CA AB 1405
California Assembly Bill 1405 - Artificial Intelligence Auditor Registry
Requires AI auditors to register with the Government Operations Agency and bars unregistered persons from offering, selling or conducting a covered AI audit from January 1, 2029. Registered auditors must maintain independence from the auditee, follow applicable audit protocols, report in detail, and keep records for at least 10 years. Certified public accountants licensed by the California Board of Accountancy are treated as satisfying the independence requirements if they comply with applicable professional standards.
Jurisdiction
California
Enacted
Sep 9, 2026
Effective
Jan 1, 2027
Enforcement
California Government Operations Agency, which investigates violations and refers matters to the Attorney General or other enforcement authorities; the California Board of Accountancy investigates licensed accountants and accounting firms
Approved by the Governor on September 9, 2026 and chaptered as Chapter 178, Statutes of 2026. Adds Chapter 5.9.5 (Sections 11549.80 to 11549.86) to Part 1 of Division 3 of Title 2 of the Government Code. No urgency clause, so the act takes effect January 1, 2027 under Article IV, Section 8(c) of the California Constitution, but the registry and the registration mandate both begin January 1, 2029. Obligated parties are AI auditors, a party type the obligated_parties taxonomy does not currently have a value for, so that field is left unset.
California Legislative Information: AB 1405, Chapter 178, Statutes of 2026 (chaptered text)Why It Matters
Turns AI auditing into a registered activity in California: from January 1, 2029 the person performing a statutory AI audit must themselves be on a state registry and meet codified independence rules. For an operator under a separate audit duty this narrows who can lawfully perform the work, and the accountancy carve-out signals that the Legislature expects established audit professions to do part of it.
Recent Developments
Signed September 9, 2026 as Chapter 178, Statutes of 2026, paired with SB 813 (Chapter 179), which creates a voluntary state designation for independent verification organizations. The January 1, 2029 registration mandate falls on the same date as the first biennial child safety audit that SB 1119 (Chapter 190) requires of companion chatbot operators, so operators commissioning that audit will need a registered auditor from the outset.
At a Glance
Requires
Who Must Comply
- Persons, firms and organizations that offer, sell or conduct covered AI audits for California purposes
Safety Provisions
- Mandatory registration with the Government Operations Agency to offer, sell or conduct a covered AI audit from January 1, 2029
- Registry entries must give business name and contact details, the California laws the auditor works to, certifications, a service description of 500 words or fewer, and standard operating procedures referencing applicable standards
- Auditor must maintain independence and may not audit where a financial, business, employment or other interest would reasonably be expected to impair independence or objectivity
- Auditor may not evaluate its own prior work for the auditee
- Auditor may not seek, solicit, negotiate for or accept employment with the auditee while participating in the audit
- Auditor may not assign individuals employed by the auditee in relevant roles within the preceding 12 months
- Registry information must be updated within 90 days of a change that materially affects its accuracy
- Records retained for at least 10 years
- Establishes the AI Auditors Registration Fund
Exemptions
Certified public accountants
Accountants licensed by the California Board of Accountancy are treated as satisfying the independence requirements where they comply with applicable professional standards
- • Licensed by the California Board of Accountancy
- • Compliance with applicable professional standards
Compliance & Enforcement
Key Dates
Jan 1, 2029
Government Operations Agency must have established the AI Auditor Registry and begins issuing unique registration numbers; from this date a person may not offer, sell or conduct a covered AI audit unless registered with the agency
Penalties
license revocation
View on map
California
Focus Areas
Cite This
APA
California. (2026). California Assembly Bill 1405 - Artificial Intelligence Auditor Registry.
Related Regulations
CA SB 813
Creates a voluntary state designation for independent verification organizations: AI auditors that the Government Operations Agency recognises as having demonstrated expertise in assessing the risks posed by an AI system or model. The agency must establish application requirements, designation criteria and suspension procedures on or before January 1, 2028, and designated organizations report annually to the Legislature. Engaging a designated organization is not mandatory for AI developers or deployers.
CA SB 1047
Would have required safety testing and "kill switch" capabilities for frontier AI models above certain compute thresholds. Governor vetoed citing concerns about threshold-based approach.
IL AI Employment Law
Amends Illinois Human Rights Act to make it a civil rights violation for employers to use AI that discriminates based on protected classes in employment decisions. Requires notice to employees and applicants when AI is used in hiring, firing, promotion, or discipline.
HI Deepfake Civil Remedy Act
Creates a civil cause of action allowing individuals to sue over realistic digital imitations (deepfakes) depicting them without consent, with statutory damages available.
ND Healthcare AI Act
Regulates AI use in healthcare prior authorization decisions. Requires adverse determinations be reviewed by licensed physicians qualified in relevant specialty. Sets decision timelines: 7 days for non-urgent, 72 hours for urgent services. Prohibits prior authorization for emergency services and opioid use disorder treatment.
TX Social Media Deepfake Takedown
Requires social media platforms to provide accessible complaint system for explicit deepfake material. Platform must confirm receipt within 48 hours, investigate within 30 days (60 days if delayed), and provide mandatory updates to reporting user.
Last updated September 13, 2026. Verify against primary sources before relying on this information.