Internet Lawyer Blog
California’s new AI audit laws will influence how technology businesses select auditors, document system performance, and explain compliance to customers. Senate Bill 813 and Assembly Bill 1405, signed on September 9, 2026, establish different parts of an oversight framework. Businesses should understand what each law does before purchasing an audit or promising that a product has received government approval.
For a company developing or deploying artificial intelligence, the immediate task is to identify the legal requirements governing its particular activities. These two laws do not, by themselves, require every business using AI to obtain an annual independent audit. They address the organizations and professionals performing specified assessments, with implementation dates that require careful attention.
What SB 813 Establishes
SB 813 adds Government Code section 8898 and related provisions concerning Independent Verification Organizations (IVOs). An IVO is an AI auditor designated by the Government Operations Agency based on demonstrated expertise in assessing AI risks and identifying the methods supporting those assessments. The statute directs the agency to develop application requirements, designation criteria, and procedures for suspending or terminating designations on or before January 1, 2028.
That designation concerns an evaluator’s qualifications and independence. A technology business considering an engagement should ask what the evaluator is qualified to examine and how its proposed tests relate to the company’s system. Experience evaluating one category of model may provide limited insight into a different deployment, dataset, or operating environment.
How AB 1405 Regulates AI Auditors
AB 1405 adds Government Code section 11549.80 and related provisions. It establishes a registration framework for AI auditors and requirements addressing audit practices and reporting. The agency must establish the registry no later than January 1, 2029. Beginning that date, a person generally may not offer, sell, or conduct a covered AI audit without registration.
A covered audit examines controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law. Registration does not constitute state endorsement. The law also addresses reports describing an audit’s scope, results, deficiencies, and limitations. Businesses should distinguish an auditor’s registration from the separate IVO designation process and from the conclusions reached about an individual product.
Keep Statutory Dates Separate From Implementation Announcements
Executive Order N-9-26, issued September 18, 2026, accelerates the agency’s work. It directs completion of the IVO application requirements, procedures, and criteria by May 1, 2027. It also directs the agency to establish the auditor registry and begin specified registry administration by December 1, 2027. Those earlier agency deadlines should appear in the company’s monitoring calendar alongside the statutory dates.
The order separately calls for recommendations on additional oversight measures by November 16, 2026. It does not expressly advance section 11549.82.5’s January 1, 2029 prohibition on offering or conducting covered audits without registration. Businesses should monitor subsequent action and distinguish recommendations for new private-sector obligations from requirements already enacted.
Create a compliance calendar that records the source of each deadline, the affected activity, and the person responsible for monitoring changes. An agency implementation deadline, an auditor registration deadline, and a customer’s contractual delivery date can all concern the same project while requiring different actions. Treating them as interchangeable can cause unnecessary spending or missed obligations.
Identify Why an Audit Is Being Requested
Before seeking proposals, write down the reason for the audit. A customer may want evidence supporting a procurement decision. An investor may be evaluating operational risk. Counsel may identify a specific statutory assessment requirement. Each purpose calls for a different scope, audience, and set of deliverables. A broad request to certify that an AI product is compliant leaves important questions unanswered.
Consider a hypothetical software company whose enterprise customer requests an independent review of an automated recommendation feature. The company should identify the version being reviewed, the customer’s intended use, and the particular risks the report must address. If the customer later deploys that feature in a different decision process, the original review may not answer the new questions.
Prepare Evidence Before the Engagement Begins
A useful preparation file describes what the system does, who uses it, what information it processes, and where its output influences business decisions. Include responsible personnel and the vendors supplying important components. Record which features the company controls and which depend on an outside provider. These details help an auditor distinguish an observable weakness from a question that requires vendor assistance.
Preserve relevant testing records and explain their limitations. If a test used synthetic data, a restricted language sample, or a laboratory configuration, say so. Keep a record of material system changes after testing. A favorable result attached to an obsolete version can create a misleading impression when sales personnel present it to a prospective customer.
Evaluate the Auditor and the Proposed Method
Ask the proposed auditor to identify the personnel who will perform the work, their relevant experience, and any subcontractors. Request an explanation of the testing method in language the company’s technical and legal teams can evaluate. The proposal should identify what will be examined, what evidence will be needed, and what conclusions the available evidence can reasonably support.
Review financial and professional relationships that could affect independence. Prior consulting work, referral arrangements, and compensation tied to a favorable result deserve attention. These are practical diligence questions; their significance depends on the applicable legal standards and engagement. A credential or registration number should supplement the company’s evaluation of the proposed work rather than end it.
Negotiate Audit Contracts With Usable Deliverables
The engagement agreement should define the system version, review period, legal criteria, and expected report. Address how the auditor will document exclusions and disagreements. Set a process for correcting factual mistakes without allowing commercial pressure to suppress unfavorable findings. Clarify who may rely on the report and whether the company may share it with customers, regulators, investors, or insurers.
Access provisions matter when the company relies on third-party models. Determine whether existing vendor contracts permit inspection, testing, and disclosure of relevant information. If access is unavailable, the final report should explain the resulting limitation. An agreement to deliver a comprehensive assessment is difficult to perform when neither party can obtain the evidence needed to support it.
Protect Information and Address Findings
An audit may expose confidential business information, personal information, and security weaknesses. Establish secure transfer methods, access restrictions, retention terms, and incident notification duties. Consider whether less sensitive evidence can answer a testing question. Counsel should evaluate privilege separately; engaging an auditor through a lawyer does not automatically make every report or underlying fact privileged.
Assign an owner and target date to each accepted finding. Record corrective action and the evidence showing whether it worked. Where a business accepts a remaining risk, document who made that decision and on what basis. Under Government Code section 8898.4, an audit performed under an identified standard is relevant but not conclusive in an action alleging AI-related harm. A favorable report is not immunity from liability.
Legal Guidance for AI Audit Preparation
Our law firm advises technology businesses on artificial intelligence, regulatory compliance, and commercial contracts. We can evaluate which obligations apply to your operations, review proposed audit engagements, and help organize a practical response to identified risks. Contact our law firm to schedule a free initial consultation about California AI audit laws and your business’s preparation needs.