CA AB1405: Artificial intelligence: auditors: registration.

In one paragraph

California's AB 1405 creates a state registry for AI auditors. By January 1, 2029, the Government Operations Agency must launch an online AI Auditor Registry, set annual fees and open a channel for reporting auditor misconduct. Beginning January 1, 2029, no one may offer, sell or conduct a covered AI audit (an audit of an AI system's or model's controls, processes or systems needed to comply with state law) without registering. Registered auditors must disclose their standards, meet independence rules, give auditees signed reports, keep records at least 10 years and show their registration number in ads. Signed September 9, 2026 (Chapter 178); effective January 1, 2027.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

From January 1, 2029, firms that audit AI systems or models for compliance with California law must register with the Government Operations Agency, show the registration number in ads, and meet report, record-keeping and independence rules.

Key provisions

1. 1New Gov. Code §§ 11549.80-11549.86: an AI auditor is a person, partnership or corporation that assesses an AI system or model on behalf of a third party; a covered AI audit assesses internal controls, processes or systems for an AI system or model that are necessary for compliance with state law
2. 2By January 1, 2029, the Government Operations Agency must set up the AI Auditor Registry on its website, fix annual fees no higher than its reasonable costs, and create a way for people to report auditor misconduct; from then it issues registration numbers and publishes registrants' information with a statement that registration is not a state endorsement
3. 3Beginning January 1, 2029, a person may not offer, sell or conduct a covered AI audit unless registered (§ 11549.82.5); the registration number must be clearly and conspicuously displayed on all advertising for covered AI audit services
4. 4Registrants provide their business name and contacts, the California laws under which they audit, certifications, a description of up to 500 words, and a standard operating procedure naming the standards they apply (e.g., ISO, NIST) and the basis for accuracy claims (trade secrets may be redacted); material changes must be reported within 90 days
5. 5Audit reports to the auditee must cover scope and objectives, results and supporting documentation, measures to address each deficiency, whether internal safety standards were followed, the audit's limitations, and a signed, dated statement that the audit met the chapter; audits follow widely recognized industry standards where available, and records are kept at least 10 years
6. 6Independence rules: no audits where a financial, business or employment interest would impair objectivity, no auditing the auditor's own work, no seeking a job with the auditee during the audit, and a 12-month bar on assigning former auditee staff; licensed CPAs and accounting firms following the Accountancy Act and AICPA standards are deemed to satisfy the report and independence rules
7. 7Auditors may not stop employees from reporting noncompliance to the Attorney General, the Labor Commissioner or the misconduct channel, or retaliate against them. The agency may investigate; a violation is grounds for removal from the registry (after notice and a chance to cure or contest) and referral to the Attorney General or another enforcement authority; CPA cases go to the California Board of Accountancy
8. 8Signed September 9, 2026 (Chapter 178, Statutes of 2026); effective January 1, 2027, with the registry due and registration required from January 1, 2029

Latest legislative action

Sep 9, 2026. Chaptered by Secretary of State - Chapter 178, Statutes of 2026.

Sponsors (showing 5 of 43)

Roll call votes (showing 3 of 6)