Artificial intelligence governance is entering a new phase.. While much of the regulatory conversation has focused on AI developers and technology providers, California has also established a foundation for independent AI verification and audit services.

With the enactment of SB 813 and AB 1405 on Sept. 9, 2026, California became the first state to establish a formal framework for independent AI verification organizations and registered AI auditors. The legislation does not independently require every organization that develops or uses AI to obtain an audit. Instead, it establishes infrastructure and professional requirements for certain independent assessments conducted within the scope of California law.

The approach draws on concepts familiar to established assurance disciplines, including independence, transparency, integrity, and management of potential conflicts of interest. As AI becomes increasingly embedded in business operations, customer interactions, decision-making processes, and risk management activities, stakeholders are seeking greater confidence that AI-related risks are being identified, managed, and monitored.

What does an independent AI audit actually evaluate?

For organizations, this development signals a fundamental change in expectations. The conversation is no longer limited to whether AI can create value. Increasingly, organizations will be expected to demonstrate that AI systems are governed appropriately, risks are understood, and controls operate effectively throughout the AI lifecycle.

AI assurance engagements can extend beyond algorithm testing and model-performance validation. Depending on their scope, they may evaluate whether appropriate governance structures, risk management processes, oversight mechanisms, controls, and documentation practices support the responsible development, deployment, and use of AI. In many cases, the challenge is not the absence of controls, but the inability to demonstrate that those controls exist and operate effectively.

California’s framework establishes a two-tier structure administered by the California Government Operations Agency. SB 813 creates a framework for Independent Verification Organizations (IVOs) that perform independent assessments of AI systems and models, while AB 1405 establishes an AI Auditor Registry and standards related to auditor independence, transparency, and integrity.

Together, these measures formalize AI assurance as an emerging professional discipline and seek to reduce conflicts of interest between AI developers and independent assessors.

Which sectors may face the greatest AI scrutiny?

Although the framework applies broadly, its impact may be particularly relevant for organizations that develop, deploy, or rely on high-risk AI systems in areas such as lending, healthcare, insurance, employment, public-sector services and critical infrastructure.

Organizations operating in these environments should be prepared to face increased expectations from regulators, customers, investors, and other stakeholders to demonstrate effective governance, risk management, transparency, and oversight of AI-enabled processes.

Why documentation is critical for AI audit readiness

While implementation details continue to evolve, the framework highlights areas that organizations should already be evaluating. Transparency, accountability, fairness, data governance, cybersecurity, and operational resilience are becoming core components of AI governance discussions. Regulators and stakeholders continue to emphasize that responsibility for AI-driven decisions cannot be delegated entirely to technology. Effective programs require clear ownership, ongoing oversight, and documented evidence that risks are being actively managed.

Documentation is emerging as a critical indicator of demonstrating maturity within the governance structure an organization has adopted. This may include AI inventories, risk assessments, approval and escalation workflows, model testing and validation records, monitoring activities, incident logs, training records, and clearly defined accountability structures.

Organizations may have effective processes in place, but without documentation demonstrating how risks are identified, assessed, mitigated, and monitored, it can be difficult to evidence responsible AI practices. As regulatory expectations mature, documentation is likely to become one of the most important indicators of audit readiness and the effectiveness of an organization's governance program.

Organizations should view AI governance not simply as a compliance exercise, but as a business enabler. Strong governance can help scale AI adoption with confidence, strengthen stakeholder trust, improve decision-making, and reduce operational and regulatory risk. Frameworks such as ISO/IEC 42001 provide a structured foundation for accountability, risk management, performance monitoring, and continual improvement.

Executive Order N-9-26: Key deadlines and implementation timeline

The urgency for organizations to evaluate their AI governance programs has increased significantly. On Sept. 18, 2026, Gov. Gavin Newsom issued Executive Order N-9-26, accelerating implementation of key portions of the framework. Pursuant to Executive Order N-9-26, California must complete the Independent Verification Organization application framework by May 1, 2027, and complete implementation of the AI Auditor Registry requirements by Dec. 1, 2027. Registration requirements for covered AI auditors remain scheduled to take effect on Jan. 1, 2029, pursuant to AB 1405.

The national ripple effect of California’s AI laws

While California’s framework applies at the state level, its implications are likely to extend well beyond state borders. Similar to the evolution of privacy and cybersecurity regulations, these laws may provide an early indication of future expectations surrounding AI governance, accountability, and independent assurance.

The question for business leaders is no longer whether AI governance matters. The question is whether their organizations can demonstrate the governance, oversight, risk management, and documentation necessary to withstand increasing regulatory and stakeholder scrutiny.

CohnReznick professionals can help organizations assess AI governance maturity, evaluate audit readiness, identify control gaps, and align AI programs with leading practices, ISO/IEC 42001, AIUC-1, and emerging regulatory expectations.