Analysis
California Governor Gavin Newsom signed two bills September 9 establishing the first framework in the United States requiring independent third-party audits and assessments of AI systems, Gizmodo reported. Senate Bill 813, authored by state Sen. Jerry McNerney, creates a framework for independent verification organizations to assess AI systems and models for compliance with state law; Assembly Bill 1405, authored by Assemblymember Rebecca Bauer-Kahan, establishes a state registry for AI auditors and sets standards for their independence, transparency and integrity, TechTimes reported.
What the law actually requires
AB 1405 directs the California Government Operations Agency to stand up an AI Auditor Registry by January 1, 2029, and bars unregistered persons from conducting covered AI audits from that date forward -- a multi-year runway that gives the state time to define audit standards and gives frontier labs time to build internal processes around whatever those standards turn out to require, rather than an immediate compliance deadline that would have forced labs to scramble.
Notably, both Anthropic and OpenAI signaled support before Newsom's signature: Anthropic formally endorsed the bills, and OpenAI announced its own support in the hours before the signing ceremony. That's a meaningfully different posture than the same two companies, and the broader industry, took toward California's more sweeping SB 1047 frontier-model safety bill in 2024, which drew heavy industry lobbying against it before Newsom ultimately vetoed that earlier version. An audit-and-registry framework -- which creates a market for third-party verification rather than imposing direct liability or a kill-switch requirement on labs themselves -- is a structurally easier bill for frontier labs to support, since it professionalizes compliance rather than constraining product decisions directly.
Why California, and why now
California moving first on AI-auditor standards continues a 2026 pattern of state governments filling a federal regulatory vacuum: with no comprehensive federal AI statute enacted, the most active area of state legislation this year has concentrated on narrower, more specific interventions -- AI chatbot safety rules in several states, data-center clean-power mandates in Massachusetts, New York and Oklahoma, and now an independent-audit framework in California -- rather than a single sweeping frontier-model law like the vetoed SB 1047 attempted.
The practical effect for AI labs and enterprises operating in California won't be felt immediately: the registry doesn't have to exist until 2029, and the standards an eventual registered auditor will actually check against haven't been written yet. That gap is itself a limitation worth flagging -- a framework that creates a registry and independence standards without yet specifying what a compliant audit actually verifies leaves significant regulatory uncertainty for any company trying to build compliance processes today, ahead of rules that don't yet exist in final form.
