agency itself, which must build the registry and publish designation criteria on the timelines in the statutes. The third is the wider group of companies that deploy AI in California, which gain a formal option: they may commission an independent review from a registered auditor, and, if they are sued, a qualifying audit can help their defense.
For smaller companies, the practical question is cost. An audit is optional, but a credible one may become the standard way to show good faith. Firms that already run internal model reviews may find that the registry creates a market for external checks they can point to. Those that do not may face pressure from customers or insurers to obtain one, even without a legal mandate.
What SB 813 Adds
SB 813 creates a second tier, called Independent Verification Organizations, or IVOs. Auditors can apply to be designated as IVOs, and that designation is voluntary. The Agency must publish application requirements, procedures and designation criteria by May 1, 2027, according to a legal analysis of the bills. IVOs must file annual reports, starting no sooner than 12 months after designation.
The most consequential provision is about litigation. Under SB 813, an audit that follows an identified standard is "relevant to, but not conclusive of," a lawsuit alleging harm from an AI system. Lawyers reading the bill expect courts may treat a qualifying audit as a mitigating factor, which gives companies a reason to seek independent review even though no statute requires it.
Because IVO status builds on registration, an auditor that wants the verifier designation must also be on the registry. The two tiers form one system: a mandatory baseline for everyone doing covered audits, and an optional credential that carries legal weight.
Dates and Discrepancies
Coverage of these laws contains conflicting details, and readers should check the bill text on the California Legislature's website before relying on any date. A legal alert notes that Executive Order N-9-26, signed on September 18, 2026, moved some implementation deadlines up by about a year. The same analysis gives two different dates for when the Agency must establish the registry, May 1, 2027 in one place and December 1, 2027 in another. Some secondary sources also describe the IVO deadline as 2028, which the primary-source analysis does not support.
The sources also differ on how mandatory the framework is. One analysis calls the registry mandatory and the IVO tier voluntary. Others describe the whole structure as voluntary at the company level. The consistent point is that no general audit requirement applies to businesses in California.
Governor's Message
Newsom framed the laws as protecting the public. His statement said AI "must be developed and deployed with meaningful safeguards to protect the public," a line that reflects the state's approach of building oversight around the audit market instead of banning systems outright.
Why It Matters
California has moved from broad AI principles to infrastructure: a registry, credentials and a liability signal. That structure could become a model for other states, many of which are writing their own AI rules, and it gives companies a concrete target. Audit firms will need to decide early whether to register and whether to pursue the IVO designation, because the 2029 registry deadline arrives sooner than it might seem for firms building compliance practices.
The litigation provision may be the most important piece for businesses. If courts treat a qualifying audit as evidence of reasonable conduct, a verified audit becomes a practical defense, even though it is not mandatory. Legal teams should watch the Agency's rulemaking, which will determine what counts as an identified standard and who qualifies to audit.
