California creates the first state-registered AI-auditor industry
Two new laws, signed the same day, set up a formal framework for third-party organizations to verify AI systems' compliance with state law and a state registry of who's qualified to do it.
Governor Newsom signed SB 813 (Sen. Jerry McNerney) and AB 1405 (Asm. Rebecca Bauer-Kahan) on September 9, 2026. SB 813 establishes the first framework in the country for independent third-party organizations to formally verify that an AI system complies with state law; AB 1405 creates a state registry of AI auditors, with standards for independence, transparency, and integrity that a registrant has to meet to be listed.
The mechanism this actually builds
Disclosure mandates -- tell users when they're talking to a bot, publish a model card -- have been the dominant regulatory shape so far. This is different: it's licensing infrastructure for a verification profession that doesn't fully exist yet at scale. Asm. Bauer-Kahan put the reasoning directly: auditors are "essential to ensuring AI is safe for our communities and critical infrastructure." A registry only matters once buyers start asking vendors for a registered auditor's sign-off, and once enough auditors exist to actually staff that demand -- neither of which happens the day a bill is signed.
Why this matters before it's actually used
For any company currently doing AI vendor risk assessment in-house, ad hoc, this is the first sign of where that work eventually gets outsourced to a formal, state-recognized standard -- the way SOC 2 auditors became the default answer to "prove your security posture" for enterprise software. It's early: the registry has to actually fill with qualified auditors, and buyers have to start requiring their sign-off, before this changes anyone's procurement process. But it's the first state-level scaffolding for that market existing at all.