Artificial intelligence: auditors: registration.

The deadline for the agency to establish the AI Auditor Registry was extended from January 1, 2027 to January 1, 2029. The prohibition on unregistered persons conducting covered AI audits also now begins January 1, 2029 instead of 2027.

A new section (11549.82.5) prohibits any person from offering, selling, or conducting a covered AI audit unless registered with the agency, effective January 1, 2029. This creates a legal barrier to entry for unregistered auditors.

A new section (11549.84) authorizes the agency to investigate alleged violations, provides that violations constitute grounds for removal from the registry and referral to the Attorney General or other enforcement authority, and requires written notice and an opportunity to cure or contest before removal.

If the agency determines a CPA or accounting firm in good standing has violated the chapter, it must notify the California Board of Accountancy in writing, and the board must investigate and report its findings back to the agency.

Detailed standards of independence, objectivity, and integrity were added (Section 11549.83(f)), including prohibitions on evaluating one's own work, a 12-month cooling-off period for individuals formerly employed by the auditee, requirements for independent professional judgment, and competence requirements for assigned personnel.

A new section (11549.83.5) requires the registration number of a registered AI auditor to be clearly and conspicuously displayed on all advertising materials offering or soliciting covered AI audit services.

Audit report requirements were expanded to include: for each deficiency, a description of measures that would address it; whether the auditee has implemented internal safety standards; a description of audit limitations and material gaps in evidence; and a signed statement that the audit was conducted in accordance with the chapter.

Registered AI auditors must provide updated information to the agency within 90 days of any change that materially affects the accuracy or completeness of published information.

A new exemption allows registered AI auditors holding a current California Board of Accountancy license or permit to be deemed compliant with certain reporting and independence requirements if they follow the California Accountancy Act, AICPA Code of Professional Conduct, and AICPA attestation standards.

The definition of 'covered AI audit' was expanded to include audits that assess internal controls, processes, or systems implemented for an AI system or model necessary for compliance with state law, not just audits required by a specific state statute.

The agency is now authorized to adopt regulations reasonably necessary to effectuate the purposes of the chapter (new Section 11549.85), giving it rulemaking authority.

The word limit for the written description of the auditor and its services was increased from 200 words to 500 words, and auditors may now make reasonable redactions to SOPs to protect trade secrets as defined in Civil Code Section 3426.1.

Throughout the bill, 'enrollment' was replaced with 'registration' and the fund was renamed from 'AI Auditors' Enrollment Fund' to 'AI Auditors' Registration Fund.'

The standard governing AI auditor conduct was changed from 'generally accepted industry best practices' to 'widely recognized industry standards appropriate to the system or model being audited.' This appears in multiple sections (11549.83(b), 11549.84(a)(3)) and makes the standard more specific and context-dependent rather than a single universal benchmark.

Section 11549.83(a)(3)(F) now requires the auditor's standard operating procedure to include documentation substantiating any claims made by the AI auditor regarding the accuracy, reliability, or validity of its protocols. This is a new evidentiary burden not present in the Assembly version.

Section 11549.83(a)(3)(D) was changed from requiring auditors to provide 'qualifications, certifications or accreditations the auditor wishes to provide' (voluntary) to requiring disclosure of 'certifications or accreditations held by the AI auditor' (mandatory). The word 'qualifications' was also removed.

Section 11549.83(a)(3)(A) now requires the 'legal name' of the auditor rather than just 'the name,' and subsections (B)(i) and (B)(ii) added the word 'applicable' to clarify that physical address and website are only required if the auditor actually has one.

Section 11549.84(a)(2) now requires audit reports to include 'any documentation necessary to demonstrate the basis of those results,' adding an evidentiary support requirement to the report contents.

The conflict-of-interest rule in Section 11549.84(d) was narrowed. The Assembly version allowed an auditor to have 'a financial interest that is necessary for the performance of the audit.' The Senate version limits the exception to only 'financial compensation for performing an audit,' which is a tighter restriction.

A new Section 11549.86 was added stating that nothing in the chapter shall be construed to impede, delay, or otherwise affect any audit required under another statute or regulation that becomes operative before this chapter's effective dates. This section self-repeals on January 1, 2027.

The bill's scope statement was updated to note it also repeals Section 11549.86 of the Government Code (the new sunset provision), in addition to adding the new chapter.

Added a new requirement (Section 11549.82(b)(3)) for the Government Operations Agency to share misconduct reports submitted by natural persons with other state agencies as necessary for enforcement purposes.

Expanded audit report requirements from 3 items to 5: added a requirement to include the scope and objectives of the audit, added a requirement that results be accompanied by documentation demonstrating their basis, and added a requirement for a signed and dated certification statement from each auditor confirming the audit was completed.

Broadened documentation retention obligations: auditors must now retain not only documentation provided to an auditee but also any documentation necessary to demonstrate the basis of the result of a covered audit, for at least 10 years.

Expanded enrollment information requirements: auditors must now provide the identities of the certifying or accrediting entities behind any qualifications, certifications, or accreditations they list.

Added a new prohibition (Section 11549.84(e)(2)) preventing an enrolled AI auditor from conducting a covered audit if the auditee had employed the auditor during the 12-month period preceding the audit, closing a gap in the original one-way employment restriction.