California makes AI auditor registration compulsory from 2029

If a Californian law is the reason you run controls on an AI system, get your auditor's registration in writing before 1 January 2029. From that date an unregistered firm cannot lawfully conduct that audit for you.

California signed two laws about AI auditors on 9 September 2026. Assembly Bill 1405 creates a compulsory register. Senate Bill 813 creates a voluntary title beside it. Neither law makes your company get an audit. Other Californian laws put the controls in place, and that is where this reaches you.

Assembly Bill 1405 is the compulsory one. From 1 January 2029 nobody may conduct a covered AI audit unless they are on the register. A covered AI audit is an audit of controls that a Californian law made you put in place for an AI system. Nobody has to have ordered the audit. Commission one yourself and it still counts. The register does not exist yet. The California Government Operations Agency has to build it by that date.

Senate Bill 813 is the voluntary one. It creates a title, independent verification organization, shortened to IVO. The same agency has until 1 January 2028 to decide who can hold it. No auditor has to apply.

Both laws use the same definition. Assembly Bill 1405, section 11549.80(d), says a covered AI audit is "an audit conducted to assess internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law".

Read the grammar. "That are necessary" is plural, so it points at the controls, processes and systems. It cannot point at the audit, which is singular. What the law has to require is the controls. The audit can be your own idea.

That sentence was rewritten three weeks before signature. Until 25 August the bill caught only an audit "conducted pursuant to any state statute that requires an audit". The legislature struck that out.

So which Californian laws put the controls in place? Two, at least. The Transparency in Frontier Artificial Intelligence Act, signed in September 2025, makes a large frontier developer write, implement and publish a frontier AI framework. The California Privacy Protection Agency's rules, in force since 1 January 2026, make businesses assess the risks of automated decisionmaking technology. Those duties bite from 1 January 2027. Controls built for either reason are controls Californian law required.

One caveat. The statute says "state law", and I read that to include rules made by a Californian agency under a Californian statute. That is how a compliance team will read it, but nobody has tested it.

The ban itself is one sentence, section 11549.82.5. "Beginning January 1, 2029, a person shall not offer, sell, or conduct a covered AI audit unless the person is registered with the agency pursuant to this chapter."

It never says in California. It says a person. What decides whether you are caught is why the audit is happening, not where the auditor sits. A firm in London or Singapore, auditing a client against a Californian AI rule, is conducting a covered AI audit. Whether California could enforce that abroad is a question for a lawyer, but the text gives you no geographic exemption.

The duty sits on the auditor. The consequence lands on you. Assembly Bill 1405 says nothing about what your firm must do. But from 1 January 2029 an unregistered auditor cannot lawfully conduct a covered AI audit, so the engagement you were relying on is one the statute does not allow.

What you gain is the ability to check an auditor before you appoint one. Section 11549.83 makes every registered auditor tell the agency which California laws it audits against, which standards it applies and what accreditations it holds. The agency publishes all of it. Today you cannot look any of that up.

If your auditor is an accounting firm, much of this is already met. Section 11549.83 treats a California-licensed certified public accountant, or a firm holding a California permit, as already satisfying the report requirements and the independence standards. The condition is that they follow the California Accountancy Act and the standards of the American Institute of Certified Public Accountants. They still have to register.

The independence wording in Senate Bill 813 is a criterion, not a rule. It sits in section 8898.1(c)(2), which tells the California Government Operations Agency what to weigh when it writes the designation criteria before 1 January 2028. It binds nobody today. The agency has to consider whether an organisation refuses terms that tie its fee to the result, and whether it is free of management dependence on the party it assesses.

An audit is a document you hand to a court, not a shield you stand behind.

Dates from Assembly Bill 1405, sections 11549.82 and 11549.82.5, and Senate Bill 813, section 8898.1, read 14 September 2026.

California has created a voluntary title and given nobody any reason to require it. Until a regulator or a procurement process actually asks for a designated auditor, the IVO title changes nothing, and no compliance team should reorganise around it.

That is not an argument for waiting. Companies get audited. Governments get audited. AI now runs parts of both, and it has to be audited on the same basis. In the firm where I sit on the AI risk committee, my colleagues and I are mapping AI risk from both ends, the developer side and the customer side. The point is to find our own weaknesses before somebody else does. That firm is also building an internal audit team just for AI.

If you are a bank, a government body or a healthcare organisation, anywhere in the world, treat this as something to deal with now, not later. Not because California said so. Because the audit is coming either way. The only question is whether you have done the work before it gets to you.

Bachir Farah Badar
Managing Director, IntelWork4ce. Chief AI Officer, Yeeld.
linkedin.com/in/bachirfarahbadar