AB1405 - Artificial intelligence: auditors: registration.

Enrolled September 03, 2026 Passed IN Senate August 30, 2026 Passed IN Assembly August 30, 2026 Amended IN Senate August 25, 2026 Amended IN Senate July 09, 2025 Amended IN Assembly April 03, 2025 CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Assembly Bill No. 1405 Introduced by Assembly Member Bauer-Kahan (Coauthors: Senators McNerney, Rubio, and Wiener) February 21, 2025 An act to add Chapter 5.9.5 (commencing with Section 11549.80) to Part 1 of Division 3 of Title 2 of the Government Code, relating to artificial intelligence. LEGISLATIVE COUNSEL'S DIGEST AB 1405, Bauer-Kahan. Artificial intelligence: auditors: registration. Existing law establishes the Department of Technology within the Government Operations Agency. Existing law requires the department to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law generally regulates artificial intelligence, including the Transparency in Frontier Artificial Intelligence Act, which, among other things related to the safety of certain artificial intelligence models, requires a large frontier developer to write, implement, comply with, and clearly and conspicuously publish on its internet website a frontier AI framework that applies to the large frontier developer’s frontier models and describes how the large frontier developer approaches certain safety-related items. Existing law defines “artificial intelligence” as an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. This bill would require the Government Operations Agency to, no later than January 1, 2029, establish an AI Auditor Registry on the agency’s internet website allowing AI auditors to register with the agency and allowing natural persons to report misconduct by a registered AI auditor, and require the agency to fix annual registration fees, as specified. The bill would, commencing January 1, 2029, prohibit an unregistered person from offering, selling, or conducting a covered AI audit, as defined, and would require the agency to, among other things, issue a unique registration number to each registered AI auditor and publish information provided by a registered AI auditor on the agency’s internet website. The bill would require the registration number of a registered AI auditor to be clearly and conspicuously displayed on all advertising materials offering or soliciting covered AI audit services. The bill would authorize the agency to adopt regulations that are reasonably necessary to effectuate the purposes of the bill. This bill would require an AI auditor that registers with the agency to provide specified information to the agency and would impose various requirements on a registered AI auditor that conducts a covered AI audit, including, among other things, providing the auditee with a report that includes a signed and dated statement indicating that the audit was conducted according to the provisions of this bill. This bill would require a registered AI auditor to adhere to various standards of independence, objectivity, and integrity, including not seeking, soliciting, negotiating for, or accepting employment with an auditee while participating in the audit and not conducting a covered AI audit if the auditor has a financial, business, employment, or other interest or relationship that would reasonably be expected to impair the auditor’s independence or objectivity. The bill would prohibit a registered AI auditor from preventing an employee from engaging in, or from retaliating against an employee who has engaged in, specified whistleblower activity. The bill would authorize the agency to investigate alleged violations of the bill, as specified, and provide that a violation constitutes grounds for removal from the registry and referral to the Attorney General or other appropriate enforcement authority. This bill would create the AI Auditors’ Registration Fund within the State Treasury, to be administered by the agency, and would require that all moneys collected or received by the agency pursuant to the above-described provisions be deposited into the fund to be available, upon appropriation by the Legislature, to administer the above-described provisions. Existing law establishes the California Board of Accountancy, which is within the Department of Consumer Affairs, and requires the board to license and regulate accountants in this state. This bill would exempt a registered AI auditor licensed or authorized to practice public accountancy and a firm holding a permit to practice public accountancy issued by the California Board of Accountancy, as specified, from complying with certain requirements related to reporting information to the agency and standards of independence, objectivity, and integrity under the bill if certain requirements are met. The bill would require the Government Operations Agency to, if the agency determines that a certified public accountant, public accountant, or accounting firm in good standing has violated this bill, notify the accountant or firm and the California Board of Accountancy in writing, and would require the board to investigate the complaint and provide the agency with a report of its findings and any resulting action. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill Text The people of the State of California do enact as follows: SECTION 1. Chapter 5.9.5 (commencing with Section 11549.80) is added to Part 1 of Division 3 of Title 2 of the Government Code, to read: CHAPTER 5.9.5. Artificial Intelligence Auditors 11549.80. For purposes of this chapter, the following definitions apply: (a) “Agency” means the Government Operations Agency. (b) “Artificial intelligence” or “AI” means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. (c) “AI auditor” means a person, partnership, or corporation that assesses an AI system or model on behalf of a third party. (d) “Covered AI audit” means an audit conducted to assess internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law. 11549.81. The AI Auditors’ Registration Fund is hereby created within the State Treasury. The fund shall be administered by the Government Operations Agency. All moneys collected or received by the agency under this chapter shall be deposited into the AI Auditors’ Registration Fund to be available for expenditure by the agency, upon appropriation by the Legislature, to administer this chapter. 11549.82. (a) No later than January 1, 2029, the agency shall do all of the following: (1) Establish an AI Auditor Registry on the agency’s internet website allowing AI auditors to register with the agency. (2) Fix annual registration fees at an amount not exceeding the reasonable costs of administering this chapter. (3) Establish a mechanism on the agency’s internet website allowing natural persons to report misconduct by a registered AI auditor. (b) Beginning January 1, 2029, the agency shall do all of the following: (1) Issue a unique registration number to each registered AI auditor. (2) Publish all of the following information in a publicly accessible format on the agency’s internet website: (A) The registration number of each registered AI auditor. (B) Any registration information provided by the registered AI auditor pursuant to this chapter. (C) A statement prominently disclosing that registration by an AI auditor does not constitute recommendation or endorsement of that entity by the State of California. (3) Retain misconduct reports submitted using the mechanism established pursuant to subdivision (a) for as long as the relevant AI auditor remains registered, plus 10 years. (4) Share misconduct reports submitted using the mechanism established pursuant to subdivision (a) with other state agencies as necessary for enforcement purposes. (5) Periodically review and update, as necessary, the annual registration fees and reporting mechanism established pursuant to subdivision (a). 11549.82.5. Beginning January 1, 2029, a person shall not offer, sell, or conduct a covered AI audit unless the person is registered with the agency pursuant to this chapter. 11549.83. (a) An AI auditor that registers with the agency pursuant to this chapter shall provide the agency with all of the following information: (1) The business name of the AI auditor. (2) Business contact information for the AI auditor. (3) A list of California laws or regulations under which the AI auditor conducts covered AI audits. (4) Any relevant certifications or accreditations held by the AI auditor. (5) A written description of the AI auditor and the services they provide, not to exceed 500 words in length. (6) (A) A standard operating procedure that includes both of the following: (i) References to any standards the AI auditor applies when conducting audits, including, but not limited to, standards published by the International Organization for Standardization, the National Institute of Standards and Technology, national and international auditing and assurance standard-setters, professional accountancy bodies, or a governmental agency in this state. (ii) A description of the basis for any claims made by the AI auditor regarding the accuracy, reliability, or validity of its protocols. (B) An AI auditor that provides a standard operating procedure pursuant to this paragraph may make reasonable redactions for the purpose of protecting trade secrets, as that term is defined in Section 3426.1 of the Civil Code. (b) A registered AI auditor shall provide updated information to the agency within 90 days of making any change that materially affects the accuracy or completeness of information published by the agency. (c) A registered AI auditor shall conduct covered AI audits in accordance with widely recognized industry standards appropriate to the system or model being audited, to the extent appropriate standards are available. (d) (1) A registered AI auditor that conducts a covered AI audit shall provide the auditee with a report that includes, but is not limited to, all of the following information: (A) The scope and objectives of the audit. (B) The results of the audit and any documentation necessary to demonstrate the basis of those results. (C) For each deficiency identified in the audit, a description of any technical, operational, or governance measures the AI auditor determines would reasonably address the deficiency, if appropriate. (D) A description of whether the auditee has implemented and adhered to internal safety standards and protocols that are within the scope of the covered AI audit. (E) A description of the limitations of the audit, including any matters within the scope of the audit that were not assessed and any material gaps in the evidence, information, systems, or access available to the AI auditor. (F) A statement indicating that the audit was conducted in accordance with the requirements of this chapter, signed and dated by the AI auditor. (2) A registered AI auditor holding a current and valid license issued by the California Board of Accountancy, or authorized to practice public accountancy pursuant to Article 5.1 (commencing with Section 5096) of Chapter 1 of Division 3 of the Business and Professions Code, and a firm holding a current and valid permit to practice public accountancy issued by the California Board of Accountancy, including the firm’s partners, shareholders, owners, and employees acting within the scope of that license or permit, shall be deemed to satisfy the requirements of paragraph (1) when issuing a report pursuant to this chapter, provided both of the following apply: (A) The report addresses the subject matter required by this chapter. (B) The AI auditor complies with all applicable professional standards, including the following: (i) Chapter 1 (commencing with Section 5000) of Division 3 of the Business and Professions Code, known as the California Accountancy Act, and regulations promulgated thereunder. (ii) The American Institute of Certified Public Accountants (AICPA) Code of Professional Conduct and its requirements relating to integrity, objectivity, independence, professional competence, due care, and the public interest. (iii) The attestation standards promulgated by the AICPA, as applicable to engagements performed under this chapter. (e) A registered AI auditor shall retain all of the following information for at least 10 years: (1) Any information provided to an auditee pursuant to this chapter. (2) Any documentation necessary to demonstrate the basis of the results of a covered AI audit. (f) (1) Except as provided by paragraph (2), a registered AI auditor shall adhere to all of the following standards of independence, objectivity, and integrity: (A) A registered AI auditor shall maintain independence from the auditee and shall not conduct a covered AI audit if the auditor has a financial, business, employment, or other interest or relationship that would reasonably be expected to impair the auditor’s independence or objectivity. Reasonable compensation received for performing a covered AI audit shall not, by itself, constitute an interest prohibited by this subparagraph. (B) A registered AI auditor shall not conduct a covered AI audit that requires the auditor to evaluate the auditor’s own work, including a system, process, control, assessment, or other subject matter that the auditor materially designed, developed, implemented, or operated for the auditee. (C) An individual conducting a covered AI audit shall not seek, solicit, negotiate for, or accept employment with the auditee while participating in the audit. (D) A registered AI auditor shall not assign an individual to perform a covered AI audit of an auditee if, during the preceding 12 months, the individual was employed by the auditee in a position involving material responsibility for, or material participation in, the subject matter of the audit. (E) A registered AI auditor shall exercise independent, objective, and impartial professional judgment in planning and conducting a covered AI audit and in preparing and reporting its findings and conclusions. (F) A registered AI auditor shall ensure that the individuals assigned to perform a covered AI audit collectively possess the knowledge, skills, and abilities necessary to competently perform the audit, including any specialized expertise necessary for the subject matter [Text truncated for display. Full text available on Congress.gov.]