On Sept. 9, Gov. Gavin Newsom signed SB 813 and AB 1405, establishing what the governor’s office calls the nation’s first framework for independent AI verification organizations and a state registry of AI auditors. A day later, he signed SB 1119, known as Adam’s Law, layering an independent child-safety audit obligation onto any operator running a companion chatbot.

Read together, the three bills quietly do something bigger than the frontier-lab press coverage suggests: they build a certified-auditor pipeline that reaches down to any business deploying AI in ways that materially affect people.

The mechanics matter. SB 813 directs the California Government Operations Agency to set criteria for independent verification organizations by Jan. 1, 2028. AB 1405 stands up the online AI Auditor Registry by Jan. 1, 2029. After that date, per PYMNTS, an unregistered auditor generally can’t conduct an AI audit required to assess compliance with state law. Auditors may accept payment from the audited company, but compensation can’t depend on findings, and they can’t evaluate systems they materially designed. Gaps in access or documentation must be recorded.

Adam’s Law tightens the loop for chatbots. Beginning July 1, 2027, companion-chatbot operators must document child-safety risk assessments; the initial independent audit is due Jan. 1, 2029, with the lead auditor certifying under penalty of perjury. Anthropic endorsed SB 813 and AB 1405 in August, a signal that at least one frontier lab prefers legible state rules to the alternative.

For a 5-to-30-person shop using AI for lead screening, pricing, or a customer-facing bot, the practical read is that Adam’s Law and the chatbot risk-assessment mandate now has a statutory audit hook, and that Texas TRAIGA’s complaint portal reaching AI sales tools is no longer an outlier. The 2027 rulemaking on IVO criteria will decide how far down the SMB stack the audit obligation actually reaches.

Sources

Sources