On September 9, Governor Gavin Newsom signed two laws establishing a framework for independent AI verification organizations and a registry for AI auditors. California put attention on the people providing assurance about AI.
An outside assessment sounds reassuring. But being outside the company answers only one question. It does not establish that the assessor has the right expertise, obtained sufficient evidence, or reached a conclusion the work supports.
The new framework addresses that gap. Its importance lies in making the basis of an assessment open to examination, including the independence of the person who performed it.
Registration and Designation Answer Different Questions
AB 1405 requires registration beginning January 1, 2029, to offer, sell, or conduct covered AI audits. Covered audits assess the internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law. Registration does not constitute state endorsement.
SB 813 directs the Government Operations Agency to develop independent verification organization designation requirements by January 1, 2028. Designation turns on demonstrated risk-assessment expertise and methods. Criteria must consider technical personnel, conflicts, and freedom from the assessed party’s control. Designated organizations report annually on methods and relevant funding or governance changes.
Registration and designation are distinct statuses. For someone purchasing an assessment, the practical questions remain concrete: what qualifications does this assessor hold, and what work do those qualifications support?
The framework addresses AI systems and models broadly, rather than foundation models alone. It does not turn every benchmark or AI consulting engagement into a covered audit. The connection to state-law compliance defines covered audits.
That distinction matters for the way the news is described. A company using a predictive model is not excluded simply because its technology does not generate text. Conversely, the mere involvement of AI does not establish that an engagement falls within this statutory category.
Independence Requires More Than a Separate Company
AB 1405 addresses conflicting relationships, review of an auditor’s own work, employment negotiations during an audit, and assignment of certain employees who left the auditee within the preceding 12 months. Teams must collectively possess expertise appropriate to the audit. Qualifying accountancy engagements can satisfy specified requirements through applicable professional standards.
SB 813’s designation criteria permit reasonable market-rate payment to an IVO but bar terms conditioning payment on assessment results. They also address operational and management independence, including protection from the assessed party’s control over conclusions.
These provisions give independence a practical meaning. Consider a hypothetical consultant who designs a company’s AI approval process and then offers an independent assessment of that same process. The consultant knows the work intimately. That knowledge does not remove the problem of reviewing decisions the consultant helped make.
Or consider an assessment fee that increases when the company receives a favorable result. The assessor’s financial interest is then tied to the conclusion. Moving the assessor to a different office would not change that relationship.
The lesson is that independence depends on what the assessor has done, what relationships remain, and who can influence the work.
The Report Must Reveal What the Evidence Cannot Establish
AB 1405 requires reports covering objectives, findings, supporting documentation, deficiencies, relevant internal safety protocols, and limitations—including material gaps in evidence or access. Records must be retained for ten years. Misconduct reporting, whistleblower protections, removal, and enforcement referrals support accountability.
The limitations requirement deserves particular attention. In a hypothetical assessment of a hiring application, an auditor might examine written procedures and test results supplied by the vendor without receiving records of actual hiring decisions. Those materials answer different questions from evidence about how the employer uses the application.
The reader needs to know which work occurred. A conclusion about documented controls should not become a claim that every consequential decision was examined.
Disclosing missing evidence does not supply that evidence. It does, however, give the recipient a basis for deciding how much reliance the conclusion deserves. The practical value of the report depends on that distinction.
An Audit Supplies Evidence Rather Than Immunity
SB 813 does not require developers, deployers, or operators to obtain an IVO assessment as a condition of operating in California. Nor does it establish liability solely for failure to meet a standard under the chapter. A qualifying audit is relevant, but not conclusive, in litigation alleging AI-caused harm. IVO designation can be suspended or terminated through procedures addressing conflicts, misrepresentations, inadequate records, competence, and cybersecurity lapses.
For a company, this means an assessment must be understood on its own terms. It provides evidence about the matters examined. Its value cannot be separated from the methods used, the information available, or the limitations disclosed.
The organization purchasing the work still needs to decide what to do with the findings. A report identifying a deficiency does not correct the deficiency.
