California mandates third-party audits for AI models

For years, AI developers have essentially been grading their own homework. Whenever a frontier model dropped, we got a polished safety report written by the very team trying to sell it to us.

California just pulled that red pen away. On September 9, Governor Gavin Newsom signed two first-in-the-nation bills, Senate Bill 813 and Assembly Bill 1405, creating an official legal framework for independent, third-party AI audits.

Ending the era of self-certification

The two bills target both the testing framework and the inspectors who will carry it out.

SB 813, authored by Senator Jerry McNerney, establishes a framework for independent verification organizations to test AI systems and models for compliance with state laws. McNerney pointed out that frontier systems paired with autonomous agents now present concrete threats, and California decided to move because Washington has been dragging its feet.

AB 1405, authored by Assemblymember Rebecca Bauer-Kahan, tackles the auditors themselves. The bill creates a state registry for AI auditors while laying down strict standards for independence, integrity, and transparency. As Bauer-Kahan put it, the public cannot trust tech giants to police themselves, and communities need certified third parties verifying bold marketing claims before tools deploy into critical infrastructure.

This is not a standalone move. California has steadily built this fence: from regulating state procurement in 2023, to tackling deepfakes in 2024, to passing the landmark frontier AI transparency bill SB 53 in 2025, and launching a dedicated AI cyber defense unit just last month.

Why it matters

We think this is one of the smartest regulatory moves California has made yet, because it targets structure rather than micromanaging code.

For AI labs and enterprise teams, the era of self-certified safety cards is coming to an end. If you want to do business across California or sell into sensitive public and private infrastructure, preparing for accredited external audits will soon become a mandatory line item. It will add friction and real compliance costs, but it also creates an entirely new professional services ecosystem around algorithmic auditing.

For everyday users, this builds guardrails where they actually matter. As autonomous agents take over workflows in healthcare, finance, and municipal grids, having independent experts inspect systems for catastrophic failure modes protects the public from black-box drift.

The real risk lies in execution. The AI community still lacks consensus on what objective safety benchmarks even look like. If California sets standards that are too rigid, smaller startups will simply incorporate elsewhere; if standards become too vague, audits risk degenerating into corporate rubber-stamping. Still, taking away the industry's self-grading privilege is a necessary shift.