California Independent Verification Organizations Act (SB 813)

Applies To

Overview

Governor Newsom approved SB 813 on 9 September 2026 as Chapter 179, Statutes of 2026. As a regular statute it takes effect on 1 January 2027. The law lets the Government Operations Agency designate independent verification organizations (IVOs). An IVO is an AI auditor the agency designates as having shown expertise in assessing the risks of an AI system or model. By 1 January 2028 the agency must set application requirements, designation procedures, and criteria. These cover technical expertise, assessment methods, conflicts of interest, and independence from the party being assessed. An August 2026 amendment removed a proposed AI Standards and Safety Commission before passage. The law does not require any business to use an IVO or undergo an AI audit. Failing to meet a standard developed under it does not, by itself, create liability. Designated IVOs must report each year to the agency and the Legislature. The agency must convene working groups and report their findings to the Legislature. Anthropic backed the bill publicly in August 2026, and OpenAI added its support hours before Newsom signed it.

Key Requirements

• •The Government Operations Agency designates independent verification organizations (IVOs), meaning approved AI auditors.
• •By 1 January 2028 the agency must set application requirements, procedures, and designation criteria.
• •Criteria cover technical expertise, assessment methods, conflicts of interest, and independence.
• •Using an IVO is voluntary, and no business must undergo an AI audit.
• •Failing to meet a standard under the law does not, by itself, create liability.
• •Designated IVOs report annually to the agency and the Legislature.

What Your Organization Must Do

• →Track the Government Operations Agency's designation criteria, which are due by 1 January 2028.
• →Treat use of an independent verification organization, meaning an approved AI auditor, as voluntary.
• →Avoid telling the business that SB 813 creates any audit duty or penalty exposure.
• →Review your outside AI audit plans, and consider designated auditors once the list exists.
• →Record that using a designated auditor shows good faith but creates no formal safe harbor.
• →Compare any voluntary audit scope against EU AI Act conformity assessment duties if you operate in the EU.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

Does SB 813 require companies to use an AI auditor?

No, the law does not require any business to engage an IVO or undergo an AI audit. It sets up a voluntary system for designating AI auditors.

When does the Government Operations Agency have to finalize IVO designation requirements under SB 813?

By 1 January 2028 the agency must set application requirements, designation procedures, and criteria for IVOs. The law itself takes effect on 1 January 2027.

What independence and conflict of interest requirements must an IVO satisfy to be designated?

The agency sets criteria covering technical expertise, assessment methods, conflicts of interest, and independence from the party being assessed. The statute leaves detailed thresholds to the agency.

Does hiring an IVO under SB 813 create a safe harbor from California AI enforcement?

Using an IVO can document a good-faith effort to assess risk, but the law creates no formal safe harbor. Legal exposure still depends on the substantive laws that apply.

How does SB 813 compare to the EU AI Act's conformity assessment requirements?

The EU AI Act requires conformity assessments for high-risk AI systems, sometimes by notified bodies. SB 813 requires nothing of AI developers or deployers; it only sets up voluntary state designation of AI auditors.

What practical steps should compliance teams take now under SB 813?

Track the agency's designation criteria, due by 1 January 2028. If you plan to use outside AI audits, consider designated IVOs once they exist.