California Signs an AI Audit Industry Into Being — With Nothing to Audit Yet

California’s 2026 legislative session closed with the usual end-of-quarter flurry of AI lawmaking, and through September the governor signed a batch of the results. The bills are being covered as a landmark package. Most of them are better understood as scaffolding — the state building the apparatus of AI oversight while deferring the moment when that apparatus actually bites.

Two bills signed September 9 make the point. SB 813 directs the state to stand up a process for selecting and regulating independent organizations that would verify AI systems — a government-blessed audit ecosystem. AB 1405 creates a registry for those AI audit and verification providers, and bars unregistered firms from offering covered audits, requiring registered ones to display their registration number. Both are real statutes with real mechanics. Both also point their clocks at the future: the audit-selection process must be established by January 1, 2028, and the registry must be operational by January 1, 2029, according to Kelley Drye’s session wrap.

Here is the catch that the “California regulates AI audits” framing skips: neither bill, as described, actually requires AI developers to be audited. The state is building the referee’s booth and the referee’s licensing board before it has written the rule that says anyone has to play the game. That is not nothing — a credentialed audit profession is a precondition for meaningful third-party oversight — but it is infrastructure, not enforcement. The symbolism arrives in 2026; the teeth, if they ever grow, arrive later and in a different bill.

Compare that to the one measure in the batch with an immediate, concrete demand on companies. AB 1609, signed September 28, requires businesses with more than $500 million in annual gross revenue nationwide to disclose when a customer is talking to a chatbot rather than a person, and to make a good-faith effort to connect the customer to a human within 15 minutes or schedule one within one business day. That is a specific, testable obligation on a defined set of well-resourced firms. It is the kind of rule a regulator or a plaintiff’s lawyer can point at and say: you failed to do the thing on the day the customer asked. Enforcement power, not scaffolding.

The rest of the September cluster lands on the spectrum between those poles. SB 1050, signed September 16, requires disclosure when advertisements feature AI-generated human figures — a transparency mandate whose bite depends entirely on how aggressively it is policed. On the labor side, the No Robo Bosses Act (SB 947), which would require human oversight before AI is used to discipline or fire workers, passed the legislature and was still awaiting the governor’s decision as of publication; if signed, it would not take effect until July 1, 2027.

And then there is SB 1000, which is where the enforcement-versus-symbolism question gets genuinely interesting — and unresolved. The bill rewrites California’s AI Transparency Act, and it cuts in two directions at once: it widens the set of covered providers (more enforcement reach) while eliminating the requirement for a visible disclosure on AI-generated content, keeping only machine-readable provenance data (less consumer-facing transparency). It carries a penalty of $5,000 per violation, per day, and as an urgency measure it would take effect immediately upon signature. As of the last verifiable reporting before publication, SB 1000 had not been signed or vetoed; the governor’s decision deadline fell at the very end of September. We are not asserting its fate.

Why it matters. The story of state AI regulation in 2026 is not that nothing is happening — plenty is. It is that the distance between passing a law and enforcing one is where the real policy lives, and that distance is measured in years and in carefully chosen effective dates. A registry that opens in 2029, an audit process that stands up in 2028, a labor protection that, even if signed, waits until mid-2027: each is a genuine commitment and a deferral in the same sentence. Legislators get to announce that California is regulating AI now; the AI industry gets to keep operating under the old rules for a good while longer. Both can be true, and in September they were.

The bill worth watching is the boring one — AB 1609 — precisely because it asks a company to do a specific thing on a specific timeline, and because that is the exception in this batch, not the rule.

Sources

• Kelley Drye, Ad Law Access, "California's 2026 Legislative Session Wraps: A Wave of Privacy and AI Bills Reaches the Governor"
• Vorpal Labs, "September 2026 AI regulatory update: United States"
• Wiley, "California Closes Legislative Session with Significant AI and Privacy Developments"
• Senate District 5, "Legislature Approves No Robo Bosses Act of 2026"