Governor Gavin Newsom signed two bills establishing a regulatory framework for independent AI auditors. The California Government Operations Agency must define criteria for verification organizations by January 1, 2028. Auditors must maintain operational and managerial independence from the companies they assess, and their compensation cannot be tied to audit findings.
Under the new legislation, California will launch an online AI Auditor Registry by January 1, 2029. After this date, only registered entities may conduct mandatory state-level AI audits. Auditors are required to document audit scope, findings, and any limitations, including instances where vendors withhold necessary system access or model documentation.
The law prohibits auditors from evaluating systems they previously designed or operated. Employees are restricted from auditing areas where they held material responsibility within the past 12 months. Violations of these standards may lead to removal from the registry and referral to the attorney general for enforcement.
A companion law, SB 1119, mandates child-safety risk assessments for companion chatbots starting July 1, 2027. Operators must arrange independent safety audits by January 1, 2029, or upon product launch. These audits must be repeated every two years, with lead auditors certifying results under penalty of perjury.
