California's AI Auditor Registry: What SB 813 and AB 1405 Require

Vendors have been claiming “independently audited AI” for a couple of years now, and until this month nothing stopped anyone from calling any review an audit. No license, no standard, no registry. If a vendor told you their model had been independently assessed, the honest follow-up question was: assessed by whom, against what, and how would you check?

California just started building an answer. On September 9, 2026, Governor Gavin Newsom signed SB 813 and AB 1405, two bills that together make California the first state to formally register the people and organizations who audit AI systems for a living.

Neither bill tells you to hire an auditor. That distinction matters more than most of the early coverage suggested.

California Is Building An Accreditation System, Not A Mandate

SB 813 and AB 1405 do different jobs and land on different timelines, but they share the same target: the credibility of the person doing the assessing, not the AI system being assessed.

SB 813 creates a category called independent verification organizations, or IVOs, and tasks a state agency with deciding who qualifies to be one. AB 1405 goes further and restricts the word “audit” itself, at least when it comes to AI. Read together, they are the scaffolding for a licensed profession that does not fully exist yet.

Both are administered by the same body: California’s Government Operations Agency, GovOps for short.

SB 813 Sets Up Verification Organizations By 2028

SB 813 requires GovOps to establish, by January 1, 2028, a process to select and regulate independent verification organizations with demonstrated expertise in assessing the risks posed by AI systems or models.

What it does not do is require any developer or deployer to actually use one. There is no clause in SB 813 saying a company must submit its model to an IVO before selling it in California. The law builds the qualification pipeline for auditors; it leaves the decision to hire one, for now, to the market and to whatever sector-specific rules come later.

AB 1405 Locks The Word “Audit” Behind A Registry From 2029

AB 1405 is the sharper of the two. It requires GovOps to stand up an AI Auditor Registry by January 1, 2029. From that date, a person may not offer, sell, or conduct a “covered AI audit” without being on that registry.

Registration is not a rubber stamp. Registered auditors have to state which California laws they are auditing an AI system under, describe the standards they use to do it, disclose their own qualifications, and follow independence rules meant to stop an auditor from grading its own client’s homework. That last piece is the part worth watching: a registry with real independence requirements is a different thing from a badge you can buy.

This Builds Directly On SB 53

Neither bill appeared out of nowhere. California passed SB 53 in 2025, the state’s first frontier-AI transparency and safety law, requiring large AI developers to publish safety frameworks and report critical incidents. SB 813 and AB 1405 are the next layer on top of that: SB 53 told big AI developers what to disclose, and the 2026 bills start building the profession that will eventually verify whether those disclosures hold up.

You can trace the same regulatory instinct at the federal enforcement level in how the EU AI Office’s investigation and fining powers actually work, which is the closest international parallel: give a regulator the ability to look inside a system, not just at the paperwork around it.

What This Means If You Buy Or Sell AI Right Now

For most companies reading this, nothing changes today. Neither law creates a new obligation for the ordinary business using an AI writing tool, a chatbot, or a vendor’s model. SB 813’s process does not exist until 2028. AB 1405’s registry does not exist until 2029.

What is worth doing now is watching the vocabulary. Once the AB 1405 registry is live, “independently audited” will stop being a marketing phrase and start being a checkable claim, the same way “certified” means something specific in other regulated industries. If a vendor tells you in 2029 or later that their AI was independently audited, you will be able to ask which registered auditor did it and which California law they audited it under. Save that question; it will be worth more in three years than it is today.

If you are the one explaining this to a client or a manager, precision matters more than reassurance. A vague “California now audits AI” invites the wrong follow-up questions.

A Wrivio Context for compliance updates could say:

Rewrite this as a precise, factual explanation of a new regulation for a business audience. Keep every bill number, date, and agency name exactly as written. Do not claim the law is currently in effect if it only sets a future deadline, and do not imply an audit requirement exists where the source only creates a registry.

Press Ctrl+Shift+Space, paste your draft, and check the diff before sending. Watch for the rewrite quietly turning “must register by 2029” into “must be audited now,” which is the single most common way this kind of news gets garbled in a client email.

If you already document how your team evaluates AI tools, the same discipline applies internally: see how to audit an AI vendor in 2026 for a checklist you can run today, independent of what California eventually requires. And if your compliance answers show up in client contracts, what AI clauses in client contracts actually mean is worth reading before you promise anything tied to a future registry.

Common Questions

Does SB 813 require companies to hire an independent AI auditor?

No. SB 813 only requires California’s Government Operations Agency to build, by January 1, 2028, a process for qualifying independent verification organizations; it does not obligate any developer or deployer to use one.

When can someone actually be stopped from calling their work an “AI audit” in California?

Starting January 1, 2029, when the AB 1405 AI Auditor Registry takes effect, a person may not offer, sell, or conduct a covered AI audit without being registered.

How does this relate to SB 53?

SB 53, passed in 2025, was California’s first frontier-AI transparency and safety law, requiring large developers to publish safety frameworks and report incidents; SB 813 and AB 1405 build the auditor profession that can eventually verify those disclosures.

Is there anything a business should do about this today?

Mostly watch the vocabulary and keep a dated record of your own AI vendor decisions, since neither law creates an active obligation before 2028 and 2029 respectively.

Where can I read the original announcement?

The Governor’s official announcement of SB 813 and AB 1405 is the primary source for both bills’ requirements and dates.

Download Wrivio for Windows to draft client and team updates about regulatory changes like this one, with your confidential notes staying on your own machine in Local mode.