Not sure where to start? Answer 3 questions and get a tailored compliance action plan.
What applies to me? →California AI Auditor Registration Act (AB 1405)
Issued by
State of California
AB 1405 creates California's first state registry for AI auditors, the professionals and firms hired to independently review AI systems. Auditors must enroll with a new state agency, disclose their credentials and methods, and follow recognized independence standards before they can conduct a covered audit. Starting January 1, 2029, only registered auditors will be allowed to perform these audits in California.
Applies To
Overview
AB 1405 requires any person conducting a covered AI audit in California to register with the state starting January 1, 2027. Enrollment requires disclosing credentials, methods, and any conflicts of interest, and adhering to independence standards set by the agency. From January 1, 2029, performing a covered audit without a state registration number becomes unlawful. The agency will publish registrant information, issue a unique registration number to each auditor, and retain audit reports for as long as the auditor stays enrolled, plus 10 years. It can also share misconduct reports with other state agencies for enforcement purposes. The bill pairs with SB 813 to give California both a certified-verifier system and a registered-auditor system for AI compliance work.
Key Requirements
- •Requires AI auditors to enroll with the state before conducting any covered AI audit, starting January 1, 2027.
- •Bars anyone without a state registration number from performing a covered AI audit starting January 1, 2029.
- •Requires enrolled auditors to disclose credentials, methodology, and conflicts of interest, and to remain independent of the companies they audit.
- •Directs the agency to issue a unique registration number to each auditor and publish registrant information.
- •Requires audit reports to be retained for as long as the auditor is enrolled, plus 10 years.
- •Allows the agency to share reports of auditor misconduct with other state agencies for enforcement.
What Your Organization Must Do
- →Confirm whether any AI audits your organization commissions or performs would count as a covered audit under the new definition.
- →Verify a prospective AI auditor's state registration number before engaging them, once the registry opens in 2027.
- →Require AI audit vendors to disclose their methodology and conflicts of interest as a condition of engagement.
- →Preserve audit reports and supporting records for the full retention period the law requires.
- →Watch for the agency's implementing regulations, which will define exactly what counts as a covered AI audit.
Playbook Guidance
Step-by-step implementation guidance for compliance teams.
Frequently Asked Questions
- When do AI auditors need to register under California AB 1405?
- Registration opens January 1, 2027, and auditors must enroll before conducting any covered AI audit from that date forward. The harder deadline is January 1, 2029, when performing a covered audit without a valid state registration number becomes unlawful.
- What information must an AI auditor disclose to enroll in the California AB 1405 registry?
- Applicants must disclose their credentials, auditing methodology, and any conflicts of interest with the companies they audit. Enrolled auditors must also maintain independence from the organizations whose AI systems they review, consistent with standards the agency sets.
- How long must AI audit reports be retained under AB 1405?
- Audit reports must be retained for the entire period the auditor remains enrolled in the registry, plus an additional 10 years after enrollment ends. Organizations commissioning audits should align their own recordkeeping policies with this requirement when contracting with auditors.
- How does AB 1405 differ from California SB 813?
- AB 1405 creates a state registry for independent AI auditors, focusing on who is qualified to conduct covered audits. SB 813 complements it by establishing a certified-verifier system, giving California parallel regulatory tracks for AI compliance oversight.
- What are the penalties for performing a covered AI audit in California without registration after 2029?
- AB 1405 makes conducting a covered audit without a state registration number unlawful starting January 1, 2029. The agency can also share misconduct reports with other state agencies, which may trigger additional enforcement actions beyond the bill's own penalties.
- How should companies verify that an AI auditor they hire is compliant with AB 1405?
- Once the registry opens in 2027, the agency will publish registrant information and issue each auditor a unique registration number. Before engaging an auditor, compliance teams should confirm their current registration number against the public registry and require written disclosure of methodology and conflicts of interest.