AB1405 - Artificial intelligence: auditors: registration.

Amended IN Senate August 25, 2026 Amended IN Senate July 09, 2025 Amended IN Assembly April 03, 2025 CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION Assembly Bill No. 1405 Introduced by Assembly Member Bauer-Kahan (Coauthor: Senator (Coauthors: Senators McNerney, Rubio, and Wiener) February 21, 2025 An act to add Chapter 5.9.5 (commencing with Section 11549.80) to Part 1 of Division 3 of Title 2 of, and to repeal Section 11549.86 of, of the Government Code, relating to artificial intelligence. LEGISLATIVE COUNSEL'S DIGEST AB 1405, as amended, Bauer-Kahan. Artificial intelligence: auditors: enrollment. registration. Existing law establishes the Department of Technology within the Government Operations Agency. Existing law requires the department to conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency. Existing law defines “automated decision system” as a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons. generally regulates artificial intelligence, including the Transparency in Frontier Artificial Intelligence Act, which, among other things related to the safety of certain artificial intelligence models, requires a large frontier developer to write, implement, comply with, and clearly and conspicuously publish on its internet website a frontier AI framework that applies to the large frontier developer’s frontier models and describes how the large frontier developer approaches certain safety-related items. Existing law defines “artificial intelligence” as an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. This bill would require the Government Operations Agency, by Agency to, no later than January 1, 2027, to 2029, establish a mechanism an AI Auditor Registry on the agency’s internet website allowing AI auditors to enroll register with the agency and allowing natural persons to report misconduct by an enrolled AI auditor. a registered AI auditor, and require the agency to fix annual registration fees, as specified. The bill would require the agency, would, commencing January 1, 2027, to 2029, prohibit an unregistered person from offering, selling, or conducting a covered AI audit, as defined, and would require the agency to, among other things, issue a unique registration number to each registered AI auditor and publish information provided by an enrolled a registered AI auditor on the agency’s internet website, retain specified reports for as long as the auditor remains enrolled, plus 10 years, and share reports submitted by persons reporting misconduct with other state agencies as necessary for enforcement purposes. website. The bill would require the registration number of a registered AI auditor to be clearly and conspicuously displayed on all advertising materials offering or soliciting covered AI audit services. The bill would authorize the agency to adopt regulations that are reasonably necessary to effectuate the purposes of the bill. This bill would, commencing January 1, 2027, would require an AI auditor, prior to initially conducting a covered audit, as defined, to enroll with the agency. The bill would require an AI auditor that enrolls with the agency to pay an enrollment fee, to be fixed by the agency by January 1, 2027, and auditor that registers with the agency to provide specified information. The bill information to the agency and would impose various requirements on an a registered AI auditor that conducts a covered AI audit, including, among other things, providing the auditee with an audit report after the covered audit. a report that includes a signed and dated statement indicating that the audit was conducted according to the provisions of this bill. This bill would prohibit the require a registered AI auditor from to adhere to various standards of independence, objectivity, and integrity, including not seeking, soliciting, negotiating for, or accepting employment with an auditee within 12 months of completing a covered audit of the auditee, while participating in the audit and not conducting a covered AI audit if the auditee had employed the auditor during the 12-month period preceding the audit, disclosing confidential information except under certain circumstances, and auditor has a financial, business, employment, or other interest or relationship that would reasonably be expected to impair the auditor’s independence or objectivity. The bill would prohibit a registered AI auditor from preventing an employee from engaging in, or from retaliating against an employee who has engaged in, specified whistleblower activity. The bill would authorize the agency to investigate alleged violations of the bill, as specified, and provide that a violation constitutes grounds for removal from the registry and referral to the Attorney General or other appropriate enforcement authority. This bill would create the AI Auditors’ Enrollment Registration Fund within the State Treasury, to be administered by the agency, and would require that all moneys collected or received by the agency pursuant to the above-described provisions be deposited into the fund to be available, upon appropriation by the Legislature, to administer the above-described provisions. Existing law establishes the California Board of Accountancy, which is within the Department of Consumer Affairs, and requires the board to license and regulate accountants in this state. This bill would exempt a registered AI auditor licensed or authorized to practice public accountancy and a firm holding a permit to practice public accountancy issued by the California Board of Accountancy, as specified, from complying with certain requirements related to reporting information to the agency and standards of independence, objectivity, and integrity under the bill if certain requirements are met. The bill would require the Government Operations Agency to, if the agency determines that a certified public accountant, public accountant, or accounting firm in good standing has violated this bill, notify the accountant or firm and the California Board of Accountancy in writing, and would require the board to investigate the complaint and provide the agency with a report of its findings and any resulting action. Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill Text The people of the State of California do enact as follows: SECTION 1. Chapter 5.9.5 (commencing with Section 11549.80) is added to Part 1 of Division 3 of Title 2 of the Government Code, to read: CHAPTER 5.9.5. Artificial Intelligence Auditors 11549.80. For purposes of this chapter, the following definitions apply: (a) “Agency” means the Government Operations Agency. (b) “Artificial intelligence” or “AI” means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. (c) “Artificial intelligence auditor” or “AI auditor” means a person, partnership, or corporation that assesses an AI system or model on behalf of a third party. (d) “Covered AI audit” means an audit conducted pursuant to any state statute that requires an audit of an AI system or model by an independent third party auditor. to assess internal controls, processes, or systems implemented for an AI system or model that are necessary for compliance with state law . 11549.81. The AI Auditors’ Enrollment Registration Fund is hereby created within the State Treasury. The fund shall be administered by the Government Operations Agency. All moneys collected or received by the agency under this chapter shall be deposited into the AI Auditors’ Enrollment Registration Fund to be available for expenditure by the agency, upon appropriation by the Legislature, to administer this chapter. 11549.82. (a) By No later than January 1, 2027, 2029, the agency shall do all of the following: (1) Establish a mechanism an AI Auditor Registry on the agency’s internet website allowing AI auditors to enroll register with the agency pursuant to subdivision (a) of Section 11549.83. agency. (2) Fix enrollment annual registration fees at an amount not exceeding the reasonable costs of administering this chapter. (3) Establish a mechanism on the agency’s internet website allowing natural persons to report misconduct by an enrolled a registered AI auditor. (b) Beginning January 1, 2027, 2029, the agency shall do all of the following: (1) Issue a unique registration number to each registered AI auditor. (1) (2) Publish any all of the following information provided by an enrolled AI auditor pursuant to subdivision (a) of Section 11549.83 in a publicly accessible format on the agency’s internet website. website: (A) The registration number of each registered AI auditor. (B) Any registration information provided by the registered AI auditor pursuant to this chapter. (C) A statement prominently disclosing that registration by an AI auditor does not constitute recommendation or endorsement of that entity by the State of California. (2) (3) Retain any report misconduct reports submitted using the mechanism established pursuant to paragraph (3) of subdivision (a) for as long as the enrolled relevant AI auditor remains enrolled, registered, plus 10 years. (3) (4) Share misconduct reports submitted using the mechanism established pursuant to paragraph (3) of subdivision (a) with other state agencies as necessary for enforcement purposes. (5) Periodically review and update, as necessary, the annual registration fees and reporting mechanism established pursuant to subdivision (a). 11549.82.5. Beginning January 1, 2029, a person shall not offer, sell, or conduct a covered AI audit unless the person is registered with the agency pursuant to this chapter. 11549.83. (a) Beginning January 1, 2027, prior to initially conducting a covered audit, an AI auditor shall do all of the following: (1) Enroll with the agency using the mechanism established pursuant to paragraph (1) of subdivision (a) of Section 11549.82. (2) Pay to the agency the enrollment fee set forth in paragraph (2) of subdivision (a) of Section 11549.82. (3) Provide to 11549.83. (a) An AI auditor that registers with the agency pursuant to this chapter shall provide the agency with all of the following information: (A) (1) The legal business name of the AI auditor. (B) All of the following contact information: (i) The primary physical address of the auditor, if applicable. (ii) The primary internet website of the auditor, if applicable. (iii) A telephone number enabling a natural person to communicate with the auditor. (iv) An email address enabling a natural person to communicate with the auditor. (C) The types of AI systems or models that the auditor is enrolling to audit. (2) Business contact information for the AI auditor. (3) A list of California laws or regulations under which the AI auditor conducts covered AI audits. (D) (4) Any relevant certifications or accreditations held by the AI auditor, and the names of the certifying or accrediting entities. auditor. (E) (5) A written description of the AI auditor and the services they provide, not to exceed 200 500 words in length. (F) A (6) (A) A standard operating procedure that does includes both of the following: (i) Describes the auditor’s protocols in sufficient detail to enable a third party to assess whether audits are conducted according to widely recognized industry standards appropriate to the system or model being audited. (i) References to any standards the AI auditor applies when conducting audits, including, but not limited to, standards published by the International Organization for Standardization, the National Institute of Standards and Technology, national and international auditing and assurance standard-setters, professional accountancy bodies, or a governmental agency in this state. (ii) Includes documentation substantiating A description of the basis for any claims made by the AI auditor regarding the accuracy, reliability, or validity of its protocols. (B) An AI auditor that provides a standard operating procedure pursuant to this paragraph may make reasonable redactions for the purpose of protecting trade secrets, as that term is defined in Section 3426.1 of the Civil Code. (b) A registered AI auditor shall provide updated information to the agency within 90 days of making any change that materially affects the accuracy or completeness of information published by the agency. (b) In conducting a covered audit, an enrolled AI auditor shall abide by (c) A registered AI auditor shall conduct covered AI audits in accordance with widely recognized industry standards appropriate to the system or model being audited. audited, to the extent appropriate standards are available. (d) (1) A registered AI auditor that conducts a covered AI audit shall provide the auditee with a report that includes, but is not limited to, all of the following information: (A) The scope and objectives of the audit. (B) The results of the audit and any documentation necessary to demonstrate the basis of those results. (C) For each deficiency identified in the audit, a description of any technical, operational, or governance measures the AI auditor determines would reasonably address the deficiency, if appropriate. (D) A description of whether the auditee has implemented and adhered to internal safety standards and protocols that are within the scope of the covered AI audit. (E) A description of the limitations of the audit, including any matters within the scope of the audit that were not assessed and any material gaps in the evidence, information, systems, or access available to the AI auditor. (F) A statement indicating that the audit was conducted in accordance with the requirements of this chapter, signed and dated by the AI auditor. (2) A registered AI auditor holding a current and valid license issued by the California Board of Accountancy, or authorized to practice public accountancy pursuant to Article 5.1 (commencing with Section 5096) of Chapter 1 of Division 3 of the Business and Professions Code, and a firm holding a current and valid permit to practice public accountancy issued by the California Board of Accountancy, including the firm’s partners, shareholders, owners, and employees acting within the s [Text truncated for display. Full text available on Congress.gov.]