{"resourceId":"california-ai-audit-registry-no-mandate-20260926","versions":[{"version":"external-d35ac74ab7ee88e1bb4ac8b9ea3c7ea634bd535efacfd1950cb944bcf690ca48","resource":{"id":"california-ai-audit-registry-no-mandate-20260926","title":"Sep 26 analysis: California’s first AI audit registry still obliges almost no company to be audited","organization":"California Government Operations Agency / Legislature (SB 813, AB 1405); reporting by The People Argue","sector":"State AI audit infrastructure / independent verification / frontier and sector AI oversight","geography":"California, United States (federal preemption context noted)","publishedAt":"2026-09-26","publicationDate":"2026-09-26","eventDate":"2026-09-26","sourceName":"The People Argue — California creates first state AI audit registry, but no company has to use it yet","sourceLabel":"Independent desk analysis of enrolled SB 813/AB 1405 audit-framework scope limits","sourceUrl":"https://www.thepeopleargue.com/article/california-first-state-ai-audit-registry/","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["governance-procurement","data-security","operating-model"],"finding":"Why now: published 2026-09-26, this analysis sharpens Pass B scrutiny on already-signed California AI audit laws by stressing that the ‘first US state framework for auditing AI… obliges almost no one.’ It states Newsom signed SB 813 (IVO certification + Standards and Safety Commission) and AB 1405 (auditor registry by 1 Jan 2029); SB 813 text says it does not require developers/deployers to engage an IVO or undergo a covered audit as a condition of operating; from 2029 unregistered persons may not offer/sell/conduct covered AI audits. Frames California as building institutions before sector enforcement rules, with federal preemption risk untested.","sledRelevance":"Critical corrective to ‘mandatory AI audit’ marketing when advising state CIOs and vendors on California compliance—and transferable caution for other states copying registry models.","evidence":"Opened article cites enrolled-bill scope language and signing-day framing; secondary legal commentary (FMG Law, AIGRC) inspected this run corroborates no universal audit mandate.","architectureImplications":"No immediate runtime architecture mandate; prepare audit-evidence pipelines and assessor access patterns for when sector laws attach covered audits.","governanceImplications":"Institution-building (IVO criteria, auditor registry, commission) precedes compulsory audits; registry advertising rules and independence constraints matter for assessor market.","securityPrivacyImplications":"Covered AI audits defined around safety/efficacy/reliability/security against state law; trade-secret/redaction themes noted in related counsel materials—not detailed here.","caveats":"Desk analysis of statutes already partially archived via governor signing coverage; not a substitute for counsel opinion. EO N-9-26 acceleration of deadlines is separate archived instrument.","streamIds":["state-government"],"roles":{"sales":"Sales framing: a Sep 26 desk analysis argues California’s SB 813/AB 1405 ‘first’ AI audit framework still obliges almost no developer to hire an auditor—registry infrastructure by 2029 without a universal audit mandate. Use this to reset buyer expectations after signing-ceremony headlines: sell readiness for voluntary/sector audits and registry compliance, not a blanket audit requirement. Bound proposals to independence standards and future sector hooks.","engineering":"Engineering framing: treat IVO certification and the auditor registry as compliance infrastructure, not as runtime model controls that magically appear when bills are signed. Systems still need evaluation harnesses, evidence packs, logging, and independence-safe assessor interfaces for the day sector laws attach covered-audit duties. Proof-of-value is readiness to produce covered-audit artifacts on a high-risk system—not assuming SB 813 alone forces third-party review of every deployment today. Keep trade-secret and operational-security boundaries explicit when designing assessor access.","delivery":"Delivery framing: map which state AI uses could become ‘covered AI audits,’ prepare evidence retention (≥10-year themes from related counsel analyses inspected), and track GovOps registry timelines (including EO N-9-26 acceleration already archived). Acceptance criteria separate ‘framework enacted’ from ‘audit mandated.’ Risks include overselling mandatory audits and under-preparing for 2029 unregistered-auditor bans."},"roleDetails":{"sales":{"customerProblem":"Buyers hearing ‘first-in-nation AI audits’ need clarity that California’s framework is mostly voluntary until sector laws attach duties.","stakeholders":["State CIO / GovOps","General counsel / privacy","Procurement","Frontier model vendors","Internal audit"],"discoveryQuestions":["Which agency AI uses could become covered audits?","Are any sector statutes already requiring third-party assessment?","What evidence packs exist today?","How will 2029 registry rules affect assessor contracts?"],"valueHypothesis":"A compliance-readiness engagement can separate marketing claims from statute and prepare voluntary audit evidence before mandates arrive.","potentialEngagement":"3–5 week California AI audit-framework readiness and evidence-pack gap assessment.","unsupportedClaims":["Universal mandatory AI audits in California today","SB 813 alone bans unregistered model operation","Passing an audit grants operating permission"]},"engineering":{"fit":"Fit for evaluation harnesses, logging, and assessor-facing evidence APIs—not a forced architecture change from the statutes alone.","architectureIntegration":"Model/system inventories; evaluation reports; access for independent assessors; registry metadata when selling audit services.","prerequisites":["AI system inventory","Evaluation metrics library","Independence-safe assessor access","Document retention design"],"constraints":["No universal mandate yet","Registry not live","Federal preemption uncertainty"],"security":"Assessor access must protect trade secrets and sensitive operational data while enabling covered-audit scope.","proofOfValue":["Mock covered-audit dry run","Evidence completeness score","Independence conflict checklist","Timeline map to 2027/2029 milestones"]},"delivery":{"work":"Statute-to-control mapping, evidence-pack templates, and GovOps timeline tracking.","dependencies":["Counsel interpretation","GovOps guidance when published","Vendor contracts","Internal audit"],"ownership":"GovOps/agency compliance owners with counsel for legal interpretation.","skillsAdoption":"Program owners need audit-evidence literacy; vendors need independence-aware engagement models.","governanceCheckpoints":["Quarterly mandate watch","Pre-procurement audit-clause review","Assessor independence check"],"acceptanceCriteria":["Written mandate vs framework distinction","Evidence-pack for one high-risk system","No overclaim of mandatory audits in materials"],"risks":["Buyer overconfidence from ‘first’ headlines","Unprepared for sudden sector mandates","Assessor market conflicts of interest"]}},"retrievedAt":"2026-09-27T22:21:30-05:00","enrichedAt":"2026-09-27T22:25:45-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Statute critique does not address workforce or accessibility impacts of AI audits.","procurementImplications":"From 2029, unregistered covered-AI-audit sellers face prohibition—procurement of audit services must track registry rules; no general developer audit purchase mandate today.","operatingModelImplications":"California is sequencing institution-building before enforcement; agencies should inventory systems and evidence now while avoiding false compliance certainty.","sourceVerification":{"openedUrl":"https://www.thepeopleargue.com/article/california-first-state-ai-audit-registry/","referenceExcerpt":"No developer has to hire an auditor, and passing one grants no permission","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}