Artificial intelligence: auditors: registration

The law creates public oversight and baseline conduct rules for firms and people selling AI compliance audits. It also gives audit clients reports documenting findings, limits, and recommended fixes.

What the law does ​

• Requires the Government Operations Agency to create a public AI Auditor Registry, set cost-based annual fees, issue registration numbers, and accept misconduct reports.
• Bars unregistered people or businesses from offering, selling, or conducting covered AI audits.
• Requires registrants to disclose their services, relevant laws, credentials, audit methods, and the basis for claims about their protocols, subject to trade-secret redactions.
• Requires audits to follow available recognized industry standards and requires written, signed audit reports covering scope, results, deficiencies, safety protocols, and limitations.
• Imposes independence, competency, record-retention, advertising, and employee whistleblower-protection requirements.
• Authorizes investigations, removal from the registry, and referral to the Attorney General or other enforcement authorities; directs the California Board of Accountancy to investigate qualifying complaints involving accountants and firms.

Who it affects ​

• People, partnerships, and corporations that assess AI systems or models for third parties to determine compliance with California law.
• Businesses and other organizations receiving covered AI audits.
• Certified public accountants, public accountants, and accounting firms performing covered audits, which may meet certain requirements through applicable accountancy standards.
• Employees of registered AI auditors who report suspected noncompliance.

Context ​

Registration does not mean California recommends or endorses an AI auditor.