California AB 1405: the AI Auditor Registry

Status

• ApprovedBy the Governor on 9 September 2026, and filed with the Secretary of State the same day. Chapter 178, Statutes of 2026.
• The registryNo later than 1 January 2029, the Government Operations Agency establishes an AI Auditor Registry on its website, fixes annual registration fees no higher than the reasonable cost of running it, and sets up a way for any natural person to report misconduct by a registered auditor (section 11549.82(a)).
• From 1 Jan 2029The agency issues each registered auditor a unique registration number and publishes the numbers and the registration information, with a statement that registration does not constitute recommendation or endorsement by the State of California (section 11549.82(b)). An unregistered person may not offer, sell or conduct a covered AI audit (section 11549.82.5).
• Earlier dateExecutive Order N-9-26, signed 18 September 2026, directs the agency to complete the requirements of section 11549.82(a), and begin taking the actions in (b), no later than 1 December 2027.
• AI auditor“a person, partnership, or corporation that assesses an AI system or model on behalf of a third party.”

What a registered auditor must do

• RegisterIts business name and contact details, the California laws or regulations under which it conducts covered AI audits, its certifications or accreditations, a description of its services, and a standard operating procedure naming the standards it applies and the basis for any claims about the accuracy, reliability or validity of its protocols. Trade secrets may be redacted. Material changes are reported within 90 days (section 11549.83(a) and (b)).
• StandardsAudits are conducted in accordance with widely recognized industry standards appropriate to the system or model, to the extent such standards are available (section 11549.83(c)).
• The reportTo the auditee: the scope and objectives; the results and “any documentation necessary to demonstrate the basis of those results”; for each deficiency, measures that would reasonably address it, where appropriate; whether the auditee implemented and adhered to its internal safety standards and protocols within scope; the limitations, including matters not assessed and “any material gaps in the evidence, information, systems, or access available to the AI auditor”; and the signed and dated statement (section 11549.83(d)).
• RetentionEverything provided to the auditee, and the documentation behind the results, kept for at least 10 years (section 11549.83(e)).
• IndependenceNo covered AI audit where a financial, business, employment or other interest or relationship would reasonably be expected to impair independence or objectivity; no audit of the auditor’s own work, including a system, process or control it materially designed, developed, implemented or operated for the auditee; no seeking employment with the auditee during the audit; and a 12-month bar on assigning a former employee of the auditee who had material responsibility for the subject matter (section 11549.83(f)).
• AccountantsLicensed accountants and accounting firms are deemed to meet the report and independence requirements if they comply with the California Accountancy Act, the AICPA Code of Professional Conduct and the AICPA attestation standards (section 11549.83(d)(2) and (f)(2)).
• EmployeesA registered auditor may not prevent an employee from reporting non-compliance to the Attorney General, the Labor Commissioner or the registry, or retaliate for it (section 11549.83(g)).
• AdvertisingThe registration number is displayed clearly and conspicuously on all advertising for covered AI audit services (section 11549.83.5).

Enforcement

The agency may investigate a reported violation. A violation by a registered auditor is grounds for removal from the registry and referral to the Attorney General or another enforcement authority, after written notice and a reasonable opportunity to cure or contest. Violations by accountants in good standing are referred to the California Board of Accountancy, which investigates and reports back (section 11549.84). The agency may adopt regulations (section 11549.85). The chapter does not affect audits required by other statutes or regulations that become operative earlier (section 11549.86).

Why it is on this site

Regulayer™ is not an auditor and no California law requires it. It is the control that holds an AI action until a named person’s authority is confirmed, and the sealed record an auditor can inspect afterwards.

AB 1405 is here because of what it puts into law. An audit of the controls an AI system needs to comply with California law must show the documentation behind its results and name the gaps in the evidence it had, under the signature of an auditor the state has registered.

Sources

• AB 1405, Artificial intelligence: auditors: registration, Chapter 178, Statutes of 2026, chaptered text, California Legislative Information, read in full for this page
• Executive Order N-9-26, signed 18 September 2026, item 2

Related

• The law library
• California · SB 53, with SB 813 on independent verification organizations and Executive Order N-9-26
• Illinois · SB 315, an independent third-party audit
• NYC · Local Law 144, automated hiring bias audit
• AICPA · SOC 2, attestation by accountants

Read against the chaptered text, in full. Information, not legal advice.