From the State Government edition of September 27, 2026
Sep 26 analysis: California’s first AI audit registry still obliges almost no company to be audited
California Government Operations Agency / Legislature (SB 813, AB 1405); reporting by The People Argue · State AI audit infrastructure / independent verification / frontier and sector AI oversight · California, United States (federal preemption context noted)
- Publisher
- The People Argue — California creates first state AI audit registry, but no company has to use it yet
- Original publication
- 2026-09-26
- Source retrieved
- 2026-09-28
- Event date
- 2026-09-26
What happened
Why now: published 2026-09-26, this analysis sharpens Pass B scrutiny on already-signed California AI audit laws by stressing that the ‘first US state framework for auditing AI… obliges almost no one.’ It states Newsom signed SB 813 (IVO certification + Standards and Safety Commission) and AB 1405 (auditor registry by 1 Jan 2029); SB 813 text says it does not require developers/deployers to engage an IVO or undergo a covered audit as a condition of operating; from 2029 unregistered persons may not offer/sell/conduct covered AI audits. Frames California as building institutions before sector enforcement rules, with federal preemption risk untested.
Why it matters
Critical corrective to ‘mandatory AI audit’ marketing when advising state CIOs and vendors on California compliance—and transferable caution for other states copying registry models.
Evidence and measured results
Opened article cites enrolled-bill scope language and signing-day framing; secondary legal commentary (FMG Law, AIGRC) inspected this run corroborates no universal audit mandate.
Limitations and uncertainty
Desk analysis of statutes already partially archived via governor signing coverage; not a substitute for counsel opinion. EO N-9-26 acceleration of deadlines is separate archived instrument.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-27; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Buyers hearing ‘first-in-nation AI audits’ need clarity that California’s framework is mostly voluntary until sector laws attach duties.
- Stakeholders
- State CIO / GovOps
- General counsel / privacy
- Procurement
- Frontier model vendors
- Internal audit
- Discovery questions
- Which agency AI uses could become covered audits?
- Are any sector statutes already requiring third-party assessment?
- What evidence packs exist today?
- How will 2029 registry rules affect assessor contracts?
- Value hypothesis
- A compliance-readiness engagement can separate marketing claims from statute and prepare voluntary audit evidence before mandates arrive.
- Potential engagement
- 3–5 week California AI audit-framework readiness and evidence-pack gap assessment.
- Unsupported claims
- Universal mandatory AI audits in California today
- SB 813 alone bans unregistered model operation
- Passing an audit grants operating permission
Pre-sales engineering
Role takeaway
- Fit
- Fit for evaluation harnesses, logging, and assessor-facing evidence APIs—not a forced architecture change from the statutes alone.
- Architecture and integration
- Model/system inventories; evaluation reports; access for independent assessors; registry metadata when selling audit services.
- Prerequisites
- AI system inventory
- Evaluation metrics library
- Independence-safe assessor access
- Document retention design
- Constraints
- No universal mandate yet
- Registry not live
- Federal preemption uncertainty
- Security
- Assessor access must protect trade secrets and sensitive operational data while enabling covered-audit scope.
- Proof of value
- Mock covered-audit dry run
- Evidence completeness score
- Independence conflict checklist
- Timeline map to 2027/2029 milestones
Delivery
Role takeaway
- Work
- Statute-to-control mapping, evidence-pack templates, and GovOps timeline tracking.
- Dependencies
- Counsel interpretation
- GovOps guidance when published
- Vendor contracts
- Internal audit
- Ownership
- GovOps/agency compliance owners with counsel for legal interpretation.
- Skills and adoption
- Program owners need audit-evidence literacy; vendors need independence-aware engagement models.
- Governance checkpoints
- Quarterly mandate watch
- Pre-procurement audit-clause review
- Assessor independence check
- Acceptance criteria
- Written mandate vs framework distinction
- Evidence-pack for one high-risk system
- No overclaim of mandatory audits in materials
- Risks
- Buyer overconfidence from ‘first’ headlines
- Unprepared for sudden sector mandates
- Assessor market conflicts of interest
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
No immediate runtime architecture mandate; prepare audit-evidence pipelines and assessor access patterns for when sector laws attach covered audits.
Governance
Who approves, reviews and stays accountable for outcomes?
Institution-building (IVO criteria, auditor registry, commission) precedes compulsory audits; registry advertising rules and independence constraints matter for assessor market.
Security and privacy
What data, permissions and controls need testing?
Covered AI audits defined around safety/efficacy/reliability/security against state law; trade-secret/redaction themes noted in related counsel materials—not detailed here.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Statute critique does not address workforce or accessibility impacts of AI audits.
Procurement
What should contracts, pricing and exit terms secure?
From 2029, unregistered covered-AI-audit sellers face prohibition—procurement of audit services must track registry rules; no general developer audit purchase mandate today.
Operating model
Which teams own the service once it runs?
California is sequencing institution-building before enforcement; agencies should inventory systems and evidence now while avoiding false compliance certainty.
Publication history
- 2026-09-27State Government · Issue 225 resources
Stable resource ID: california-ai-audit-registry-no-mandate-20260926