11 SEP 2026 — Governor Gavin Newsom has signed California's first laws requiring independent AI audits, and Assembly Bill 1405 creates a state registry of AI auditors. The registry does not have to exist until 1 January 2029, and the ban on unregistered auditors starts the same day. The law is in force and binds nobody for over three years.
What AB 1405 does
It establishes a registry of AI auditors and sets standards for their independence, transparency and integrity. The Government Operations Agency must stand up the registry on its website, issue each registered auditor a unique number, publish what registrants submit, and let members of the public report misconduct by a registered auditor.
From the same date, an unregistered person may not offer, sell or conduct what the statute calls a covered AI audit — defined as an assessment of the internal controls, processes or systems needed to comply with state law.
The bill was filed with the Secretary of State on 9 September 2026. Every operative date in it is 1 January 2029.
Three years is the story
The headlines say first-in-the-nation AI safeguards. The statute says 1 January 2029. Both are accurate and only one is being reported. A model deployed in California this year, next year and the year after is not audited by anyone under this statute.
The lead time is not unreasonable on its own terms. Building a registry, writing independence standards and creating a profession that does not yet exist takes time, and a law that demanded audits next quarter would produce auditors who had learned the job in a fortnight.
The three-year gap is significant. It leaves time for legislative amendment, industry lobbying, a federal pre-emption fight, and for the technology to change enough that the definitions need rewriting — and we have just watched the EU defer its own high-risk regime by more than a year for closely related reasons.
Creating a profession by statute
The ambition is more interesting than the timetable. California is not regulating AI systems in this bill; it is regulating the people who will assess them, and trying to bring a profession into being by defining who may practise it.
Financial auditing is the obvious model and it is instructive in both directions. It produced a profession with enforceable standards. It also produced the conflict that runs through every audit market, which is that the auditor is chosen and paid by the audited.
AB 1405 addresses that with independence standards and a public misconduct channel, which is more than nothing and is the same answer accounting gave before its own failures. Whether it works depends on rules the Government Operations Agency has not written yet.
What a covered audit actually covers
The definition is narrower than the coverage implies. A covered AI audit assesses the internal controls, processes or systems needed for compliance with state law — so its scope is whatever California's other AI statutes happen to require.
That makes this bill plumbing rather than a standard. It does not say a model must be safe, accurate or unbiased; it says that where state law already demands something, the assessment of whether you did it must be done by a registered person.
Reading it as an audit of AI systems themselves would be a mistake. It is an audit of compliance paperwork, performed by someone the state has vetted.
Why it still reaches Southeast Asia
California's rules travel, because companies build one compliance posture and apply it everywhere rather than maintaining a Californian variant. That is how the state's privacy law shaped product decisions far beyond it.
If a registered-auditor requirement becomes the norm for AI compliance work in California by 2029, vendors selling into the region will already have the artefacts, and regional regulators drafting their own rules will have a template to copy — which is usually how this propagates rather than by anyone deciding to follow California.
What to watch
The Government Operations Agency's rulemaking, because the independence standards are where this is won or lost and none of them exists yet. Whether an amendment moves the 2029 date in either direction.
And whether anyone starts building the profession early. A market that knows registration arrives in 2029 has three years to train people, and if nobody does, the date will arrive with a registry and no one qualified to be on it.
