Newsom signs SB 813 and AB 1405, creating a state-designated corps of AI verification bodies and a mandatory registry for AI auditors from 2029

What was signed

On September 9, 2026 Governor Gavin Newsom signed two bills from the 2025-2026 session that together build California’s first machinery for outside scrutiny of artificial intelligence systems. Senate Bill 813, by Senator Jerry McNerney, became Chapter 179 of the Statutes of 2026. Assembly Bill 1405, by Assemblymember Rebecca Bauer-Kahan, became Chapter 178. Both were approved and filed with the Secretary of State the same day. The governor’s office described the pair as first-in-the-nation safeguards and, in the same release, called on the federal government to enact national rules.

Neither bill regulates AI systems directly. Each regulates the people and organizations that check them, and each hands the work to the Government Operations Agency rather than to a new regulator or the Attorney General.

SB 813: designated verification bodies

SB 813 adds Chapter 14, sections 8898 to 8898.4, to Division 1 of Title 2 of the Government Code, under the heading California Artificial Intelligence Safety Independent Verification Organizations. An independent verification organization, or IVO, is an entity the agency designates as having demonstrated expertise in assessing the risks posed by an AI system or model and in identifying the metrics and methodologies behind that assessment.

By January 1, 2028 the agency must do three things. It must publish application requirements, including the applicant’s qualifications and the benchmarks, technologies, metrics and methodologies it proposes to use. It must publish designation criteria, and in doing so consider existing standards and frameworks from government agencies, standards-setting organizations, national and international auditing and assurance bodies, AI developers and deployers, and independent experts. And it must adopt procedures for suspending or terminating a designation, which the statute says must cover failure to adhere to standards, material misrepresentation in an application or audit report, conflicts of interest that impair independence, inadequate documentation, conduct that calls integrity or competence into question, and lapses in cybersecurity.

The agency is required to consult broadly and to convene working groups drawn from auditors, IVOs, academic institutions, developers and deployers including startups, consumer, labor and civil-society groups, other agencies and standards bodies. It must report the working groups’ findings to the Legislature. A designated IVO must report annually, no sooner than twelve months after designation, on its standards and methodologies, on changes to its governance or funding that bear on independence, and on changes to its application, with redactions permitted for trade secrets, cybersecurity, public safety and national security, provided the character and justification of each redaction is described.

Section 8898.4 sets the limits, and they are the most consequential part of the bill for anyone advising a developer or a buyer. The chapter creates no liability solely for failing to comply with a standard identified under it. It is not a state recommendation or endorsement of any system. It does not require any person or company to engage an IVO or undergo a covered audit as a condition of developing, deploying or operating AI in California. And in an action alleging that the development, modification or use of an AI system caused harm, the fact that an audit was performed to a standard identified under the chapter is relevant to, but not conclusive of, the action. That last clause is the bill’s answer to the question of what a certification is worth in court: evidence, not a defense.

AB 1405: a registry with teeth from 2029

AB 1405 adds sections 11549.80 to 11549.86 to the Government Code. It requires the same agency, no later than January 1, 2029, to establish an AI Auditor Registry on its website, to allow AI auditors to register, to allow members of the public to report misconduct by a registered auditor, and to set annual registration fees. The agency may adopt regulations to carry the chapter out.

From January 1, 2029 the bill prohibits an unregistered person from offering, selling or conducting a covered AI audit. A covered AI audit is defined as an audit conducted to assess the internal controls, processes or systems implemented for an AI system or model that are necessary for compliance with state law. Each registered auditor receives a unique registration number that must be displayed clearly and conspicuously on all advertising for covered audit services, and the agency publishes the information a registrant provides.

Registered auditors take on conduct rules. An auditor that performs a covered audit must give the auditee a report containing a signed and dated statement that the audit was conducted under the chapter. Auditors must meet standards of independence, objectivity and integrity: among them, not seeking, soliciting, negotiating for or accepting employment with an auditee while participating in its audit, and not conducting a covered audit where a financial, business, employment or other interest or relationship would reasonably be expected to impair independence or objectivity. A registered auditor may not prevent an employee from engaging in specified whistleblower activity or retaliate for it.

The agency may investigate alleged violations. A violation is grounds for removal from the registry and referral to the Attorney General or another enforcement authority. Fees and other money collected go into a new AI Auditors’ Registration Fund in the State Treasury, available on appropriation to administer the scheme.

One carve-out matters for the accounting profession. A registered auditor who is licensed to practice public accountancy, or a firm holding a current permit from the California Board of Accountancy, is exempt from certain of the bill’s reporting and independence requirements if specified conditions are met. If the agency finds that a CPA or accounting firm in good standing has violated the chapter, it must notify the accountant or firm and the Board of Accountancy in writing.

How the two fit, and what they do not do

Read together, SB 813 says who the state trusts to assess AI systems, and AB 1405 says who may be paid to audit them for state-law compliance at all. The designation regime is voluntary on both sides: no developer must use an IVO, and no auditor must become one. The registry is not voluntary for anyone selling a covered audit in California after 2029.

What neither bill does is impose an audit obligation on developers or deployers. That distinction is the one StateScoop drew in its report on the signing, noting that Illinois in July enacted a law requiring annual independent third-party audits of major frontier AI developers. California’s pair builds the supply side of an audit market and leaves the demand side to other laws, to procurement, and to litigants who will now be able to point to a recognized standard when they argue about whether an audited system was reasonably built.

The operative dates are January 1, 2028 for the agency’s IVO framework and January 1, 2029 for the registry and the prohibition on unregistered audits. As non-urgency statutes chaptered in 2026, both take effect on January 1, 2027.