California signs AI-auditor laws; a public registry is due in 2029

California has created an audit framework—not a safety label for every AI tool

Governor Gavin Newsom signed Senate Bill 813 and Assembly Bill 1405 on Wednesday, and both measures were filed with the Secretary of State as Chapters 179 and 178. Together they direct the California Government Operations Agency to define qualified independent verification organizations and build a public registry for auditors who perform AI audits required by state law. The operative deadlines stretch into 2028 and 2029. Nothing in the new laws means that a chatbot, wellness app or automated recommendation in use tonight has already passed a California safety review.

SB 813 sets the first deadline for independent verification organizations

SB 813 requires the agency, by January 1, 2028, to publish application requirements and criteria for designating an AI auditor as an independent verification organization, or IVO. The criteria must address technical competence, assessment methods, conflicts of interest, operational independence and documentation. The agency must consult stakeholders and convene working groups, then designated IVOs must report annually on their standards, methods and relevant governance or funding changes. The law allows limited redactions for trade secrets, cybersecurity, public safety, national security or other legal requirements, with a description of the reason when permitted.

AB 1405 builds a registry with a January 2029 start line

AB 1405 requires the agency to establish an online AI Auditor Registry no later than January 1, 2029. Beginning that day, a person may not offer, sell or conduct a “covered AI audit” without registering. Registered auditors must identify the California laws or regulations under which they conduct those audits, describe their standards and procedures, disclose relevant qualifications and follow independence and integrity rules. The registry must publish the auditor's registration number and submitted information while stating that registration is not a California endorsement. A separate reporting mechanism will accept allegations of auditor misconduct.

The laws cover a defined audit—not every algorithm or consumer complaint

Both statutes define a covered AI audit as an assessment of controls, processes or systems needed for compliance with California law. SB 813 expressly says it does not require every developer, deployer or operator to hire an IVO or put every system through an audit. It also says an audit can be relevant in a civil case alleging AI-related harm but is not conclusive. AB 1405 regulates people who perform covered audits; it does not create a general approval process for individual apps, guarantee that an audited system is accurate or replace the agency that enforces the underlying consumer, labor, privacy or safety rule.

For consumers, the immediate change is information about a system still being built

The legislation is now law, but the public-facing tools described in it are not yet operating. There is no registry number to check before using an AI health assistant today, and the 2028 IVO criteria will not by themselves show that a particular product was audited. When the registry arrives, consumers should be able to verify whether an auditor is registered, review its stated services and standards and see the state's non-endorsement notice. Until then, a company's claim that its AI is “audited,” “verified” or “California compliant” still deserves basic questions: who conducted the review, what law or standard was tested, what version was examined, what limits were found and whether the report is public.

Health and wellness advice needs an independent check now

An audit claim does not turn a chatbot into a clinician. For a health or wellness answer, identify who created the tool, when the information was updated, what evidence supports the recommendation and whether the page or app is selling something. Compare material claims with a current public-health agency, clinical guideline or qualified healthcare professional. Do not let a conversational answer delay care for severe symptoms, alter a prescribed medicine or substitute a massage, supplement or routine wellness service for diagnosis or treatment. Call 911 for severe trouble breathing, chest pain, signs of stroke, loss of consciousness or another immediate emergency.

Protect the question as carefully as the answer

Before entering symptoms, sexual-health concerns, location, insurance details or account information into an AI service, review what the service says it collects, retains and shares. Use the least identifying detail needed, avoid uploading medical records or government identification unless the destination and purpose are clear, and save important source links outside the chat. California residents can use the California Privacy Protection Agency's complaint system for possible violations of the state privacy laws it enforces. That existing route is different from the future AB 1405 mechanism for reporting misconduct by a registered AI auditor.

Read future audit claims with the law's own caveats in mind

The strongest consumer takeaway is a boundary: California is creating standards for the people who inspect certain AI systems, not promising that every AI output is safe. Check the live bill text and agency guidance as the 2028 and 2029 deadlines approach because regulations and implementation details can change. NOCTI publishes this as California digital-safety and wellness service journalism. It is educational information, not legal or medical advice, and it does not endorse an AI product, auditor or audit claim.

Sources

• Office of Governor Gavin Newsom: SB 813 and AB 1405 signing announcement (September 9, 2026) ↗
• California Legislative Information: chaptered text of SB 813, Chapter 179 (September 9, 2026) ↗
• California Legislative Information: chaptered text of AB 1405, Chapter 178 (September 9, 2026) ↗
• NIH/NCCIH: five questions for checking online health information ↗
• California Privacy Protection Agency: privacy complaint system ↗