California Starts Regulating the People Who Audit AI

Governor Gavin Newsom signed legislation on September 9, 2023, to regulate the independent auditors responsible for examining artificial intelligence systems in California. This marked the first framework of its kind in the nation. A day later, he signed a companion bill requiring independent audits for chatbot operators as part of the product safety process.

These laws aim to transform AI auditing into a regulated profession with specific standards for competence, independence, and evidence. The California Government Operations Agency will establish criteria for independent verification organizations by January 1, 2028, based on qualifications, methodologies, and conflict-of-interest management.

Auditors may receive reasonable payment but cannot let compensation influence findings. They must remain independent from the company being assessed and control their conclusions. The California Government Operations Agency will also create an online AI Auditor Registry by January 1, 2029, and require audited companies to disclose reports detailing the audit's scope, findings, deficiencies, and remedies.

Auditors must disclose any gaps in evidence and are prohibited from auditing systems or processes they designed or operated in the past year. SB 1119, known as Adam's Law, requires operators to conduct child-safety risk assessments for new or substantially modified companion chatbots starting July 1, 2027. Audits will be required every two years, and violations can lead to removal from the registry and legal consequences.

This California model could influence financial institutions and other regulated sectors in AI auditing requirements.