California Creates Registry and Standards for Independent AI Auditors

Two bills signed by California Gov. Gavin Newsom create formal structures for independent review of AI systems and establish credentials for those conducting such reviews. The legislation seeks to enhance credibility and openness in how outside organizations evaluate AI, particularly as these technologies become more sophisticated and embedded in everyday applications and essential infrastructure.

State Sen. Jerry McNerney, D-Pleasanton, authored Senate Bill 813, which sets up a framework allowing independent verification organizations to assess AI systems and models. Assemblymember Rebecca Bauer-Kahan, D-Orinda, sponsored Assembly Bill 1405, establishing a state registry for AI auditors with requirements around their independence, transparency and integrity, according to Newsom's office.

The two statutes formalize the position of organizations that evaluate AI systems separately from those who build them. By establishing uniform standards, the framework aims to simplify the process of determining whether outside evaluators meet baseline criteria for independence and openness.

AI has the potential to improve our lives, but without effective guardrails, it poses significant risks.

State Sen. Jerry McNerney

Why independent testing matters

The legislation arrives as AI systems grow more sophisticated and become increasingly woven into business operations and public systems. California contends that third-party verification has become essential because problems with these systems can ripple far beyond a single application or tool, potentially disrupting major economic sectors and public services.

Bauer-Kahan emphasized that companies creating AI systems should not be the sole judges of their own safety.

We cannot expect industry to simply grade its own homework.

Assemblymember Rebecca Bauer-Kahan

For technology and procurement professionals, this framework offers an additional tool for conducting due diligence when selecting AI vendors or commissioning independent evaluations. However, registration in the state system would not replace an organization's internal security assessments, privacy evaluations, legal review or post-deployment monitoring.

California's wider AI push

These bills join an expanding collection of California regulations governing AI. Newsom previously signed SB 53, which mandates that developers of frontier AI models reveal their safety protocols, document specific serious incidents and shield employees who raise concerns about major hazards.

California has also passed laws addressing AI-generated content, data protection, AI-enabled scams and network security. In August, Newsom unveiled an AI Cyber Defense Program designed to identify security gaps, reinforce infrastructure and facilitate response to breaches.

The state is also strengthening protections for minors using AI. A package of measures signed by Newsom establishes rules for AI chatbot companions, such as parental oversight features and emergency support systems, as well as limits on habit-forming elements in social platforms targeting users under 16.

The bigger regulatory question

California's regulatory path may reshape how AI creators present safety evidence and how organizations choose independent reviewers. Should outside audits become standard in procurement decisions, the expense and timeline for rolling out AI solutions could increase, particularly for startups and smaller organizations lacking substantial compliance infrastructure.

At the same time, California's approach tackles a concrete challenge: AI is advancing at a pace that outstrips the speed at which conventional regulatory systems can keep pace.

Newsom has advocated for federal-level regulation, contending that AI's dangers demand a nationwide response. While awaiting such action, technology and compliance professionals should monitor announcements regarding the registry's launch date, eligibility for registration and whether the state will make registered auditors a requirement in future procurement standards or compliance frameworks.