SB 813 and AB 1405 speed up California's AI auditor rules after Newsom's order
SB 813 and AB 1405 create mandatory auditor registration and independent verification frameworks.
California shifted toward mandatory third-party oversight of AI systems after Governor Newsom signed an executive order on September 18 accelerating two laws signed days earlier. Senate Bill 813 and Assembly Bill 1405 create a framework for certifying entities to audit AI systems and establish a public registry for those auditors, compressing deadlines and forcing California AI companies to plan compliance sooner than originally expected. The laws move from self-disclosure under existing rules to mandatory independent verification, replacing self-assessment with third-party auditing to identify risks and hold companies accountable.
The acceleration follows California's September 2025 Transparency in Frontier Artificial Intelligence Act (SB 53), which required developers of powerful AI models to publicly disclose safety frameworks and report critical incidents. SB 813 and AB 1405 now establish who can conduct those assessments and under what standards. The executive order also convened a panel of experts to develop recommendations within two months for embedding independent auditors in AI company labs and requiring an emergency shutoff mechanism for frontier AI models, changes that could reshape regulatory requirements again.
The shift from self-assessment to mandated auditing
California's regulation of AI safety has evolved through two steps. First, SB 53 (September 2025) required developers of "frontier models"—foundation models trained using more than 10^26 computational operations—to publicly disclose their risk management practices and report serious safety incidents to state regulators. The law applies most stringent requirements to "large frontier developers" with over $500 million in annual revenue, who must annually publish governance frameworks documenting how they identify and mitigate catastrophic risks, including foreseeable incidents that could cause death or serious injury to 50 or more people or cause at least $1 billion in damages.
But SB 53 relied on company self-disclosure. SB 813 and AB 1405 now require independent third parties to verify those disclosures. SB 813 creates the framework; AB 1405 creates the registry and enforcement mechanism. Together they establish an infrastructure for external validation rather than allowing companies to audit themselves.
How the accelerated timeline compresses compliance
SB 813 originally set January 1, 2028 as the deadline for the Government Operations Agency to publish requirements and criteria for designating independent verification organizations (IVOs)—entities authorized to assess AI systems for safety and compliance with California law. The executive order directs the agency to accelerate that deadline, though it does not specify a new date.
That deadline requires the agency to publish application requirements for IVO designation, criteria evaluating qualifications including technical expertise and conflict-of-interest management, and procedures for suspending or terminating IVO status. Once the accelerated date is set, companies and auditors will have less time than originally planned to understand the new designation requirements, identify qualified IVOs, and plan audits before the registry opens January 1, 2029.
AB 1405 creates a separate enforcement requirement: an AI Auditor Registry that must open by January 1, 2029. Beginning that date, any person offering or conducting a "covered AI audit" in California must be registered with the agency. Unlike SB 813, which does not require companies to hire an auditor, AB 1405 makes registration mandatory for anyone performing audits. Registered auditors who violate the law's requirements face removal from the registry and referral to enforcement authorities, and practicing as an unregistered auditor after that date is not legally permitted.
What independent verification organizations must assess
SB 813 requires IVOs to demonstrate "sufficient technical expertise" in assessing the risks posed by an AI system or model and to "identify the metrics and methodologies" underlying those assessments. The law does not prescribe specific tests or measures; instead, it allows IVOs to propose their own standards and methodologies for Government Operations Agency approval during the designation process.
Designated IVOs must submit annual reports—at minimum 12 months after initial designation—to the agency and Legislature documenting their standards, methodologies, and governance changes. They must also maintain independence from the companies they assess, avoiding financial, operational, or management dependence on auditees. The agency will evaluate IVO qualifications during designation, considering whether an applicant possesses sufficient technical competence and appropriately identifies and manages conflicts of interest.
Unlike licensing regimes in other fields, SB 813 does not mandate that companies undergo IVO audits to operate in California. The law establishes the infrastructure, but audit participation remains voluntary—for now. However, audit findings may become relevant in litigation involving alleged AI-related harm, creating market incentives for companies to undergo voluntary audits.
The auditor registry and enforcement starting January 1, 2029
AB 1405 requires the Government Operations Agency to establish an AI Auditor Registry by January 1, 2029. Registered auditors must provide business information, contact details, descriptions of services in no more than 500 words, relevant certifications, and standard operating procedures identifying the standards they use and the basis for accuracy claims. The agency assigns each auditor a unique registration number that must appear "clearly and conspicuously" on all advertising materials offering covered AI audit services.
Auditors must conduct assessments according to "widely recognized industry standards appropriate to the system or model being audited" and provide detailed reports including scope, results, identified deficiencies, and limitations. They must retain records for at least ten years and maintain independence by avoiding conflicts of interest, not evaluating their own prior work, and not seeking employment with companies they audit during the assessment period. Auditors who employ staff that worked for a company recently must wait before assigning that person to audit their former employer.
The agency publishes all registered auditor information publicly but includes a prominent disclaimer that registration does not constitute state endorsement. Annual registration fees will cover administrative costs. Beginning January 1, 2029, unregistered persons cannot legally offer or conduct covered AI audits in California. The law defines a covered audit as an assessment of compliance with California law regarding AI systems, though the precise boundaries of what qualifies remain subject to agency interpretation through regulations the agency is authorized to adopt.
“Companies that anticipated January 2028 to finalize compliance plans now face an accelerated deadline, not yet announced, for understanding independent verification requirements, followed by January 2029 registry enforcement.”
The kill switch proposal and enhanced oversight model
The executive order directed a panel of experts to develop recommendations within two months of the September 18 order on how to strengthen California AI safety law. Among proposals under consideration are two significant changes beyond what SB 813 and AB 1405 establish: requiring frontier AI companies to embed designated independent verification organizations directly in their labs to conduct regular audits, and mandating that companies develop an emergency shutoff mechanism for frontier models.
The shutoff capability would be verified on an ongoing basis by the independent verification organization, though the specific technical design remains under development by the expert panel. This represents a more invasive form of oversight than the current framework allows. SB 813 permits companies to decide whether to hire an auditor; the proposal would mandate onsite presence by third-party auditors.
The expert panel convenes "world-leading experts" to provide guidance within two months of the executive order. If the panel recommends legislative changes and the Governor adopts them, California could enact additional requirements, further compressing timelines for companies planning AI deployments. The current framework is already more restrictive than other states and the federal government, which have not yet mandated independent audits or embedded oversight in company labs.
What this means for California AI companies and auditors
Companies that anticipated January 2028 to finalize compliance plans now face an accelerated deadline, not yet announced, for understanding IVO requirements, followed by January 2029 registry enforcement. Frontier AI developers with over $500 million in revenue already comply with SB 53's disclosure requirements; SB 813 and AB 1405 add the requirement to involve independent parties in verifying those disclosures.
Auditors and verification organizations face a compressed timeline to prepare for designation. The agency must publish criteria on an accelerated timeline not yet specified, then evaluate applications, making designation decisions before the registry opens January 1, 2029. Auditors must develop methodologies, assemble technical expertise, establish independence controls, and prepare for registration within just over two years.
The regulatory landscape for California AI remains in flux. If the expert panel recommends onsite auditor requirements and emergency shutoff mandates, companies will need to revise compliance strategies again. Even without executive order follow-through, the convergence of three regulatory regimes—SB 53 disclosure, SB 813 verification, and AB 1405 registration—creates a comprehensive system requiring coordination between developers, auditors, and state regulators by 2029.
Related coverage: How Newsom's new AI executive order could reshape rules for Hollywood; The new California rules for chatbots that talk to children; What California's AI transparency rules require of businesses.
