California enacts AB 1405, creating a state AI auditor registry

Assembly Bill 1405 is a California law that creates a state registry for AI auditors, requiring them to register with a state agency before conducting covered AI audits. Governor Gavin Newsom signed AB 1405 on September 9, 2026, alongside the companion bill SB 813, which separately created a framework for independent AI verification organizations.

What it is

AB 1405 adds a new chapter to California's Government Code directing the Government Operations Agency to open a public AI Auditor Registry.

The statute defines a covered audit as one assessing the internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law.

It was enacted as Chapter 178 of the Statutes of 2026 after being chaptered by the Secretary of State.

What it requires

Beginning January 1, 2029, AB 1405 bars any unregistered person from offering, selling, or conducting a covered AI audit in California.

Registered auditors must retain all audit reports and supporting documentation for at least ten years and display their registration number clearly and conspicuously on all advertising materials offering or soliciting covered AI audit services.

Each audit report must cover scope and objectives, results and supporting documentation, remediation measures for identified deficiencies, whether the auditee adhered to internal safety standards, audit limitations, and a signed and dated compliance statement.

Independence rules bar auditors from conducting a covered audit where a financial, business, employment, or other interest would reasonably be expected to impair objectivity, and from evaluating their own prior work.

An executive order issued after the signing moved up the Agency's deadline, requiring it to establish the AI Auditor Registry and begin registering auditors no later than December 1, 2027.

AB 1405 is a companion to SB 813, and the two registration tiers are not mutually exclusive for organizations that want both credentials.

What security leaders should do

Security and compliance teams that engage or supply AI audit services should begin mapping their existing assessment work, such as ISO/IEC 42001 certifications or NIST AI Risk Management Framework reviews, against the new registration and independence standards well before the 2029 enforcement date. Organizations should also track Government Operations Agency rulemaking through 2027 for the registry's technical requirements and fee structure, since the registry build-out has already been accelerated once by executive order. Legal and audit functions should coordinate so that any third-party AI audit documentation is retained and structured to satisfy the reporting elements the law specifies, reducing rework when a covered audit is later required under California law or requested as part of litigation risk management.