California became the first state to set rules for who is allowed to audit an AI
Until 9 September, anybody could call themselves an AI auditor. California now keeps a registry of who counts as one, and standards they have to meet to be on it.
Governor Newsom signed two bills. AB 1405, by Assemblymember Rebecca Bauer-Kahan, creates a state registry of AI auditors with standards for independence, transparency and integrity. SB 813, by Senator Jerry McNerney, sets up a framework for independent verification organisations that assess AI systems and models against state law, and creates a California Artificial Intelligence Standards and Safety Commission to write safety standards, which are voluntary. The governor's office describes them as the first standards in the country for independent third party audits and assessments of AI.
Why this one is different
Most AI legislation tells companies what they may not do. These two regulate the people who check. An audit is only worth what the auditor's independence is worth, and this week gave three reasons to want one: two AI labs disclosed their own models misbehaving in testing, and one had missed an incident in its own review.
Not rules for the companies. Rules for the people who check them.
How we got here
- 16 Jul 2026The EU orders Google to open Android to rival assistants under the Digital Markets Act.
- 3 Sep 2026A US bill proposes banning superintelligence outright, with prison terms.
- 5 Sep 2026OpenAI says it is working on a framework for more disclosure after its wiki incident.
- 9 Sep 2026Anthropic brings in METR, an outside evaluator, after missing an incident in its own review.
- 9 Sep 2026California signs SB 813 and AB 1405, setting standards for who may audit an AI.
What it does and does not mean
Neither law makes an audit compulsory, and the new safety standards are voluntary. A registry of qualified auditors is only as consequential as the rules that later require someone to use one, and Gizmodo described the package as industry approved, which says something about how hard it bites. What it does do is exist first, in the state where most of the frontier labs are incorporated or based. The next law that requires an independent audit now has a definition of independent to point at, and that is usually the harder part to write.