Compliance SweepBack to stories →
← Back to stories

AB-1405 Artificial intelligence: auditors: registration

AB 1405’s enacted AI-auditor registry begins in 2029 and applies to defined third-party state-law compliance audits.

Illustrative artwork. Fictional scene, not a photograph of the people or events in this story.

What happened

California chaptered AB 1405 on September 9 as Chapter 178. The act requires the Government Operations Agency to establish an AI Auditor Registry by January 1, 2029 and prohibits offering, selling or conducting a covered AI audit without registration beginning that day. An AI auditor assesses a system or model on behalf of a third party, and a covered audit assesses controls, processes or systems necessary for compliance with state law. That definition does not make every internal model review or every voluntary technical evaluation a covered audit.

The framework includes registration information, material updates within 90 days, auditee reports describing results and limitations, and at least 10 years of supporting-record retention. It addresses independence, self-review, recent employment, competence and protection for employee reporting. Qualifying accountancy professionals and firms have specified professional-standard routes for report and independence requirements, rather than a blanket exemption from registration. Removal involves notice and an opportunity to cure or contest, with a separate accountancy complaint process. Registration must not be presented as state endorsement, and the law does not delay audits required by other authority before its dates.

Scope and timing

Authority status
Final
Applicability
Operationally relevant
Audience
Health systems, Provider networks, Health-tech
Jurisdiction
California
Recorded date
2029-01-01
Date type
compliance

Why it matters

Audit service providers and purchasers should assess the statutory third-party/state-law scope and independence requirements before the 2029 registry milestone.

Sources

Complete edition and supplemental material

This finding in the complete approved report →

Regulatory horizons, CIA trends and implementation trackers remain in the full report.

Read the entire Compliance Sweep report →

← Return to stories

Privacy preferences

Where enabled for this site, Cloudflare Web Analytics can send page-use and performance measurements to Cloudflare. This panel provides information and does not turn analytics on or off.

This panel stores no tracking choice and does not change your tool saves, screening, resets, reports or exports. Other sites have separate settings.

Read Privacy & Cookies