Compliance SweepBack to stories →
← Back to stories

AB-1405 Artificial intelligence: auditors: registration

AB 1405 creates a California registry for auditors of AI controls required by state law, with registration required to offer, sell or conduct covered audits beginning January 1, 2029.

Illustrative artwork. Fictional scene, not a photograph of the people or events in this story.

What happened

California chaptered AB 1405 on September 9, 2026, establishing an AI Auditor Registry administered by the Government Operations Agency. The agency must establish the registry, annual fees limited to reasonable administrative costs, and a public misconduct-reporting mechanism by January 1, 2029. Beginning that date, a person may not offer, sell or conduct a covered AI audit without registration. The definition covers audits of AI controls, processes or systems necessary for compliance with state law; it does not make every assessment of an AI product a covered audit. Registration numbers must appear conspicuously in advertising for covered audit services, and the public registry must state that registration is not a state recommendation or endorsement.

Registered auditors must disclose their services, applicable laws, qualifications and operating procedures, update material registration information within 90 days, and retain audit reports and supporting documentation for at least 10 years. Reports must explain scope, findings, supporting evidence, limitations and appropriate measures to address deficiencies, with a signed compliance statement. Independence safeguards address financial conflicts, reviewing one's own work, employment negotiations during an audit and specified recent employment with the auditee. Qualified accountants and accounting firms can satisfy specified report and independence requirements through the stated professional standards; they are not categorically exempt from registration. The law also protects employee reporting of suspected violations and permits investigation, removal from the registry and enforcement referrals, subject to notice and an opportunity to cure or contest removal.

Scope and timing

Authority status
Final
Applicability
Operationally relevant
Audience
Health systems, Provider networks, Health-tech
Jurisdiction
California
Recorded date
2029-01-01
Date type
compliance

Why it matters

Organizations procuring legally required AI audits need to distinguish registration from endorsement and evaluate the auditor's scope, independence and evidence retention. Firms providing covered audits have a specific January 2029 registration horizon.

Sources

Complete edition and supplemental material

This finding in the complete approved report →

Regulatory horizons, CIA trends and implementation trackers remain in the full report.

Read the entire Compliance Sweep report →

← Return to stories

Privacy preferences

Where enabled for this site, Cloudflare Web Analytics can send page-use and performance measurements to Cloudflare. This panel provides information and does not turn analytics on or off.

This panel stores no tracking choice and does not change your tool saves, screening, resets, reports or exports. Other sites have separate settings.

Read Privacy & Cookies