California creates formal infrastructure for AI auditors and Independent Verification Organizations.
A major step toward professionalized, evidence-based AI assurance.
Last updated: September 29, 2026 · AI Govern Consulting LLC
California has enacted two laws that begin transforming independent AI assurance from an emerging practice into a state-defined professional and institutional framework.
On September 9, 2026, Governor Gavin Newsom signed:
- Senate Bill 813, Chapter 179, establishing a framework for state-designated Independent Verification Organizations, or IVOs; and
- Assembly Bill 1405, Chapter 178, requiring California to establish an AI Auditor Registry and setting standards for covered AI audits, auditor independence, competence, reporting, evidence retention, and professional integrity.
For organizations developing or using AI, the message is clear: credible assurance will increasingly depend on demonstrable competence, reproducible methods, sufficient evidence, genuine independence, and transparent limitations — not a generic claim that an AI system has been “reviewed.”
For AI auditors and assurance providers, the laws establish an important future qualification pathway. They do not confer registration, IVO designation, state approval, accreditation, or endorsement on any current provider.
At a glance
| Development | Legal status | Key date | Practical significance |
|---|---|---|---|
| California SB 813 | Enacted lawImplementation framework under development | Government Operations Agency action required on or before January 1, 2028 | Creates application requirements and qualification criteria for state-designated IVOs |
| California AB 1405 | Enacted lawRegistry becomes operational later | AI Auditor Registry required no later than January 1, 2029 | Establishes covered-audit registration, reporting, independence, competence, advertising, and evidence-retention requirements |
| California SB 947 | Proposed — not bindingNot binding as of this update | Presented to the Governor September 9, 2026 | Would strengthen human review for certain AI-assisted employment discipline and termination decisions |
What California SB 813 establishes
SB 813 directs the California Government Operations Agency to develop the state's IVO framework on or before January 1, 2028.
Under the statute, an IVO is an AI auditor designated by the Agency after demonstrating expertise in assessing risks posed by an AI system or model and identifying the metrics and methodologies supporting that assessment.
The future application process must address:
- the applicant's qualifications and competence;
- the benchmarks, technologies, metrics, and methodologies the applicant proposes to use;
- documentation supporting the accuracy of application information;
- procedures for suspension or termination of designation; and
- qualification criteria aligned, where practicable, with recognized professional, regulatory, audit, and assurance frameworks.
The Agency must consider whether an applicant can assess AI risk, employ sufficient technical expertise, identify and manage conflicts of interest, and remain independent from the organization being assessed.
Independence is operational — not ceremonial
An IVO may receive reasonable market-rate compensation from an assessed organization. However, payment cannot be conditioned on the outcome of the assessment. The IVO must remain free from operational or management dependence and from the assessed party's control over conclusions or recommendations.
California may suspend or terminate designation for matters including:
- failure to follow appropriate standards;
- material misrepresentations;
- conflicts that impair independence;
- inadequate documentation;
- conduct calling integrity, objectivity, or competence into question; and
- cybersecurity lapses.
Designated IVOs will also have continuing reporting responsibilities — including annual reporting — concerning standards, methodologies, governance policies, funding sources relevant to independence, conflicts of interest, and material changes to application information. Applicants must demonstrate competence, benchmarks and methodologies, conflict management, and operational, management, and financial independence. Permitted unredacted material must be retained for five years.
What SB 813 does not do
SB 813 does not require every AI developer, deployer, or operator to hire an IVO or undergo a covered AI audit as a condition of operating in California. It builds the qualification and oversight infrastructure through which IVOs may operate.
An audit performed under an identified standard may be relevant in a legal action involving alleged AI harm, but it is not conclusive proof against liability. An audit is evidence — not immunity.
What California AB 1405 requires
AB 1405 directs the Government Operations Agency to establish an online AI Auditor Registry no later than January 1, 2029.
Beginning January 1, 2029, a person may not offer, sell, or conduct a covered AI audit without being registered. The statute defines a covered AI audit as an audit of internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with California law.
Registration and public transparency
Registered AI auditors will be required to disclose information including:
- the California laws or regulations under which they conduct covered audits;
- relevant certifications or accreditations they actually hold;
- a description of their organization and services;
- standards used in their audit procedures; and
- the basis for claims about the accuracy, reliability, or validity of their protocols.
The state will assign a registration number, and that number must be displayed clearly and conspicuously in advertising for covered AI-audit services.
California must also state prominently that registration does not constitute recommendation or endorsement by the State of California.
Required audit reporting
A covered-audit report must address matters including:
- audit scope and objectives;
- results and the documentation supporting them;
- identified deficiencies and, where appropriate, technical, operational, or governance measures that could address them;
- whether the auditee implemented and followed internal safety standards and protocols within scope;
- limitations of the audit;
- matters within scope that were not assessed; and
- material gaps in evidence, information, systems, or access.
The report must also include a signed and dated statement indicating that the audit was conducted in accordance with the statute.
Ten-year evidence retention
Registered auditors must retain information supplied to the auditee and documentation supporting the audit results for at least 10 years.
That requirement makes evidence management a core assurance capability. It affects workpaper design, access control, data protection, version integrity, legal holds, retention schedules, vendor systems, and the ability to reconstruct how a conclusion was reached years after an engagement.
Independence, competence, and integrity
AB 1405 establishes detailed professional safeguards. Among other things, a registered AI auditor must:
- avoid financial, business, employment, or other relationships reasonably expected to impair independence or objectivity;
- avoid auditing systems, controls, processes, assessments, or other subject matter the auditor materially designed, developed, implemented, or operated;
- prevent audit personnel from negotiating for or accepting employment with the auditee while participating in the audit;
- avoid assigning an individual who held material responsibility for the subject matter at the auditee during the preceding 12 months;
- exercise independent, objective, and impartial professional judgment; and
- ensure the assigned team collectively possesses the knowledge, skills, abilities, and specialized expertise necessary for the engagement.
Violations can support removal from the registry and referral to the Attorney General or another enforcement authority.
Why this matters to executives and AI program owners
The California framework changes the readiness question.
Organizations should no longer ask only, “Do we have an AI policy?” They should ask whether a qualified, independent third party could reach a supportable conclusion using the evidence the organization can produce.
That means preparing across five dimensions:
1. Auditable governance
AI roles, decision rights, risk acceptance, escalation, change approval, incident response, and board or executive oversight should be documented and operating in practice.
2. Evidence integrity
Organizations need controlled records showing system purpose, ownership, data provenance, validation, limitations, subgroup performance, human review, incidents, changes, vendor representations, and corrective action.
3. Defensible human oversight
A person's presence in the workflow is not enough. Reviewers need appropriate authority, competence, time, information, and freedom to challenge or override an automated output.
4. Assurance-ready access
Contracts, system architecture, vendor relationships, confidentiality controls, and technical environments should permit an auditor to obtain sufficient appropriate evidence without compromising privacy, security, intellectual property, or legal privilege.
5. Independence by design
Organizations should separate governance advisory work, control implementation, management decisions, internal monitoring, and independent external assurance. Independence problems are difficult to repair after the same provider has designed or operated the controls it is later asked to audit.
Connecting AI controls to defensible human judgment
California's new framework appropriately emphasizes methods, evidence, competence, and independence. Those elements are essential — but AI assurance must also address the human decision system surrounding the technology.
Governance Beta™ is AI Govern Consulting's proprietary decision-intelligence and governance framework, derived from Dr. Damon Dade's doctoral research. It focuses on the conditions that make an AI-supported decision defensible:
- Which stakeholders are affected, and which values are at risk?
- What decision is the AI informing or influencing?
- Who has authority to approve, challenge, modify, override, escalate, or stop the decision?
- What evidence supports the human judgment?
- How are fairness, transparency, accountability, and trust addressed?
- What limitations and residual risks were understood and accepted?
- Can the organization reconstruct the decision and demonstrate that controls operated?
The essential service boundary
AI Govern Consulting's current role is to support:
- AI governance and control design;
- readiness and gap assessments;
- Governance Beta™ decision-assurance reviews;
- evidence architecture and documentation;
- testing and evaluation readiness;
- staff and reviewer training;
- remediation planning;
- independence and conflict-management design; and
- preparation for future external audit, registration, or IVO qualification.
Where AI Govern Consulting materially designs or implements a client's controls, it should not later represent itself as independent for a covered audit of that same work. A credible assurance practice protects independence before an engagement is sold — not only when the report is issued.
IVO and AI-auditor readiness roadmap
For organizations that may seek California registration or designation, the preparation window should be used deliberately.
Governance foundation
- Establish legal-entity ownership, leadership accountability, and quality-management responsibilities.
- Define permitted services and independence boundaries.
- Adopt conflict-identification, acceptance, monitoring, and remediation procedures.
- Establish information-security, confidentiality, records, complaint, and whistleblower safeguards.
Competence architecture
- Define engagement roles and required technical, domain, governance, legal, audit, and human-factors competence.
- Maintain verifiable qualification and continuing-development records.
- Establish specialist-use, supervision, consultation, and quality-review procedures.
- Build a staffing model capable of supporting conclusions without dependence on the auditee.
Methodology and evidence
- Map proprietary methods to relevant laws, NIST resources, ISO standards, and recognized audit and assurance concepts.
- Define engagement acceptance, criteria selection, materiality, sampling, testing, evidence sufficiency, findings, and reporting.
- Validate claims about the accuracy, reliability, and validity of assessment protocols.
- Create protected and public-facing versions of methodology documentation where trade-secret redaction may be appropriate.
Operating proof
- Pilot procedures in readiness engagements while accurately distinguishing them from regulated independent audits.
- Test workpaper integrity, review, retention, security, and reproducibility.
- Conduct internal inspections and remediate quality findings.
- Document how conclusions remain free from client control and outcome-dependent compensation.
Application readiness
- Assemble competence evidence, governance records, methods, metrics, conflict safeguards, cybersecurity controls, and supporting documentation.
- Monitor California's working groups, published criteria, implementing procedures, registration requirements, and future regulations.
- Obtain legal review of service descriptions and marketing claims before using regulated titles or offering covered audits.
Executive order accelerates independent oversight work
On September 18, 2026, Governor Newsom issued an executive order to accelerate independent oversight and advance work toward an AI “kill switch.” On September 23, 2026, he announced the expert group that will carry out that work.
The concepts under study include embedded IVOs, independent verification of developers' safety frameworks and risk assessments, and an independently verified, human-operated kill switch. These remain study and recommendation concepts. They are not current private-sector duties, and they do not change SB 813's January 1, 2028 or AB 1405's January 1, 2029 statutory dates.
Enacted status, for clarity: SB 813 and AB 1405 are binding law, but their obligations apply on future dates. Neither currently requires every AI operator to undergo an audit.
SB 947 and meaningful human review in employment
California SB 947 was presented to the Governor on September 9, 2026. If enacted in its presented form, it would limit employer reliance on automated decision systems for certain disciplinary and termination decisions beginning July 1, 2027.
The proposal would distinguish meaningful review from nominal human involvement. When an employer primarily relies on automated output, a human would need to corroborate the decision using supporting information. An output that cannot be corroborated — or is inaccurate, incomplete, or misleading — could not support the covered decision. The employee would receive notice of the automated system's role and the human review.
This proposal closely aligns with Governance Beta™'s central principle: a human-in-the-loop safeguard is credible only when the human exercises informed, documented, and independent judgment capable of changing the outcome.
Because SB 947 has not been enacted as of this update, organizations should treat it as a planning signal, not a current statutory obligation.
What clients can do now
- 1Inventory AI systems, models, and automated tools affecting consequential decisions.
- 2Identify applicable California requirements and potential covered-audit subject matter.
- 3Build an evidence index for policies, controls, data, testing, human review, incidents, vendors, and changes.
- 4Test whether decision-makers can challenge and override AI outputs in practice.
- 5Separate advisory, implementation, management, internal-review, and independent-assurance roles.
- 6Assess auditor and reviewer competence against the actual technology, decision domain, and legal criteria.
- 7Review contracts for access, confidentiality, audit rights, evidence retention, incident cooperation, and independence threats.
- 8Begin an IVO or AI-auditor readiness roadmap well before California's 2028 and 2029 implementation milestones.
How AI Govern Consulting can help
AI Assurance Readiness Assessment
A structured review of governance, evidence, testing, documentation, human oversight, audit access, competence, independence, and remediation priorities.
Governance Beta™ Decision-Assurance Review
A focused review of a consequential AI-supported decision process, including stakeholder values, human authority, challenge and override, transparency, accountability, evidence, and defensibility.
IVO and AI-Auditor Qualification Roadmap
A development plan for methodology, competence, quality management, evidence standards, independence, conflict controls, cybersecurity, records retention, and future application readiness.
Evidence Architecture and Audit Preparation
Support for organizing system records, control evidence, technical validation, decision documentation, workpapers, limitations, gaps, remediation, and auditor access.
Human-in-the-Loop Assurance Training
Role-based training for executives, decision-makers, reviewers, control owners, risk teams, and prospective assurance professionals.
California's framework provides time to prepare, but credible qualification cannot be assembled at the last minute. Competence, independence, methodology, evidence integrity, and quality management must be designed, tested, and demonstrated over time.
Contact AI Govern Consulting LLC to discuss:
- organizational readiness for covered AI audits;
- a Governance Beta™ decision-assurance review;
- development of an AI-auditor or IVO qualification roadmap; or
- preparation of audit-ready governance evidence.
Build the assurance foundation before the market — or the regulator — requires proof.
Talk with AI Govern Consulting LLC about readiness for covered AI audits, a Governance Beta™ decision-assurance review, or an IVO qualification roadmap.
Official California sources
- Governor Newsom's September 9, 2026 announcement (opens an official source in a new tab)
- Governor Newsom's September 18, 2026 executive order (opens an official source in a new tab)
- Governor Newsom's September 23, 2026 expert group announcement (opens an official source in a new tab)
- SB 813 — bill status and history (opens an official source in a new tab)
- AB 1405 — bill status and history (opens an official source in a new tab)
- SB 813 — Independent verification organizations, Chapter 179 (opens an official source in a new tab)
- AB 1405 — AI auditors: registration, Chapter 178 (opens an official source in a new tab)
- SB 947 — Employment: automated decision systems (opens an official source in a new tab)
Important notice
This material is provided for general educational and informational purposes. It is not legal advice, lobbying advice, an audit opinion, or a substitute for advice from qualified legal counsel. Applicability depends on the facts, relevant law, implementing criteria, and future regulations.
AI Govern Consulting LLC does not represent that it is currently registered as a California AI auditor, designated as an Independent Verification Organization, approved or endorsed by the State of California, accredited as a certification or conformity-assessment body, or otherwise government recognized. No consulting, readiness, or assessment engagement guarantees legal compliance, qualification, registration, designation, accreditation, certification, avoidance of liability, or any particular outcome.
Governance Beta™, AI Decision Intelligence, related methodology, intellectual property, licensing rights, and future certification rights are owned by The Dade Companies LLC. AI Govern Consulting LLC is the commercial subsidiary delivering AI governance consulting, training, readiness assessments, independent-assurance preparation, and related services.
Editorial note: SB 947 moves from proposed to enacted status only after official gubernatorial action is confirmed. This page is updated when California publishes IVO application requirements, designation criteria, registry procedures, fees, or implementing regulations.