Two new laws will introduce qualification standards by 2028 and require firms conducting AI audits to register with the state beginning in 2029.

California Gov. Gavin Newsom signed two laws establishing state oversight of businesses that assess whether AI systems comply with state requirements.

Assembly Bill 1405 regulates outside AI auditors that check compliance with California law. Starting in 2029, those auditors must register with the state. They cannot review work they helped create, and they must document what they examined and found.

Senate Bill 813 requires the state to set qualification standards and review the credentials of organizations seeking recognition as independent experts in assessing the risks posed by AI systems.

The laws do not require AI developers or other companies to commission an audit. They regulate the auditors that businesses may hire to examine whether an AI system has the controls and processes needed to comply with California law.

California will screen and register AI auditors

SB 813 requires California to create qualifications for companies seeking state recognition as independent AI risk assessors. By January 1, 2028, the California Government Operations Agency must decide what technical expertise applicants need and how they must remain free from client control when reaching conclusions or making recommendations.

The auditor can accept a fee from the assessed company, but that company cannot tie the auditor’s fee to the result. The auditor must also be free to assess the system without interference from that company. The state can withdraw its designation if the organization misrepresents its work or no longer meets the standards.

The designation is optional. It does not mean California endorses the assessor or the AI system it reviews, and companies will not have to use a state-designated organization.

AB 1405 serves a different purpose. It covers auditors hired to check whether a company’s AI systems have the controls needed to comply with California law. Starting January 1, 2029, those auditors must register with the state before offering these services.

The public registry will allow companies to confirm that an auditor is registered and understand how it conducts its reviews.

Auditors must remain independent and explain their work

AB 1405 prohibits registered auditors from reviewing their own work. An auditor cannot assess an AI system, business process, or safeguard that it helped create or operate.

People conducting the audit also cannot pursue a job with the client company while the review is underway. A former employee cannot be assigned to examine work they were responsible for at that company during the previous year.

After completing an audit, the auditor must tell the client what it checked, what it found, and what it could not verify. If the audit uncovers problems, the report must explain how the company could address them when appropriate.

Auditors must keep their reports and supporting records for at least 10 years.

SB 813 addresses how an audit may be used in court. If a lawsuit alleges that an AI system caused harm, a court may consider an audit conducted under a state-recognized standard. However, the audit alone will not determine whether the defendant is liable.

California can investigate auditor misconduct

AB 1405 requires the state to establish a system for individuals to report suspected misconduct by registered auditors.

The Government Operations Agency may investigate those reports. An auditor found to have violated the law could be removed from the registry and referred to the California Attorney General or another enforcement authority.

Auditors must be notified first and given an opportunity to correct or contest an alleged violation before removal. The law also prohibits audit firms from retaliating against employees who report suspected violations.

Requirements will roll out through 2029

SB 813 requires the agency to form working groups that include engineers from competing AI companies and AI safety experts. The groups will provide input on the qualification standards, and the agency must report their conclusions to the Legislature.

The state must establish its standards for designated independent assessors by January 1, 2028. The auditor registry and registration requirement must be operating by January 1, 2029.

Newsom also called for federal AI regulation when announcing the laws, arguing that state action alone cannot address risks that cross state borders.

Frontier AI developers Anthropic and OpenAI both endorsed the bills, saying corporate self-governance is not enough to tackle AI dangers.