Law / United States / California
AI Auditor Registry Act (AB 1405)
Cal. Gov. Code Sections 11549.80 to 11549.86 (AB 1405, Ch. 178, Stats. 2026)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force in 838 days, effective 1 January 2029.
An AI governance rule binding private bodies.
As of 15 September 2026.
What it requires
- This chapter binds AI auditors (anyone who assesses an AI system or model on behalf of a third party), not the developer or deployer of the AI system being assessed, unless that developer or deployer also offers covered AI audits to others.
- If you offer, sell, or conduct a covered AI audit, an audit assessing internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with California law, register with the Government Operations Agency before doing so, starting January 1, 2029.
- If you register as an AI auditor, give the agency your business name, contact information, the California laws or regulations you audit under, relevant certifications, a description of your services, and a standard operating procedure describing the standards you apply and the basis for your accuracy and reliability claims.
- If you are a registered AI auditor, update that information with the agency within 90 days of any change that materially affects its accuracy or completeness.
- If you are a registered AI auditor, do not conduct a covered AI audit of a system, process, control, assessment, or other subject matter you materially designed, developed, implemented, or operated for the auditee, and otherwise maintain independence, objectivity, and competence throughout the audit.
- If you are a registered AI auditor conducting a covered AI audit, give the auditee a report covering the audit's scope and objectives, its results and supporting documentation, each deficiency found and how it could reasonably be addressed, whether the auditee followed its own internal safety standards and protocols within the audit's scope, the audit's limitations, and a signed and dated statement that the audit met this chapter's requirements.
- If you are a registered AI auditor, retain the information you gave the auditee and the documentation behind your audit results for at least 10 years.
- If you are a registered AI auditor, display your registration number clearly and conspicuously on advertising for your audit services, and do not retaliate against an employee who reports suspected noncompliance to the Attorney General, the Labor Commissioner, or the agency.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Who enforces it
Enforcement body
Government Operations Agency, which may investigate a reported violation and remove a registered AI auditor from the registry, referring most violations to the Attorney General or other appropriate enforcement authority; a violation by a CPA, public accountant, or accounting firm is referred instead to the California Board of Accountancy for investigation.
What it reaches
Obligation class
Licensing, Retention, Disclosure
Who checks it
Audit expectation
none
Who audits it
Registered or designated auditor
Where the report goes
Kept
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
This chapter regulates AI auditors, meaning any person, partnership, or corporation that assesses an AI system or model on behalf of a third party, and does not impose duties on the AI system's own developer or deployer unless that developer or deployer also offers covered AI audit services to others.
Beginning January 1, 2029, a person may not offer, sell, or conduct a covered AI audit (an audit assessing internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law) unless registered with the Government Operations Agency, which must itself establish the AI Auditor Registry, fix registration fees, and stand up a misconduct-reporting mechanism no later than that same date.
An auditor who registers must give the agency its business name and contact information, a list of the California laws or regulations it audits under, any relevant certifications, a description of its services, and a standard operating procedure describing the standards it applies and the basis for its accuracy and reliability claims; the agency then publishes that registration information, including the list of laws audited under, on its own website.
A registered auditor may not conduct a covered AI audit of a system, process, control, assessment, or other subject matter it materially designed, developed, implemented, or operated for the auditee, and must otherwise maintain independence, objectivity, and competence throughout the engagement.
For each covered audit, the auditor must give the auditee a report covering the audit's scope and objectives, its results and the documentation behind them, each deficiency found and what could reasonably address it, whether the auditee followed its own internal safety standards and protocols within the audit's scope, the audit's limitations and any material gaps in the evidence available, and a signed and dated statement that the audit met this chapter's requirements.
The auditor must retain the information it gave the auditee and the documentation behind its results for at least 10 years, display its registration number on advertising for its audit services, and may not retaliate against an employee who reports suspected noncompliance.
A licensed CPA or accounting firm performing the audit under applicable AICPA and California Board of Accountancy standards is deemed to satisfy the reporting and independence requirements without separately meeting every listed element, and a violation by such an accountant is referred to the California Board of Accountancy rather than handled solely by the agency.
When LexLint raises it
trains_modelsgenerates_contenthigh_risk_decisions