The auditors get audited

California signed two bills on Sept. 9, 2026 creating the first state framework for independent AI verification organizations. A chatbot law signed the next day wires auditing into product safety.

“California has moved beyond requiring companies to examine the risks of artificial intelligence and has begun regulating the people hired to perform those examinations.”

Standards by 2028

SB 813 gives the Government Operations Agency until Jan. 1, 2028 to set criteria. Applicants disclose qualifications, methods and testing tools, and must show they can manage conflicts of interest.

Paid, but not bought

An auditor can take reasonable payment from the company it assesses, but the fee cannot hinge on what it finds. The auditor stays operationally independent and keeps control of its conclusions.

“compensation cannot depend on the findings”

A registry with a gate

AB 1405 requires an online AI Auditor Registry by Jan. 1, 2029. After that, unregistered people generally cannot offer, sell or conduct an AI audit required under state law.

Put the gaps on record

Reports must cover scope, findings, deficiencies and remedies, and disclose limitations. If a vendor withholds model documentation or system access, that gap goes in writing.

“A company can commission an independent assessment, but the result may provide little assurance if a vendor withholds the model documentation.”

You cannot grade your own work

Auditors cannot evaluate systems they materially designed or operated, and staff cannot audit an area they were responsible for in the past 12 months. Violations mean removal and referral to the attorney general.

Adam's Law raises the stakes

From July 1, 2027 companion chatbot operators must assess child-safety risks, with independent audits by Jan. 1, 2029 and every two years after. The lead auditor certifies under penalty of perjury.

“An AI audit may soon be judged as closely as the system it examines.”