On September 9, 2026, California enacted two laws that change what an AI audit is for: SB 813 makes a qualifying audit “relevant to, but not conclusive of” a lawsuit alleging that an AI system caused harm, and AB 1405 dictates what that audit report contains and how long it is kept. For a regulated enterprise the question is no longer whether to be audited; it is whether the records an audit would test — the inventory, the risk tiers, the oversight log — survive being read by someone paid to find the gap.
The liability shield became an evidence rule on the way to the Governor’s desk
SB 813 did not begin as an evidence rule. In July 2025, the Senate Judiciary Committee’s analysis of the companion auditor bill described SB 813 as offering “a rebuttable presumption against liability” for harms caused by an AI model or application certified by a private organization designated by the Attorney General. That is a safe harbor: get certified and the burden shifts to the plaintiff. The version signed as Chapter 179 keeps the verification machinery and drops the shield. Section 8898.4(b) of the Government Code now provides that, in an action alleging that a defendant’s development, modification, or use of an AI system caused harm, the fact that an audit was performed to a standard identified under the chapter is “relevant to, but not conclusive of, the action.” The same section states that nothing in the chapter establishes liability solely for failing to meet a standard, and that nothing requires any entity to engage an independent verification organization (IVO) or undergo a covered AI audit.
The machinery is deliberate and slow. The Government Operations Agency (GovOps) has until January 1, 2028, to publish application requirements and designation criteria for IVOs, and the statute names what it must weigh: whether the organization can assess AI risk and identify the metrics and methodologies behind that assessment, whether its personnel have sufficient technical expertise, whether it identifies and manages conflicts of interest, and whether it remains independent of the party it assesses. An IVO may accept market-rate payment from the company it reviews but not terms that make payment depend on the result, and GovOps must, where practicable, let reports prepared for substantially similar requirements satisfy its own. Kelley Drye’s session wrap-up is precise about the limit: the law “does not require AI developers or deployers to engage an IVO or undergo a covered AI audit.” In our judgment, any compulsion will come from elsewhere — procurement, insurers, prudential supervisors — and when it does, the audit arrives with the evidentiary status the Legislature gave it.
AB 1405 prescribes the audit report a plaintiff will eventually read
If SB 813 settles the status of the audit, AB 1405 settles its contents. Chapter 178 directs GovOps to establish an AI Auditor Registry by January 1, 2029, and from that date no person may offer, sell, or conduct a covered AI audit in California without registering. The statute defines a covered AI audit as an audit of the internal controls, processes, or systems for an AI system or model that are necessary for compliance with state law — an audit of governance, not of weights. The registered auditor’s report to the auditee must set out the scope and objectives, the results with supporting documentation, the deficiencies found and any recommended remedies, whether the auditee followed its own internal safety standards, and the audit’s limitations, under a signed and dated statement that the audit followed the chapter. The auditor keeps that report and the documentation behind it for at least ten years.
The independence rules are the ones a hostile reader tests first. A registered auditor may not audit its own work, may not seek employment with the auditee during the engagement, and may not assign staff who held a material role at the auditee in the prior twelve months; reasonable compensation alone does not disqualify, but any interest that would reasonably impair objectivity does. Auditors may not stop their employees from reporting to the Attorney General or the Labor Commissioner, and the registry carries a misconduct-reporting mechanism whose records GovOps keeps for as long as the auditor is registered plus ten years.
Assemblymember Rebecca Bauer-Kahan put the purpose in one line in the Governor’s signing announcement: “We cannot expect industry to simply grade its own homework” (Governor’s office). WilmerHale counts California as the third state, after Connecticut and Virginia, with an independent-verification audit law, and Akin Gump notes that neither bill mandates that a developer obtain one. Read together, the design is plain: the state is not forcing an audit on anyone; it is making sure that when an audit happens, it is written to a prescribed structure by an auditor bound by independence rules, kept long enough to matter, and treated as relevant when harm is alleged.
The audit does not decide the case. It decides what the court reads — and the records behind it are the exhibit.
The audit does not decide the case. It decides what the court reads — and the records behind it are the exhibit.
The hostile reading starts with your records, not your auditor
An audit of internal controls, processes, and systems can only test what exists. In our experience the first week of an AI assurance engagement is spent learning that the inventory lists procured models but not the assistants embedded in SaaS tools, that risk tiering was done once at approval and never revisited, and that human oversight is a sentence in a policy rather than a log anyone can produce. Under AB 1405 each of those gaps becomes a written deficiency with a recommended remedy, and the report must state whether the organization followed its own safety standards — so the policy written in 2024 is the yardstick applied in 2029. Under SB 813 that report is relevant in a harm action. The audit does not create the exposure; it dates it, documents it, and preserves the documentation for a decade.
Three moves follow, and none of them wait for GovOps. First, the AI system owner — in most regulated enterprises the chief information officer or the head of model risk — should bring the inventory to audit grade before year-end: every system that makes or informs a consequential decision, with a named owner, a risk tier, the state laws it touches, and the date the tier was last reviewed. Second, the legal or compliance owner should rewrite the internal AI standard so that it promises only what the organization can evidence; a standard that overstates its controls is the document a plaintiff will quote first. Third, the second line — risk and compliance, not the teams that run the systems — should run a dry audit against the AB 1405 report structure before the registry opens, producing the deficiency list and the remediation plan internally, where it can be worked, rather than externally, where it is kept for ten years. The closed-findings log that results is the defense: a dated record that issues were raised, owned, and resolved.
California did not make the AI audit mandatory; it made the audit legible — to a registry, to a regulator, and to a plaintiff. Enterprises that treat this as a compliance milestone will meet the auditor with a policy and a hope. Those that treat it as discovery preparation will meet the auditor with an inventory, a tiering record, and a closed-findings log — and will have written, in advance, the exhibit a court reads first.