California Builds the Plumbing for AI Audits
Two new laws create the first US framework for state-certified independent AI auditors. Nothing is mandatory yet. The infrastructure for making it mandatory now exists.
Most AI regulation argues about what companies must do. California's two newest laws are about something more basic: who is qualified to check. On 9 September 2026 Governor Gavin Newsom signed SB 813 and AB 1405, which his office described as first-in-the-nation standards for third-party audits and independent assessments of AI systems.
What the laws do
SB 813, authored by Senator Jerry McNerney, establishes a framework for independent verification organisations that can assess AI systems and models for compliance with state law. The bill text directs the Government Operations Agency, on or before 1 January 2028, to act on the selection and regulation of those organisations, convene stakeholder working groups and report to the Legislature; designated organisations must report annually. McNerney's office describes it as a voluntary, flexible framework that takes effect on 1 January.
AB 1405, by Assemblymember Rebecca Bauer-Kahan, creates a state registry for AI auditors and standards for their independence, transparency and integrity. Under the bill text, the Government Operations Agency must establish the AI Auditor Registry no later than 1 January 2029, after which a person may not offer, sell or conduct a covered AI audit unless registered. The bill's independence rules bar auditors from accepting employment with an auditee within 12 months of completing an audit and from auditing an entity that employed them in the preceding 12 months.
What the laws do not do
Neither statute requires any developer or deployer to undergo an audit. SB 813's own summary says so explicitly. The framework is voluntary until another law, contract or regulator requires an audit and points at the registry. That is a deliberate sequencing choice, and it is also why two frontier labs could support the bills: Politico reports that Anthropic backed them in August and OpenAI endorsed them on 9 September, shortly before signing.
The precedent is close by. Illinois enacted its Artificial Intelligence Safety Measures Act in July 2026, which StateScoop reports mandates annual independent third-party audits for major frontier developers. California has built the auditor supply; Illinois has created auditor demand. The two models will likely converge.
The politics
Newsom's statement pairs the signing with a call on the federal government to step forward with robust national regulation. McNerney was blunter: the signing 'sends a clear message that California is taking the lead on assessing AI's safety risks, since Washington, D.C., is unable or unwilling to do so.' Bauer-Kahan framed the case for independence: 'We cannot expect industry to simply grade its own homework.'
The laws build on SB 53, California's 2025 Transparency in Frontier AI Act, which requires frontier developers to publish safety frameworks and report critical incidents. Across the Atlantic, the EU AI Office's enforcement powers for general-purpose model and transparency rules activated on 2 August 2026. Verification capacity is becoming the scarce resource in AI governance on both sides.
Who benefits, who is at risk
Beneficiaries: audit and assurance firms that register early, frontier labs that can point to independent verification, and regulators elsewhere who can reference California's registry. At risk: consultancies selling 'AI audits' today with no independence rules, and developers whose voluntary frameworks will now be checked by someone else.
What happens next?
- The Government Operations Agency begins rulemaking on independent verification organisations ahead of the January 2028 deadline.
- Other states reference the California registry rather than building their own.
- Mandates arrive by other routes: Illinois-style audit requirements, procurement rules and insurer demands.
- Frontier labs publish audits by registered organisations as a trust signal.
Related topics
Sources & references
- 01Governor Newsom signs first-in-the-nation AI safeguards to protect Californians — Office of Governor Gavin Newsomprimary
- 02SB 813 bill digest and history — CalMatters Digital Democracyprimary
- 03AB 1405 bill text — LegiScanprimary
- 04Newsom signs McNerney's landmark bill to assess artificial intelligence safety risks — Office of Senator Jerry McNerneyprimary
- 05Newsom signs AI safety bills backed by Anthropic, OpenAI — Politiconews
- 06Newsom signs legislation establishing framework for third-party AI auditors — StateScoopnews
- 07Enforcement of the AI Act — European Commissionprimary
More from Artificial Intelligence
Humanoids Clock In: What the First Factory Contracts Reveal
Global humanoid shipments jumped to between 13,000 and 18,000 units in 2025, led by Chinese vendors, but most went to entertainment, education and data collection. The first binding factory contracts in Europe show where commercial deployment actually starts: box handling, battery assembly and robot-as-a-service pricing.
Open Weights Just Got Bought
In one summer, the largest open-weight models ever released arrived from Moonshot, DeepSeek and Alibaba, and the two platforms through which developers find and route them were acquired by NVIDIA and Stripe. Open weights are strategic infrastructure, and the strategy now has owners.
The Age of AI Employees Has Begun
Agents are being connected to the systems where work actually happens. That changes what companies buy, how they organise and what a productive employee looks like.
Physical AI Leaves the Lab
Pilots in logistics and manufacturing are moving physical AI from research into commercial environments, and operators are starting to judge them like any other capital equipment.