California's New AI-Auditor Registry: What It Actually Requires If You Ship AI Products

If you build or ship AI products with any exposure to California, two bills signed into law this week are worth understanding now, even though most of what they require won’t take effect for years. The gap between “signed into law” and “actually enforced” is exactly the detail most coverage of this glosses over.

What actually got signed

On September 10, Governor Gavin Newsom signed AB 1405 and SB 813 — together described by his office as the first framework in the US requiring independent third-party audits of AI systems.

• AB 1405 (Assemblymember Rebecca Bauer-Kahan) requires California’s Government Operations Agency to establish an AI Auditor Registry, sets standards for auditor independence and integrity, and — starting once the registry exists — bars unregistered persons or organizations from conducting a “covered AI audit.” Licensed CPAs and accounting firms already regulated by the California Board of Accountancy are exempted from some of these requirements if specific conditions are met.
• SB 813 (Senator Jerry McNerney) creates a separate framework for designating independent verification organizations that can assess AI systems for compliance with state law.

Both bills define a “covered AI audit” the same way: an assessment of the internal controls, processes, or systems a company needs to comply with state law — not a generic technical evaluation of a model’s capabilities.

The timeline nobody’s headline is emphasizing

Here’s the detail that changes how urgent this actually is: the law requires the registry to exist no later than January 1, 2029, and the restriction on unregistered persons conducting covered audits only kicks in once that registry is live. This isn’t a 2026 or 2027 compliance deadline — it’s a multi-year runway. If you saw a headline implying immediate new audit requirements, that’s an overstatement of where things actually stand today.

Why this is happening now

This builds directly on California’s 2025 Transparency in Frontier AI Act (SB 53), which required frontier AI developers to publicly disclose safety frameworks and report critical safety incidents, and the California AI Transparency Act, whose scope was broadened this session and takes effect in August 2026. Together, these form a pattern: California legislating AI transparency and accountability incrementally, rather than in one comprehensive law, as Congress has not passed federal AI legislation to fill that gap.

Notably, both Anthropic and OpenAI backed this specific legislation — a signal that at least some frontier labs see structured, credentialed third-party auditing as preferable to either no oversight or a patchier alternative. The rationale offered by the bill’s author was direct: that the industry evaluating its own AI systems creates an inherent conflict of interest, and that independent auditors are needed to verify safety claims rather than take them at face value.

Not everyone agrees with the approach. The Business Software Alliance, an industry trade group, opposed the bills, arguing they contribute to a state-by-state regulatory patchwork that’s harder for companies to comply with than a single federal standard would be — a genuine, reasonable concern regardless of one’s view on the underlying goal, since 26 separate AI-related bills moved through California’s legislature this session alone.

What to actually do about this now

Given the 2029 registry deadline, there’s no immediate compliance action required — but there are things worth doing now rather than waiting:

• If you operate in California and your AI systems inform decisions covered by state law (the bills’ language centers on compliance-relevant internal controls and processes), start tracking what “covered AI audit” ends up meaning in the implementing regulations the Government Operations Agency will need to write before 2029 — that’s where the real operational detail will land, not in the bill text itself.
• Don’t confuse this with the separate California AI Transparency Act, which has a much nearer-term August 2026 effective date and different, disclosure-focused obligations for generative AI providers. These are related but distinct compliance tracks.
• If you’re evaluating third-party AI auditors today, ahead of the formal registry, ask about their basis for independence and methodology now — the standards this law will eventually formalize are a reasonable preview of what “credible” auditing should already look like.

Official reference: the enrolled text of AB 1405 and SB 813 via the California Legislative Information website (leginfo.legislature.ca.gov), and the Governor’s office announcement — both confirmed as signed on September 10, 2026.