California Governor Gavin Newsom signed two AI bills on September 9: SB 813 and AB 1405. Both regulate who is allowed to audit artificial intelligence systems in the state. Neither one obliges a developer to commission an audit in the first place.
What AB 1405 actually creates
AB 1405, from Assemblymember Rebecca Bauer-Kahan, requires the state’s Government Operations Agency to open an AI Auditor Registry by January 1, 2029, complete with annual fees and a channel for the public to report auditor misconduct. From that date, “a person shall not offer, sell, or conduct a covered AI audit unless the person is registered,” and the registration number must appear on every advertisement for audit services. The law defines a “covered AI audit” narrowly: an audit of the internal controls an AI system needs to comply with state law.
The independence rules follow the accounting model. An auditor cannot audit a system it designed, built or ran for the client; its staff cannot seek a job at the audited company while the audit is underway; and it cannot assign someone who, in the previous 12 months, worked at that company with material responsibility for what is being audited. Reports must disclose their limitations and any “material gaps” in the access the auditor was given. Auditor employees who report non-compliance to the Attorney General or the Labor Commissioner get whistleblower protection; a violation costs the auditor their registration and triggers a referral to the Attorney General. Licensed CPAs and accounting firms clear the bar automatically if they already follow the California Accountancy Act and AICPA standards, with violations referred instead to the Board of Accountancy. It transplants rules that finance adopted after its own audit failures, before AI has had an equivalent one.
What SB 813 actually creates
SB 813, from Senator Jerry McNerney, works the other half of the same idea. By January 1, 2028, the state must write application requirements, designation criteria, and suspension procedures for a new voluntary category of “independent verification organizations” (IVOs), developed through working groups that include, in the bill’s own words, “engineers from AI companies that are competitors and AI safety experts.” An IVO may charge the company it assesses “reasonable market rates,” but the law forbids conditioning any payment “on the results of their assessment.”
The bill states its limits directly. SB 813 does not “require any person, partnership, or corporation that develops, deploys, or operates an AI system or model to engage an IVO or to undergo a covered AI audit as a condition of developing, deploying, or operating an AI system or model in this state.” An audit performed to the law’s standard still carries weight later: in a harm lawsuit, it is “relevant to, but not conclusive of, the action.” Even so, nothing in the text forces any company to produce one in the first place. Coverage describing California as now requiring independent AI audits does not survive a reading of that clause.
Why the labs are on board
Both leading labs welcomed the bills. Anthropic’s government affairs spokesperson, Cesar Fernandez, added a qualification to his praise: “While more work is needed to ensure AI developers are required to have safeguards evaluated by independent third-party experts, we commend Sen. McNerney and Assemblymember Bauer-Kahan.” OpenAI announced its support the day of signing, saying it now backs bills “we did not endorse in the past, and are now supporting after reconsidering in light of the recent jump in capabilities,” while cautioning that “these bills are not a substitute for federal regulation” and pledging to keep pushing Congress for “mandatory national AI safety requirements.”
A voluntary framework a company can point to without ever being forced to adopt it is easy to support; whether that is why either lab backed these bills is a reading of the incentives, not a claim either company made. What Anthropic’s own words establish as fact is narrower: independent evaluation of safeguards remains optional, by the company’s own account, even after the bill it just praised became law.
A federal deadline above the state one
California’s is not the only clock running. A June 2026 discussion draft from Representatives Obernolte and Trahan would make IVO audits mandatory for large frontier AI developers, going further than SB 813 does today. The same draft would preempt state AI laws, California’s included, for three years, and had not been formally introduced as of that reporting.
If a bill on those terms passes before January 2029, the registry AB 1405 creates and the criteria SB 813 sets by 2028 could be superseded before the state ever uses them. Newsom’s own signing statement called on the federal government to “establish robust national regulations” for AI. Congress delivering on that request, on the terms currently circulating in Washington, would take the audit question out of California’s hands.