California Enacts Procedure for Audits of AI

California enacted two laws establishing a framework for independent verification of AI systems and creating a state registry for AI auditors.

Governor Gavin Newsom signed Senate Bill 813 and Assembly Bill 1405, with his office calling the bills first-in-the-nation standards for third-party audits and independent assessments of AI systems.

In the enacted legislation, California set standards for third-party audits of AI systems to increase transparency and accountability. SB 813 states expressly that it does not require anyone developing, deploying, or operating an AI system to engage an "independent verification organization" ("IVO") or undergo a "covered AI audit." The law also provides that in a suit alleging an AI system caused harm, the fact that an audit was performed under one of the new standards is relevant but not conclusive.

SB 813 directed the California Government Operations Agency to establish criteria for designating qualified organizations as IVOs that assess AI system risks. Prospective IVOs must demonstrate technical expertise, manage conflicts of interest, and remain independent from the entities they assess. IVOs may receive market-rate compensation, but payment cannot depend on the outcome of the assessment.

AB 1405 required the agency to establish a public AI Auditor Registry. Beginning January 1, 2029, no person may offer, sell, or conduct a covered AI audit without registering with the agency. A covered AI audit is one assessing the internal controls, processes, or systems for an AI system or model that are necessary for compliance with state law. Registered auditors must disclose their qualifications, follow recognized industry standards, and provide auditees with reports on audit scope, findings, and limitations. The law also imposed independence rules barring auditors from reviewing their own work or assigning individuals with recent ties to the auditee.

The agency must set IVO designation criteria under SB 813 by January 1, 2028. The AI Auditor Registry under AB 1405 must be established, and registration required, by January 1, 2029.