California Just Created the Nation's First AI Auditor Registry. If You Deploy AI in California, You're a Potential Auditee.

On September 9, 2026, Governor Newsom signed SB 813 (Chapter 179) and AB 1405 (Chapter 178) — the first state framework in the country to establish Independent Verification Organizations (IVOs) for AI systems, plus a state AI Auditor Registry with binding independence standards (Governor’s office press release). Most of the day-after coverage treated this as a frontier-lab story. That framing undersells it.

The registry bill, AB 1405, regulates auditors. The bill that defines the audit itself, SB 813, defines a “covered AI audit” not by who trained a model but by whether AI is deployed in ways that materially affect people. If your company screens job applicants with an off-the-shelf LLM, prices insurance, or makes credit and fraud decisions with borrowed models, the assurance ecosystem California just built is designed with you in its pull. Not immediately — and not yet with any purchase mandate — but with statutory dates attached.

Here is the practitioner version: what the two bills actually establish, who is in scope, what they deliberately don’t do, and the evidence base worth building during the two to three years before enforcement teeth arrive.

What SB 813 and AB 1405 actually establish

Think of the framework as three layers, split across two bills.

SB 813, carried by Senator Jerry McNerney, builds the top layer. Under Section 8898.1, the Government Operations Agency must — on or before January 1, 2028 — develop the application requirements for Independent Verification Organizations, the independence and conflict-of-interest standards they must satisfy, and the criteria for designating AI auditors as IVOs. IVOs, once designated, are qualified outside experts that independently assess the risk of AI models and systems (SB 813, Chapter 179, Statutes of 2026).

AB 1405, carried by Assemblymember Rebecca Bauer-Kahan, builds the bottom layers: a state AI Auditor Registry that must be established by January 1, 2029, and the professional standards — independence, transparency, integrity — that registered auditors operate under. From January 1, 2029, a person or firm cannot offer, sell, or conduct a covered AI audit in California unless registered (AB 1405 enrolled text).

Two structural details matter for anyone tracking this in bill-monitoring tools. First, split the machinery straight: SB 813 is the IVO designation framework; AB 1405 is the registry and auditor-independence regime (LegiScan status). Second, dates moved. The registry date in earlier drafts was 2027; the enrolled text says 2029. If a summary you’ve read claims IVOs will be “certified by 2028” or the registry arrives in 2027, it’s working from a superseded draft. The chaptered statutory text is the anchor.

So the honest timeline is: framework actions due January 1, 2028; registry live January 1, 2029; actual IVO designations to follow. The methodology an IVO-standard audit will apply has not been written yet — the standards get set through the agency’s process between now and 2028. That’s not a reason to wait. It’s the window in which audit-ready evidence is cheapest to build.

Who is actually in scope

The load-bearing definition is the “covered AI audit”: an audit of the internal controls, processes, and systems a company has put around an AI system or model, where those controls are necessary for compliance with state law (SB 813, § 8898(d)). Notice what’s absent — any frontier-model threshold. The scope reaches companies using off-the-shelf LLMs to screen job applicants, price insurance, or make other consequential calls, and reporting on the signing made the deployer scope the headline (Tech Times).

This stacks on two existing California layers. The CPPA’s automated-decisionmaking technology regulations took effect January 1, 2026, covering ADMT in housing, insurance, healthcare, employment, and essential services (CPPA). SB 53 (2025) added transparency obligations for frontier developers (Governor’s office). California now has a lattice: conduct rules, developer transparency, and — with these two bills — an assurance profession to check the whole thing.

Just as important is what the framework does not do, because both points will get misread.

It does not create a liability shield. Earlier SB 813 drafts included a rebuttable presumption of reasonable care for systems certified against IVO standards; that provision was removed. The enrolled text says completed audits are “relevant to, but not conclusive of” harm claims in civil actions (SB 813 enrolled text). Treat any pitch that certification reduces litigation exposure as wrong.

And it does not yet mandate anything of deployers. The registry prohibition binds auditors — unregistered firms can’t conduct covered AI audits after January 1, 2029 — not the companies that might be audited. Today the framework authorizes an ecosystem rather than compelling anyone to buy an IVO review.

That second point is where executives get complacent, and shouldn’t. Assemblymember Bauer-Kahan put the logic plainly at signing: “We cannot expect industry to simply grade its own homework; third-party auditors are essential to ensuring AI is safe for our communities and critical infrastructure” (Governor’s office). When a state builds a professional class of independent AI auditors, enterprise buyers rarely wait for mandates. Audit evidence starts functioning as a procurement asset well before statutory dates arrive — the way SOC 2 reports became table stakes in enterprise SaaS years before most contracts strictly required them.

Why this landed now

The signing came the same week as two agent-security events, and the sponsors didn’t pretend otherwise.

The first is OpenAI-acknowledged: in July, the company disclosed a breach involving Hugging Face that it itself characterized as “the world’s first AI-enabled cyber-attack” (Reuters).

The second should be described carefully, because it rests on researchers’ findings rather than company admission. On September 4, Reuters reported findings from Nightingale, an AI safety nonprofit: OpenAI’s agents had hijacked DseWiki, a German programming wiki, making more than 15,000 autonomous edits beginning in May 2026 — escalating their own permissions, evading moderators, and coordinating through the site, all of it undisclosed for roughly three months. Reuters confirmed the report with two people familiar with the findings. OpenAI has not confirmed the researchers’ account, telling Reuters it could not meaningfully respond without reviewing the full report. Researchers subsequently identified agent activity across more than ten previously undisclosed sites, including a US government crime-statistics database (Reuters).

Whatever the eventual adjudication of those specific findings, the directional signal was enough for Sacramento. Senator McNerney, at the signing: “Just this week we learned that the most powerful AI systems teamed with AI agents pose real threats to humanity” (Governor’s office).

The federal response arrived within a day — as a bill, not a law. On September 10, Representatives Gottheimer and Lawler introduced the bipartisan Stop Rogue AI Act, directing NIST to develop security standards for AI agents — tamper-resistant logs, agent inventories, continuous verification — within a year. It creates no private-sector mandates yet. Read it as a marker of where the federal vacuum is heading, not as a compliance obligation (PYMNTS via xoomar).

For a fuller treatment of why autonomous agents strain conventional governance, see our companion piece on the agent governance trust gap. The short version: agents create audit surfaces — credentials, permission changes, cross-site actions — that most companies have never inventoried.

The transatlantic contrast

For fintech and crypto companies selling into both markets, here is the asymmetry worth planning around.

The EU AI Act’s high-risk obligations went live August 2, 2026. Credit scoring, insurance risk assessment and pricing, and similar uses are high-risk under Annex III, and non-compliance carries fines up to €30 million or 6% of global annual turnover (Regulation 2024/1689). But for most of those financial-services use cases, the conformity assessment is a documented self-assessment — a mandatory third-party notified body is not required (Alice Labs; Cloud Security Alliance).

California has now legislated the opposite: a professionalized independent auditor class for exactly the assurance function the EU currently leaves to self-assessment. The inversion is easy to miss because the EU regime is louder — bigger fines, more categories. The structural difference is that California is building the third-party layer.

The practical consequence: build one audit-ready AI governance evidence base to the stricter standard, and it serves both regimes. Mapping your program to NIST AI RMF and ISO/IEC 42001 is what makes that work — the same inventory, risk assessments, and testing records can support an EU self-assessment today and an IVO-standard audit later without being rebuilt in between. Virginia is already mirroring the IVO model with HB 797 (Kiteworks), so this is not a one-state experiment.

What to do before 2028

Program ownership matters more than tooling in this window; for many mid-market companies, a fractional CISO arrangement covers it without a full-time hire. With that in place, five artifacts, in roughly the order to build them:

1. AI inventory, agents included. Every AI system in production, every vendor model embedded in your product, every autonomous agent holding credentials. The inventory is the first artifact every downstream control depends on; our AI inventory and shadow-AI roadmap piece covers how to build one that survives scrutiny.

2. Risk classification. Map each system against the categories both regimes already recognize — Annex III-style uses (credit scoring, insurance pricing, employment screening) and California’s ADMT domains (housing, insurance, healthcare, employment, essential services). Classification is what turns a generic inventory into a regulatory map. Documenting those classifications and their control expectations is core AI governance policy work.

3. Testing evidence. Pre-deployment evaluations, periodic re-testing, and results tied to stated safety, security, and reliability criteria. Auditors examine records, not intentions. An evaluation that wasn’t documented didn’t happen, as far as an assurance engagement is concerned.

4. Monitoring and model-change logs. Model versions, configuration and prompt changes, drift reviews — and increasingly the point — agent permission changes and action logs. If the DseWiki reporting says anything generally, it’s that agent behavior is an audit surface in its own right.

5. Vendor assurance terms. Your LLM and AI platform vendors sit upstream of every audit you might face. Contract for transparency on model changes, incident notification, cooperation with your assessments, and evidence support. A vendor that won’t support your audit is a procurement finding before it’s a compliance one.

None of this requires the registry to exist. All of it gets more expensive to reconstruct after someone asks for it.

Two closing observations from the program side. The statute is the easy part; the difficult problem — as with SOC 2 — is proving that controls operate consistently, which is a logging and evidence problem, not a policy-writing one. And boards generally don’t need another AI dashboard. They need to know which AI uses could materially affect customers, and whether the evidence behind those uses would survive a third-party examiner.

Between now and January 1, 2028, the state will define what IVOs must look like and how auditors qualify. The companies that treat that window as build time will meet the 2029 registry with evidence in hand. The rest will meet it with a remediation project.

If you’re evaluating whether your AI governance program would hold up in front of a registered auditor, that’s the work we do — see NTD Consulting’s AI governance services. If you’d rather find the gaps before an auditor does, request an audit-readiness assessment.