What happened
- On September 9, California Governor Gavin Newsom signed SB 813 and AB 1405, two laws that establish independent auditing of AI systems and models.
- SB 813 gives the state government until January 1, 2028, to set how independent verification organizations are designated; these entities will assess whether a system complies with state law.
- AB 1405 creates a public registry of AI auditors, which must be operational by January 1, 2029, at the latest. From that date, nobody may offer or perform a covered audit without being registered.
- Registered auditors may not audit their own work or have interests that compromise their independence. The text clarifies that charging the audited party reasonable fees doesn’t, on its own, count as a conflict.
Why it matters
- Both laws regulate whoever audits; they don’t require any company to be audited. Commissioning an audit still depends on what contracts, insurers and courts demand.
- A team in Chile or Latin America contracting models from Californian vendors will be able to require, from 2029, that the report come from a registered auditor, with a number that can be checked on a public state website.
- Until 2029, anyone in California can present themselves as an AI auditor. The same is true in Chile, and the amendment the government is preparing for the AI bill proposes voluntary audits without describing who would accredit them.
The number
January 1, 2029. From that day on, auditing AI in California without registration will be illegal. Until then, the title of AI auditor requires nothing.
Context
In 2025, California passed SB 53, which requires frontier model developers to publish their safety frameworks and report critical incidents. The new laws add a third party to verify. Senator Jerry McNerney linked the signing to recent incidents with AI agents, and Assemblymember Rebecca Bauer-Kahan defended hers by saying the industry can’t grade its own homework. The final text keeps the financial audit model: the audited party pays and independence is protected by rules. The European regulation already requires external evaluation for some of its high-risk systems, although it postponed those obligations.
What’s next
- Jan 1, 2028: deadline for the state government to set the criteria for designating independent verifiers.
- Jan 1, 2029: deadline for opening the auditor registry, and the date from which auditing without registration is prohibited.
- Designated verifiers will have to report every year, no earlier than 12 months after their designation.
Bottom line
On August 31, the European Commission gave ChatGPT four months to audit its systemic risks. California gave itself just over two years to decide who can sign an audit.
This note describes foreign regulation and does not constitute legal advice.
Sources
- Governor Newsom signs first-in-the-nation AI safeguards to protect Californians — Office of the Governor of California, September 9, 2026
- SB-813 Independent verification organizations — California Legislative Information, version enacted September 9, 2026
- AB-1405 Artificial intelligence: auditors: registration — California Legislative Information, version enacted September 9, 2026
Edited by Rodrigo Cornejo. How we select and verify the facts, in who writes.
