External AI Audits Cannot Stand Alone, California Frameworks Show
What happened
The commentary, published November 7, 2026, by Maria Dinzeo and Amy Miller in Independent audits promise oversight, but not certainty about AI safety (MLex via Law360), examines California's proposed mandatory independent AI audit regimes. These include California AB 1405 and California SB 813, both of which take effect in 2027. The authors argue that evaluation science has not caught up with regulatory ambition. Existing methods for testing frontier AI models cannot consistently detect unsafe behaviors. They also cannot confirm that a model will behave safely after deployment. External auditors can verify process adherence and document findings, but they cannot guarantee outcomes. The practical implication is that enterprises and regulators risk over-indexing on audit reports as proof of safety. Those reports reflect only what evaluators could measure at a point in time.
Why it matters
- ·California's California AB 1405 and California SB 813 create mandatory audit obligations from 2027. Organizations that treat a completed audit as full compliance discharge may face enforcement exposure. That risk applies when harms occur after a clean audit report.
- ·The commentary reinforces findings from Embedded Assessments Paper Exposes Audit Independence Problem in Frontier AI, which flagged structural independence limits in frontier AI evaluations. Compliance teams cannot assume that audit independence alone resolves the measurement problem the commentary identifies.
- ·Residual risk acceptance and ongoing monitoring are the gap. Boards and risk committees that approve AI deployments based solely on audit reports face an undocumented accountability gap. Failing to also approve a residual-risk statement and a continuous monitoring plan is a gap regulators and plaintiffs can exploit.
Stay ahead of stories like this
Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Review every AI system that has received an external audit report and confirm that internal monitoring, incident response, and residual-risk documentation exist alongside it, not in place of it.
- ☐Ask your AI governance committee whether board-level approval of high-risk AI deployments includes a formal residual-risk statement that explicitly acknowledges what the audit could not confirm.
- ☐Map your current California compliance posture to both AB 1405 and SB 813 before their 2027 effective dates, and identify which systems will require registered auditors and independent verification.
- ☐Confirm that your post-audit monitoring program captures behavioral changes that occur after an assessment, such as model updates, prompt changes, or new use cases added by business units.
- ☐Prepare talking points for your board and audit committee that explain why a clean external audit report does not eliminate ongoing AI governance obligations, using this commentary as a named reference.
What to watch next
Watch for the California Attorney General and the agencies responsible for implementing California AB 1405 and California SB 813 to issue guidance on auditor registration and independent verification requirements. That guidance may address whether auditors must attest to evaluation method adequacy. The Commerce Department Evaluation of State AI Laws may also affect how California's frameworks interact with any federal preemption or coordination effort. If the 2026 midterm shift produces federal frontier AI legislation by early 2027, audit standards set at the federal level could either complement or complicate California's regime.