On September 9, 2026, Governor Gavin Newsom signed Senate Bill 813 and Assembly Bill 1405, completing a pair of bills that together build California’s first professional layer for independent assessment of AI systems. SB 813, authored by Senator Jerry McNerney, was approved by the Governor and filed with the Secretary of State the same day, becoming Chapter 179. AB 1405, authored by Assemblymember Rebecca Bauer-Kahan, had passed the legislature on August 30 and now moves from bill to statute.
SB 813 directs the Government Operations Agency to build, by January 1, 2028, application criteria and standards for Independent Verification Organizations (IVOs) - outside entities with the technical expertise to assess the risks an AI system or model poses. IVOs must employ technically qualified personnel, manage conflicts of interest, and remain independent from the parties they assess; they may accept market-rate payment from an audited company but not compensation conditioned on the outcome of their assessment. The agency must convene working groups of AI engineers and safety experts to shape the standards, and designated IVOs file annual reports on their governance and funding. Critically, the law does not require any developer or operator to use an IVO as a condition of doing business in California - it is a voluntary, state-recognized credentialing system, not a mandate.
AB 1405 complements this with a state AI Auditor Registry, also under the Government Operations Agency and also due by January 1, 2029, that requires registered auditors to disclose business and certification information, follow recognized audit protocols, retain records for at least ten years, and display their registration number in advertising. Violations can trigger removal from the registry and referral to the Attorney General.
The two laws matter less for what they mandate today than for what they make possible starting in 2028 and 2029: a defined, state-sanctioned population of people and firms qualified to audit AI systems, at the exact moment a growing stack of California, Illinois, Colorado, and EU statutes increasingly leans on third-party assessment to prove compliance. California is first to define who gets to hold the pen, which puts it ahead of Washington on a piece of infrastructure the whole state-AI-regulation project depends on but until now left undefined.