Law / United States / 
California
AI Auditor Registry Act (AB 1405)New, enacted
Cal. Gov. Code Sections 11549.80 to 11549.86 (AB 1405, Ch. 178, Stats. 2026)
An AI governance rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- Licensing, Retention, Disclosure
- Audit expectation
- none
- Who audits it
- Registered or designated auditor
- Where the report goes
- Kept
What it requires
- This chapter binds AI auditors (anyone who assesses an AI system or model on behalf of a third party), not the developer or deployer of the AI system being assessed, unless that developer or deployer also offers covered AI audits to others.
- If you offer, sell, or conduct a covered AI audit, an audit assessing internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with California law, register with the Government Operations Agency before doing so, starting .
- If you register as an AI auditor, give the agency your business name, contact information, the California laws or regulations you audit under, relevant certifications, a description of your services, and a standard operating procedure describing the standards you apply and the basis for your accuracy and reliability claims.
- If you are a registered AI auditor, update that information with the agency within 90 days of any change that materially affects its accuracy or completeness.
- If you are a registered AI auditor, do not conduct a covered AI audit of a system, process, control, assessment, or other subject matter you materially designed, developed, implemented, or operated for the auditee, and otherwise maintain independence, objectivity, and competence throughout the audit.
- If you are a registered AI auditor conducting a covered AI audit, give the auditee a report covering the audit's scope and objectives, its results and supporting documentation, each deficiency found and how it could reasonably be addressed, whether the auditee followed its own internal safety standards and protocols within the audit's scope, the audit's limitations, and a signed and dated statement that the audit met this chapter's requirements.
- If you are a registered AI auditor, retain the information you gave the auditee and the documentation behind your audit results for at least 10 years.
- If you are a registered AI auditor, display your registration number clearly and conspicuously on advertising for your audit services, and do not retaliate against an employee who reports suspected noncompliance to the Attorney General, the Labor Commissioner, or the agency.
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Government Operations Agency, which may investigate a reported violation and remove a registered AI auditor from the registry, referring most violations to the Attorney General or other appropriate enforcement authority; a violation by a CPA, public accountant, or accounting firm is referred instead to the California Board of Accountancy for investigation.
What it makes you log
Who may demand the log
Counterparty, Regulator
What the log must hold
Decision basis
Log retention
Gov. Code section 11549.83(e)'s ten-year floor is the registered AI auditor's own retention duty for what it gave the auditee and the documentation behind its audit results. The agency's separate retention of a misconduct report it receives under section 11549.82(b)(3) runs for as long as the auditor stays registered, plus ten years, a different, registration-length-linked period not represented in the minimum value above.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 10
Logging duty
A registered AI auditor conducting a covered AI audit must give the auditee a report covering the audit's scope, results, deficiencies, and a signed compliance statement, and must retain the information given to the auditee and the documentation behind its results. Section 11549.83 never uses the words log, record, event recording, or audit trail; it uses report and documentation necessary to demonstrate the basis of the results, the implicit category's own verb.
- Kind
- Implicit
- As of
- Provision
- Section 11549.83
What this law does
This chapter regulates AI auditors, meaning any person, partnership, or corporation that assesses an AI system or model on behalf of a third party, and does not impose duties on the AI system's own developer or deployer unless that developer or deployer also offers covered AI audit services to others.
Beginning , a person may not offer, sell, or conduct a covered AI audit (an audit assessing internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law) unless registered with the Government Operations Agency, which must itself establish the AI Auditor Registry, fix registration fees, and stand up a misconduct-reporting mechanism no later than that same date.
An auditor who registers must give the agency its business name and contact information, a list of the California laws or regulations it audits under, any relevant certifications, a description of its services, and a standard operating procedure describing the standards it applies and the basis for its accuracy and reliability claims; the agency then publishes that registration information, including the list of laws audited under, on its own website.
A registered auditor may not conduct a covered AI audit of a system, process, control, assessment, or other subject matter it materially designed, developed, implemented, or operated for the auditee, and must otherwise maintain independence, objectivity, and competence throughout the engagement.
For each covered audit, the auditor must give the auditee a report covering the audit's scope and objectives, its results and the documentation behind them, each deficiency found and what could reasonably address it, whether the auditee followed its own internal safety standards and protocols within the audit's scope, the audit's limitations and any material gaps in the evidence available, and a signed and dated statement that the audit met this chapter's requirements.
The auditor must retain the information it gave the auditee and the documentation behind its results for at least 10 years, display its registration number on advertising for its audit services, and may not retaliate against an employee who reports suspected noncompliance.
A licensed CPA or accounting firm performing the audit under applicable AICPA and California Board of Accountancy standards is deemed to satisfy the reporting and independence requirements without separately meeting every listed element, and a violation by such an accountant is referred to the California Board of Accountancy rather than handled solely by the agency.
When LexLint raises it
When your app profile says your app trains models or generates content with AI.
Back to the example · Lint your app
Page updated .