Blogs

California raises the bar for AI accountability & independent audits

9/21/26

By: Jacob Berlinger and Josette Brooksbank

On September 9, 2026, California Governor Gavin Newsom signed two bills establishing a first-in-the-nation framework for independent assessments of artificial intelligence (“AI”) systems and models. Senate Bill 813 (“SB 813”) creates a framework for state-designated independent verification organizations, while Assembly Bill 1405 (“AB 1405”) establishes a state registry and professional standards for AI auditors. Together, these laws represent California’s latest effort to promote transparency and accountability as AI becomes increasingly integrated into business operations and consequential decision-making.

SB 813: Independent verification of AI systems

SB 813 requires the California Government Operations Agency (“Agency”), by January 1, 2028, to establish requirements and criteria for designating qualified AI auditors as “independent verification organizations,” or “IVOs.” To qualify, an organization must demonstrate expertise in assessing risks posed by AI systems or models and identify the metrics and methodologies underlying those assessments.

The Agency must consider whether prospective IVOs possess sufficient technical expertise, appropriately identify and manage conflicts of interest, and maintain independence from the entities they assess. Although an IVO may receive reasonable market-rate compensation from the entity being assessed, payment cannot be conditioned on the outcome of the assessment. IVOs must also remain free from the assessed party’s control in reaching conclusions and recommendations.

The law further requires designated IVOs to report annually to the Agency and Legislature regarding their standards and methodologies, as well as changes to governance policies, funding sources, and other information relevant to independence or conflicts of interest. Certain information may be redacted to protect trade secrets, cybersecurity, public safety, national security, or to comply with other state or federal law.

Importantly, SB 813 does not require businesses that develop, deploy, or operate AI systems to engage an IVO or undergo an AI audit merely as a condition of operating in California. Nor does failure to comply with a standard developed under the law, standing alone create liability. However, where litigation alleges that the development, modification, or use of an AI system caused harm, an audit conducted in accordance with a standard identified under SB 813 may be relevant, although not conclusive, to the action.

Governor Newsom stated that “artificial intelligence holds extraordinary promise, but it must be developed and deployed with meaningful safeguards to protect the public. California has taken nation-leading action to advance AI safety, transparency, accountability, and responsible innovation, but the scale and potential consequences of this technology demand sustained action from every level of government.”

AB 1405: California’s AI auditor registry

AB 1405 complements SB 813 by regulating those who perform certain AI audits. By January 1, 2029, the Agency must establish a publicly accessible AI Auditor Registry. Beginning that same date, a person may not offer, sell, or conduct a “covered AI audit” without registering with the Agency. A covered AI audit is specifically defined as an audit assessing internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law.

Registered auditors will be required to disclose information regarding their qualifications and practices, including the California laws and regulations under which they conduct covered audits, relevant certifications or accreditations, and their standard operating procedures. Auditors must conduct covered audits in accordance with widely recognized industry standards, where appropriate standards are available, and provide auditees with reports describing the audit’s scope, results, identified deficiencies, recommended measures where appropriate, limitations, and supporting documentation.

AB 1405 also imposes independence and conflict-of-interest requirements designed to separate auditors from the companies and systems they evaluate. Among other restrictions, an auditor generally may not audit its own work, conduct an audit where a financial or business relationship could reasonably impair its independence, or assign an individual to an audit if that individual held certain responsibilities with the auditee during the preceding 12 months. Auditors must also retain information provided to the auditee and documentation necessary to demonstrate the basis for the audit results for at least ten years.

The Agency may investigate alleged violations, and noncompliance may result in removal from the registry and referral to the California Attorney General or another appropriate enforcement authority. AB 1405 also protects employees of registered auditors from retaliation for certain disclosures concerning suspected noncompliance.

What businesses should know

SB 813 and AB 1405 do not impose a universal AI-audit requirement. Instead, they establish a framework for independent verification where California law requires or otherwise gives significance to an assessment of an AI system’s compliance. As California continues to expand its regulation of AI, these laws create a more formalized and structured system for determining who may conduct covered audits, the standards governing those auditors, and the degree of independence required from the auditing process.

Businesses developing or deploying AI should therefore continue evaluating whether their systems are subject to California laws requiring assessments or other compliance controls and should carefully consider the independence and qualifications of third parties retained to conduct those evaluations. Companies should also maintain comprehensive documentation concerning AI governance, internal controls, risk assessments, and remediation efforts that may become relevant in a future audit. Particularly given SB 813’s express recognition that a qualifying audit may be relevant in litigation involving alleged AI-related harm, businesses should view independent assessments as an integral component of a broader AI governance and risk-management strategy rather than merely  a regulatory exercise.

For more information, please contact Jacob Berlinger at jacob.berlinger@fmglaw.com and Josette Brooksbank at josette.brooksbank@fmglaw.com or your local FMG Law attorney.

Information conveyed herein should not be construed as legal advice or represent any specific or binding policy or procedure of any organization. Information provided is for educational purposes only. These materials are written in a general format and not intended to be advice applicable to any specific circumstance. Legal opinions may vary when based on subtle factual distinctions. All rights reserved. No part of this presentation may be reproduced, published or posted without the written permission of Freeman Mathis & Gary, LLP.