Governor Newsom signed two bills on September 9 that create the statutory scaffolding for independent AI verification — a framework and a registry, not a mandate, and the beginning of a profession that does not yet exist.
California AI Oversight — September 9, 2026
SB 813
Framework for Independent Verification Organizations (McNerney)
AB 1405
State Registry of AI Auditors + Independence Standards (Bauer-Kahan)
Jan 1, 2028
Deadline for state to certify first IVOs under SB 813
In a signing release dated September 9, Governor Gavin Newsom’s office announced two new AI bills: SB 813, authored by Senator Jerry McNerney, establishes what California calls a first-in-the-nation framework for “independent verification organizations” — outside bodies authorized to assess AI systems and models for compliance with state law. AB 1405, from Assemblymember Rebecca Bauer-Kahan, creates a state registry for AI auditors and sets standards for their independence, transparency, and integrity. Together, they form the next layer above 2025’s SB 53, the Transparency in Frontier Artificial Intelligence Act, which required labs to disclose safety frameworks and report incidents. These two bills are scaffolding on top of that foundation — they do not replace it.
The precise shape of what was signed matters, because it is easy to overread. SB 813 creates a voluntary framework: no existing California law compels AI developers to submit their systems to an independent verification organization. The state is set to certify its first such organizations by January 1, 2028, which makes this a multi-year institutional build, not a switch that flips overnight. AB 1405 registers the auditors, not the AI systems — meaning it imposes no blanket compliance obligation on companies that have California users. The independent-AI-audit industry these laws presuppose does not yet exist in any standardized form. The bills are a legislative bet that one will form around the registry.
Newsom paired the signing with an explicit call for the federal government to act — a signal that California treats its own framework as a partial and state-level answer to what is structurally a national question. The signing release does not include statements from Anthropic or OpenAI, and no claim about those labs’ positions on these specific bills is warranted here.
Assemblymember Rebecca Bauer-Kahan — AB 1405 Author
“Californians deserve to know that the AI systems and models shaping their lives are safe and secure.”
California AI Oversight — Build Timeline
2025 — SB 53
Transparency in Frontier AI Act: labs must disclose safety frameworks and report incidents. The foundation layer.
September 9, 2026 — SB 813 + AB 1405 Signed
Framework for independent verification organizations (voluntary) + state registry for AI auditors with independence and integrity standards. Enabling infrastructure, not a mandate.
January 1, 2028 — IVO Certification Deadline
State to certify first independent verification organizations under SB 813. Industry must form around the registry for the framework to have teeth.
Open Question — Federal Action
Newsom explicitly called on the federal government to act. A state-level framework is a partial answer to a national-scope problem.
The key insight: California is not mandating AI audits — it is legislating an audit profession into existence. SB 813 and AB 1405 create the legal category, the certification path, and the independence standards. Whether that profession actually forms around the registry, and whether it produces credible assurance, is the implementation question these bills deliberately leave open.
The Structural Read
The useful frame here is not regulatory compliance — it is institutional formation. Markets did not simply trust companies to report their own financial numbers. Over decades they built a profession of independent auditors with codified standards, and after Enron they tightened the independence and financial-separation rules — via Sarbanes-Oxley — that prevent an auditor from being captured by the company it audits. That architecture took a crisis and a generation to harden. AI is earlier in the same arc.
The technical capacity to evaluate AI models exists today but is scattered: a handful of labs conduct their own safety work, a small number of nonprofit evaluators operate independently, and no standardized assurance layer with defined auditor independence rules sits across the industry. SB 813 and AB 1405 are California’s attempt to legislate that layer into existence before the market settles one on its own — to create the legal category of “independent verification organization,” register the auditors who would staff them, and attach independence and integrity standards to the role.
The same week these bills were signed, a relevant data point arrived from the voluntary side of the ledger. Anthropic disclosed that its models had reached real systems during misconfigured cybersecurity evaluations, and directed attention to an independent investigation of those incidents by the evaluation nonprofit METR — a lab-led, post-incident independent review. METR has conducted evaluations for multiple frontier labs over a period of years; this was not an unprecedented act. But the pairing is structurally legible: independent scrutiny arriving simultaneously from a lab’s own choice (voluntary, after the fact) and from a state legislature (statutory, prospective). The governance model is converging from two directions at once. That convergence is the signal worth tracking, not either event in isolation.
Permission Layer — Business Engineer Framework
From “Trust the Lab” to “Verify via Independent Third Party”
The first era of AI governance asked developers to self-certify safety. California’s SB 813 and AB 1405 are the early legislative expression of the second era: an independent-assurance layer with registered auditors, certified verification organizations, and codified independence standards. The financial-auditing precedent — and Sarbanes-Oxley’s post-Enron tightening — is our analytical frame for what that transition looks like over time, not language from the statutes. The arc from voluntary to statutory is visible; the pace depends on whether a credible audit industry actually forms around the registry by 2028 and beyond.
IMPLICATION 1 — A New Professional Category Is Being Legislated Into Existence
The independent-AI-audit industry does not yet exist in standardized form. AB 1405’s registry and SB 813’s certification path create the legal infrastructure for one to form — but the framework’s force will depend entirely on how many credible evaluators register and whether the state’s IVO certification process produces organizations that the market treats as authoritative. This is regulatory scaffolding built ahead of the industry it presupposes; whether the scaffolding attracts the building is the open question through 2028.
IMPLICATION 2 — Voluntary and Statutory Governance Are Converging on the Same Idea
Anthropic’s post-incident independent review via METR and California’s statutory IVO framework are structurally the same concept arriving from different directions: neither the lab nor the state is relying solely on self-assessment. That convergence matters more than either event alone. Labs that build relationships with credible independent evaluators now are positioning ahead of a regulatory environment that is moving — slowly but unmistakably — toward mandated third-party verification. Voluntary adoption today shapes what the statutory version eventually looks like.
IMPLICATION 3 — State-Level Scaffolding Has Limits That Only Federal Action Can Close
Newsom’s explicit call for federal action is the most honest line in the signing. A California registry of AI auditors and a voluntary IVO framework apply within one state’s jurisdiction; frontier AI models are global products. The financial-auditing parallel is instructive here too — the profession became authoritative when federal law (SEC requirements, Sarbanes-Oxley) standardized it nationally, not when individual states experimented. California is seeding the concept and demonstrating that implementation is possible. The conversion from seed to standard requires Washington to engage — and that timeline is genuinely uncertain.
Business Engineer Framework
The Permission Layer — Where Governance Sits in the AI Stack
California’s SB 813 and AB 1405 are Permission Layer moves: state-level legislation that defines who may verify AI systems, under what standards, and with what independence requirements. The Map of AI Redrawn frames this layer as the one that ultimately determines which capabilities reach the market — and at what pace. Understanding how the permission layer is forming, bill by bill and standard by standard, is essential context for anyone tracking AI’s competitive and regulatory landscape.
SB 813 and AB 1405 are not an audit mandate and should not be read as one — they are enabling infrastructure: a voluntary framework for independent verification organizations, a registry of auditors with codified independence standards, and a certification clock set to January 1, 2028. What they represent structurally is more significant than any individual clause: California is attempting to legislate an independent AI-audit profession into existence before the market produces one organically, using the same institutional logic that eventually made financial auditing trustworthy — not self-certification, but verification by an independent third party with rules about capture. The profession doesn’t exist yet. The framework does. Whether the gap closes is now an implementation question, not a legislative one.
This is businessanalysis, not legal or investment advice. SB 813 and AB 1405 establish a framework for independent verification organizations and a registry and standards for AI auditors — enabling infrastructure, not a blanket requirement that every AI system be audited. SB 813’s framework is voluntary, with the state to certify verification organizations by January 1, 2028; AB 1405 registers auditors, not AI systems. This is California state law (Newsom called on the federal government to act), builds on 2025’s SB 53, and the release does not include statements from Anthropic or OpenAI. The comparison to financial auditing is analysis, not statutory language.
Gennaro is the creator of FourWeekMBA, which reached about four million business people, comprising C-level executives, investors, analysts, product managers, and aspiring digital entrepreneurs in 2022 alone | He is also Director of Sales for a high-tech scaleup in the AI Industry | In 2012, Gennaro earned an International MBA with emphasis on Corporate Finance and Business Strategy.
Scroll to Top
Discover more from FourWeekMBA
Subscribe now to keep reading and get access to the full archive.
