SB 813 was signed into law by Governor Gavin Newsom on September 9, 2026, together with the paired AB 1405. The Governor's office described the pair as the first laws in the United States establishing independent third-party audits of AI systems (Source: gov.ca.gov).
SB 813 is a California Senate bill introduced by state Sen. Jerry McNerney (D-Pleasanton) in the 2025–2026 legislative session. Through mid-2026 it was titled "California Artificial Intelligence Standards and Safety Commission: artificial intelligence safety standards," and would have established a California Artificial Intelligence Standards and Safety Commission composed of AI industry experts, academics, and public officials, to create voluntary AI safety standards across a range of industries and applications (Source: sd05.senate.ca.gov).
The enacted law is structured differently from that account. As chaptered, the measure is described as "Independent verification organizations," adds Government Code Chapter 14 (Sections 8898–8898.4) under the heading "California Artificial Intelligence Safety Independent Verification Organizations," and assigns the substantive duties directly to the Government Operations Agency on or before January 1, 2028. No commission appears in the enacted text, the administering agency is not the Business and Consumer Services Agency, and the July 1, 2027 deadline does not appear. Neither the AB 1709 contingency nor the contingency on AB 1405 survives in the chaptered text (California SB 813 — enrolled text (Chapter 179, 2026); Source: leginfo.legislature.ca.gov). The sections below distinguish the bill's legislative history, which the commission framing belongs to, from the law as enacted.
Status and timeline
The bill was heard in the Senate Judiciary Committee on April 29, 2025 and passed the Senate on January 27, 2026 (Source: calmatters.digitaldemocracy.org). On June 17, 2026, McNerney and Assemblymember Rebecca Bauer-Kahan (D-Orinda), chair of the Assembly Privacy and Consumer Protection Committee, announced they were amending SB 813 and Bauer-Kahan's AB 1405 to work in concert with each other, pairing SB 813's standards commission with AB 1405's registry for independent third-party AI auditors (Source: sd05.senate.ca.gov). California lawmakers advanced SB 813 at a July 1, 2026 hearing; technology companies oppose the bill (Source: insideaipolicy.com). The Assembly Privacy and Consumer Protection Committee's vote was 11–2, "do pass as amended," with the bill re-referred to the Assembly Appropriations Committee; the amended version is dated July 2, 2026, and lists Bauer-Kahan and Josh Lowenthal as co-authors (Source: calmatters.digitaldemocracy.org). McNerney called the bill a "critical step in making AI safe and beneficial" (Source: insideaipolicy.com).
As amended July 2, 2026, the bill would require the Business and Consumer Services Agency to establish the commission on or before July 1, 2027; would assign the commission (or, if AB 1709 of the 2025–26 session is enacted, the e-Safety Advisory Commission established under that measure) duties including developing standards for the assessment of AI systems and models by AI auditors, procedures for suspending or terminating an AI auditor's registration, and criteria for determining whether an AI auditor qualifies as an independent verification organization; and would make its operation contingent on the enactment of AB 1405 (Source: calmatters.digitaldemocracy.org).
Nine days after signing, Governor Newsom's Executive Order N-9-26 (September 18, 2026) moved the Government Operations Agency's deadline for posting the application requirements, procedures and criteria for independent verification organizations under Government Code § 8898.1 from January 1, 2028 to May 1, 2027, and directed the agency to recommend by November 16, 2026 whether to require large frontier developers to embed designated independent verification organizations onsite California Executive Order N-9-26 — signed text.
Key provisions
As enacted (Chapter 179)
The enacted chapter directs the Government Operations Agency, on or before January 1, 2028, to develop application requirements for IVO designation, procedures for suspending or terminating a designation, and criteria for qualification; to publish those requirements and criteria in a publicly accessible format together with a statement disclaiming any state endorsement of an AI system or model; to review and revise them as law, technology and industry practice change; and to align them with existing professional and regulatory audit and assurance standards while minimising duplicative compliance obligations (California SB 813 — enrolled text (Chapter 179, 2026)).
The qualification criteria the agency must consider at a minimum include assessing a system's risks and identifying the metrics and methodologies behind that assessment, employing personnel with sufficient technical expertise, managing conflicts of interest, and maintaining independence from the assessed party. The conflict provision permits developer payment while prohibiting outcome contingency: "An IVO may accept payment from a party being assessed at reasonable market rates but shall not accept terms which condition any payment or the amount of any payment on the results of their assessment" (Section 8898.1(c)(2)(C)). Independence requires "no operational or management dependence on the party being assessed or its affiliates" and freedom from the assessed party's control in reaching conclusions (subdivision (D)) (California SB 813 — enrolled text (Chapter 179, 2026)).
Section 8898.2 requires consultation with nine categories of stakeholder, and requires the agency to convene working groups that "shall include, but not be limited to, engineers from AI companies that are competitors and AI safety experts," reporting their findings to the Legislature. Section 8898.3 requires each designated IVO to report annually to the agency and the Legislature on its standards and methodologies, changes to governance or funding relevant to independence, and changes to its application, with redaction permitted for trade secrets, cybersecurity, public safety, national security or legal compliance, a published description of each redaction's character and justification, and five-year retention of the unredacted information (California SB 813 — enrolled text (Chapter 179, 2026)).
Section 8898.4(a) states that the chapter does not establish liability for failure to comply with a standard, constitute state endorsement of any system or model, require any developer or deployer to engage an IVO or undergo an audit as a condition of operating in California, or require an IVO to conduct compliance audits in order to register. Section 8898.4(b) supplies the only liability-adjacent provision: "In an action alleging that a defendant's development, modification, or use of an artificial intelligence system or model caused harm, the fact that an audit has been performed in accordance with a standard identified under this chapter is relevant to, but not conclusive of, the action." That is an evidentiary rule rather than a safe harbour, and it favours neither party on its face (California SB 813 — enrolled text (Chapter 179, 2026)).
As described during passage
Under the version the sponsors described, the AI Standards and Safety Commission would create voluntary standards for the responsible development of AI and publish them on the commission's website, and could designate working groups composed of experts and stakeholders to facilitate the development of what the sponsors describe as practical, evidence-based standards that evolve alongside advances in technology. McNerney's office describes the framework as modeled on standards regimes in other industries, from electrical and mechanical standards to LEED standards for green buildings, and states that under the bill California would become the first state to create voluntary standards for the responsible development of AI (Source: sd05.senate.ca.gov). The working-group mechanism survives in the enacted text at Section 8898.2(b); the commission that would have convened it does not.
Relation to AB 1405
The paired AB 1405 (Bauer-Kahan) would establish a registry and standards for independent third-party AI auditors to verify the safety of AI systems and models, including requirements for auditor independence, ethical practice, and financial independence. As of the June 17, 2026 announcement, AB 1405 sat on the Senate Appropriations Committee's Suspense File, with amendments planned. The sponsors state that both bills need to be enacted for the framework to go into effect (Source: sd05.senate.ca.gov). The enacted SB 813 contains no contingency on AB 1405, so the mutual condition the sponsors described is not in this chapter (California SB 813 — enrolled text (Chapter 179, 2026)). AB 1405's chaptered text (Chapter 178, approved September 9, 2026) does not refer to SB 813 either: it creates a separate AI Auditor Registry under Government Code Chapter 5.9.5, administered by the same Government Operations Agency, with registration required from January 1, 2029 to offer, sell or conduct a covered AI audit (Source: leginfo.legislature.ca.gov). The mutual contingency was therefore removed from both measures rather than relocated.
Reactions
Gabriel Weil argued on July 29, 2026 that a certification-for-shield design of this kind compounds the developer-pays conflict of interest inherent in the independent-verification-organization model, because a liability shield "swaps the broad incentive to cut risk by any cost-effective means for a narrow incentive to do only what earns the shield" (Don't Let AI Developers Hire Their Own Referees (Weil, July 2026)). The enacted text does not create a shield. Section 8898.4(a)(1) states that the chapter does not establish liability for failure to comply with a standard, and Section 8898.4(b) makes a conforming audit "relevant to, but not conclusive of" a harm action — an evidentiary rule rather than certification-for-shield. The developer-pays structure Weil objects to is permitted by Section 8898.1(c)(2)(C), with outcome-contingent payment prohibited (California SB 813 — enrolled text (Chapter 179, 2026)). His account of the bill differs from the record above in two respects — he describes the accrediting body as the state attorney general rather than a commission, and states the bill "failed this session." The enacted text resolves the first against his description: the accrediting body is the Government Operations Agency, and the state attorney general appears nowhere in Chapter 14 (California SB 813 — enrolled text (Chapter 179, 2026)). Whether an earlier version named the attorney general is not established. See the reconciliation note on Independent Verification Organizations (IVOs).
Technology companies opposed SB 813 during its passage (Source: insideaipolicy.com). Weil's statement that the bill "failed this session" is contradicted by the September 9, 2026 signing; his account of the accrediting body remains unreconciled.
On signing, McNerney said the action "sends a clear message that California is taking the lead on assessing AI's safety risks, since Washington, D.C., is unable or unwilling to do so," and that SB 813 codifies a recommendation of the governor's blue-ribbon panel on AI. Newsom said the concerns raised in recent incidents reinforce that "the federal government must step forward with robust, national regulations that match the urgency of this moment" (Source: gov.ca.gov; insideaipolicy.com). Bauer-Kahan, announcing the pairing, said the bills would build "a system of independent, verified auditors and known standards that protect our communities from AI harms and unchecked power in the hands of a few companies" (Source: sd05.senate.ca.gov).
A week after signing, the governor's office wrote that because of SB 813 "California is now the first state in the nation to require assessments by independent verification organizations, to ensure AI systems and programs are following California's robust state laws" (Source: gov.ca.gov). The enacted chapter directs the Government Operations Agency to establish the IVO designation regime, and Section 8898.4(a) states that it does not require any developer or deployer to engage an IVO or undergo an audit as a condition of operating in California (California SB 813 — enrolled text (Chapter 179, 2026)). In a POLITICO interview published September 17, 2026, Newsom described SB 813 and AB 1405 as "first steps to the kind of independent third-party reviews and safety standards that people are advocating for," and as part of an effort "to begin to scaffold the next steps" beyond SB 53, which he called "the floor, not the ceiling" (Source: politico.com).
AB 1709 of the 2025–26 session, the alternative designee named in the July 2 amendment, was signed by Newsom on September 10, 2026 as part of a thirteen-bill child online safety package, in a form requiring social media companies either to stop offering addictive features such as infinite scroll and autoplay to users under 16 or to keep those users off their platforms (Source: calmatters.org). The provision that would have assigned duties to an e-Safety Advisory Commission on AB 1709's enactment does not appear in the enacted SB 813, so no such trigger operates (California SB 813 — enrolled text (Chapter 179, 2026)).
Positions
OpenAI formally endorsed SB 813 on September 9, 2026, describing it as establishing "a process for designating qualified, independent organizations capable of assessing AI risks," while stating a preference for independent technical assessments to be required at the federal level "where policymakers can establish consistent standards for assessor qualifications, security, and access to highly sensitive information," and supporting the state measure only "in the absence of federal action." The same post recorded that some of the four California bills endorsed that day had not previously been endorsed by the company (The AI policy window is open. We need to act. (Chris Lehane, OpenAI, September 2026)).
Relationships
- related: California Executive Order N-9-26 (independent verification and frontier AI safety) — advances the § 8898.1 deadline to May 1, 2027 and studies an onsite embedded-verification mandate
- instance-of: State-Level AI Regulation — a California entry in the state AI-legislation landscape.
- related: Colorado AI Act (SB 24-205) — a contrasting mandatory state framework; the July 2026 FTC policy statement claiming preemption authority over state AI laws singled out Colorado's act.
- depends-on: California SB 813 — enrolled text (Chapter 179, 2026) — the enrolled text as signed, Chapter 179 of 2026.
- related: California AB 1405 (AI auditor registry) — the paired auditor registry, signed the same day; the contingency the sponsors described does not appear in SB 813 as enacted.
- related: AI Liability — the relevant-but-not-conclusive evidentiary rule at Section 8898.4(b).
- related: AI Benchmarks and Evaluation — third-party assessment and verification of AI systems is the subject of the paired AB 1405 registry.
- related: The AI policy window is open. We need to act. (Chris Lehane, OpenAI, September 2026) — OpenAI's September 2026 endorsement, with the federal-preference caveat.