From the State Government edition of September 22, 2026
California signs SB 813 and AB 1405 creating IVO and AI auditor-registry frameworks
State of California — Office of the Governor / Legislature · State AI safety legislation and third-party audit market design · California, United States (national demonstration effect)
- Publisher
- Governor of California — Newsom signs first-in-the-nation AI safeguards (SB 813 / AB 1405)
- Original publication
- 2026-09-09
- Source retrieved
- 2026-09-23
- Event date
- 2026-09-09
What happened
Why now: signed 2026-09-09 statutes create California’s independent verification organization (SB 813) and AI auditor registry/independence standards (AB 1405), distinct from the already-archived 2026-09-18 EO N-9-26 that later accelerates implementation timelines. The governor’s release frames the bills as first-in-the-nation third-party assessment infrastructure for AI systems/models’ compliance with state law, building on SB 53 and prior EOs. Opened supporting legal analysis notes statutory designation deadlines (IVO criteria by Jan 1, 2028; auditor registry by Jan 1, 2029) that EO N-9-26 seeks to pull forward—relevant for state procurement and vendor assurance planning this week.
Why it matters
State-government buyers and regulators need the statutory IVO/auditor-registry design, not only the accelerating EO: it shapes how California (and copycat states) will demand third-party assurance in procurement and frontier-developer oversight.
Evidence and measured results
Primary: official governor press release quoting Newsom, Sen. McNerney, Asm. Bauer-Kahan. Supporting inspection of FMG legal summary for deadline structure; GovTech 2026-09-21 for EO acceleration context. Bills establish frameworks; they do not themselves publish audit results.
Limitations and uncertainty
Press release is announcement-level; full bill text not re-parsed in this run. Frameworks are not yet operational. Statutory deadlines differ from EO acceleration dates—cite carefully.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-22; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Public-sector and AI vendors need credible third-party assurance pathways as California creates IVO and auditor-registry law.
- Stakeholders
- GovOps / CDT
- Agency CIOs and counsel
- Frontier developers and deployers
- Procurement officers
- Potential IVO/auditor firms
- Discovery questions
- Are you expecting to be assessed, to buy assessments, or to become an IVO/auditor?
- Which state-law obligations will audits cover first?
- How will EO acceleration change your 2027 milestones?
- What evidence can you share without waiving privileges?
- Value hypothesis
- A bounded assurance-readiness engagement can align evidence packs to SB 813/AB 1405 purposes before registry go-live.
- Potential engagement
- 6–10 week California AI assurance readiness assessment mapped to IVO/auditor-registry requirements.
- Unsupported claims
- Immediate mandatory audits for all AI systems
- Federal preemption resolved
- Guaranteed IVO designation for any vendor
Pre-sales engineering
Role takeaway
- Fit
- Fit for organizations that must produce assessable safety/compliance evidence; not a substitute for product controls.
- Architecture and integration
- Evidence lake for evals, incident reports, model changes; access patterns for external assessors; redaction workflows.
- Prerequisites
- Inventory of in-scope AI systems
- Mapped California AI obligations
- Logging/retention suitable for audit
- Conflict-of-interest boundaries if seeking IVO status
- Constraints
- Framework not yet operational
- Deadlines subject to EO acceleration
- Trade-secret redaction limits transparency
- Security
- Plan assessor access with least privilege; protect cyber and safety-sensitive details under allowed redactions.
- Proof of value
- Gap analysis to statutory IVO/auditor criteria
- Mock assessor dry-run on one system
- Timeline aligned to GovOps milestones
- Independence policy draft if pursuing auditor role
Delivery
Role takeaway
- Work
- Policy tracking, evidence repository build, vendor/auditor market scan, and procurement clause updates.
- Dependencies
- GovOps rulemaking
- Legislative reporting templates
- Legal privilege strategy
- Existing SB 53 compliance program
- Ownership
- Agency counsel + risk/compliance with CIO technical evidence owners.
- Skills and adoption
- Staff need audit-response and evidence-curation skills; vendors need independence literacy.
- Governance checkpoints
- Bill/EO requirement matrix sign-off
- Quarterly GovOps watch
- Pre-procurement assurance clause review
- Conflict checks for any auditor relationships
- Acceptance criteria
- Requirement matrix approved
- Evidence pack for one pilot system
- Procurement language draft ready
- No claims of completed statutory audits until designated
- Risks
- Deadline confusion between statute and EO
- Assessor shopping without independence
- Over-collection of sensitive eval data
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Creates external assurance actors (IVOs/registered auditors) that vendors and covered entities may need to interface with; state agencies should expect evidence packages and independence attestations in future procurements.
Governance
Who approves, reviews and stays accountable for outcomes?
Codifies third-party evaluation rather than industry self-attestation; annual IVO reporting to Agency/Legislature on methodologies and conflicts (per supporting legal analysis). Does not by itself mandate audits of every AI system.
Security and privacy
What data, permissions and controls need testing?
Independent assessment aimed at safety/compliance risks; trade-secret and security redactions contemplated in IVO reporting per supporting analysis—operators must plan dual public/confidential evidence layers.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Builds a professional AI-auditor labor market and registry; state GovOps capacity to designate/register becomes a critical path.
Procurement
What should contracts, pricing and exit terms secure?
Expect future solicitations to reference IVO assessments or registered auditors once programs stand up; align with existing trusted-AI procurement EOs.
Operating model
Which teams own the service once it runs?
Long implementation runway unless accelerated by EO N-9-26; agencies should track GovOps rulemaking rather than assume immediate audit mandates.
Publication history
- 2026-09-22State Government · Issue 174 resources
Stable resource ID: california-sb813-ab1405-independent-ai-audit-framework-20260909