California AB 1405 (AI auditors)

Summary

Establishes the AI Auditors’ Enrollment Fund, administered by the Government Operations Agency, to oversee the regulation of AI auditors.

Requires AI auditors to enroll with the agency, pay enrollment fees, and provide detailed information about their practices by January 1, 2027.

Mandates AI auditors to adhere to widely recognized industry standards and avoid conflicts of interest, including prohibiting employment with auditees within 12 months of an audit.

Obliges auditors to provide detailed reports post-audit to auditees, explaining results and compliance recommendations while retaining documentation for at least 10 years.

Prohibits auditors from disclosing confidential information without authorization, except under specified legal circumstances, and prohibits retaliation against employees who report non-compliance.

Instructs the agency to publish auditor information publicly and retain and share misconduct reports for enforcement purposes, beginning January 1, 2027.

Clarifies that this chapter doesn’t impede audits required by other statutes prior to January 2027, when Section 11549.86 expires.

Defines key terms related to AI auditing, including AI auditor, artificial intelligence, and covered audit.

The people of the State of California do enact as follows:

SECTION 1. Chapter 5.9.5 (commencing with Section 11549.80) is added to Part 1 of Division 3 of Title 2 of the Government Code, to read:

CHAPTER 5.9.5. Artificial Intelligence Auditors

11549.80. For purposes of this chapter, the following definitions apply: (a) “Agency” means the Government Operations Agency. (b) “Artificial intelligence” or “AI” means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. (c) “Artificial intelligence auditor” or “AI auditor” means a person, partnership, or corporation that assesses an AI system or model on behalf of a third party. (d) “Covered audit” means an audit conducted pursuant to any state statute that requires an audit of an AI system or model by an independent third party auditor.

Creates the AI Auditors’ Enrollment Fund for use by the Government Operations Agency to manage AI auditors.

11549.81. The AI Auditors’ Enrollment Fund is hereby created within the State Treasury. The fund shall be administered by the Government Operations Agency. All moneys collected or received by the agency under this chapter shall be deposited into the AI Auditors’ Enrollment Fund to be available for expenditure by the agency, upon appropriation by the Legislature, to administer this chapter.

11549.82. (a) By January 1, 2027, the agency shall do all of the following: (1) Establish a mechanism on the agency’s internet website allowing AI auditors to enroll with the agency pursuant to subdivision (a) of Section 11549.83. (2) Fix enrollment fees at an amount not exceeding the reasonable costs of administering this chapter. (3) Establish a mechanism on the agency’s internet website allowing natural persons to report misconduct by an enrolled AI auditor.

(b) Beginning January 1, 2027, the agency shall do all of the following: (1) Publish any information provided by an enrolled AI auditor pursuant to subdivision (a) of Section 11549.83 in a publicly accessible format on the agency’s internet website. (2) Retain any report submitted using the mechanism established pursuant to paragraph (3) of subdivision (a) for as long as the enrolled AI auditor remains enrolled, plus 10 years. (3) Share reports submitted using the mechanism established pursuant to paragraph (3) of subdivision (a) with other state agencies as necessary for enforcement purposes.

Requires AI auditors to enroll with the agency, provide specified information, and follow industry standards for audits.

11549.83. (a) Beginning January 1, 2027, prior to initially conducting a covered audit, an AI auditor shall do all of the following:

(1) Enroll with the agency using the mechanism established pursuant to paragraph (1) of subdivision (a) of Section 11549.82.

(2) Pay to the agency the enrollment fee set forth in paragraph (2) of subdivision (a) of Section 11549.82.

(3) Provide to the agency all of the following information: (A) The legal name of the auditor. (B) All of the following contact information: (i) The primary physical address of the auditor, if applicable. (ii) The primary internet website of the auditor, if applicable. (iii) A telephone number enabling a natural person to communicate with the auditor. (iv) An email address enabling a natural person to communicate with the auditor. (C) The types of AI systems or models that the auditor is enrolling to audit. (D) Any relevant certifications or accreditations held by the AI auditor, and the names of the certifying or accrediting entities. (E) A written description of the auditor and the services they provide, not to exceed 200 words in length. (F) A standard operating procedure that does both of the following: (i) Describes the auditor’s protocols in sufficient detail to enable a third party to assess whether audits are conducted according to widely recognized industry standards appropriate to the system or model being audited. (ii) Includes documentation substantiating any claims made by the AI auditor regarding the accuracy, reliability, or validity of its protocols.

(b) In conducting a covered audit, an enrolled AI auditor shall abide by widely recognized industry standards appropriate to the system or model being audited.

Requires AI auditors to provide audit reports, retain documentation, and avoid conflicts of interest with auditees.

11549.84. (a) After conducting a covered audit, an enrolled AI auditor shall provide the auditee with an audit report that contains, but is not limited to, all of the following: (1) The scope and objectives of the audit. (2) The results of the audit and any documentation necessary to demonstrate the basis of those results. (3) An explanation of any steps the auditee can take to meet widely recognized industry standards appropriate to the system or model being audited. (4) An explanation of any steps the auditee can take to become compliant with state law. (5) A statement that is signed and dated by each auditor that certifies that the covered audit was completed.

(b) An AI auditor shall not knowingly make a material misrepresentation in an audit report prepared pursuant to this subdivision.

(c) An enrolled AI auditor shall retain any documentation that is provided to an auditee pursuant to this chapter, or that is necessary to demonstrate the basis of the result of a covered audit, for at least 10 years.

(d) An enrolled AI auditor shall not conduct a covered audit if it has a financial interest in the auditee other than financial compensation for performing an audit.

(e) (1) Notwithstanding Chapter 1 (commencing with Section 16600) of Part 2 of Division 7 of the Business and Professions Code, an enrolled AI auditor shall not accept employment with an auditee within 12 months of completing a covered audit of the auditee. (2) An enrolled AI auditor shall not conduct a covered audit if the auditee had employed the auditor during the 12-month period preceding the audit.

Allows AI auditors to disclose confidential information with consent, legal compulsion, or specific professional exceptions. Prohibits retaliation against whistleblowing employees.

11549.85. (a) An enrolled AI auditor may disclose confidential information concerning an auditee only if the auditee provides written authorization or if the disclosure is any of the following: (1) Made in compliance with a subpoena or a summons enforceable by order of a court. (2) Reasonably necessary to maintain or defend the auditor in a legal proceeding initiated by the auditee. (3) Made in response to an official inquiry from a federal or state government regulatory agency. (4) Made to another enrolled AI auditor or person in connection with a proposed sale or merger of the auditor’s professional practice, provided the parties enter into a written nondisclosure agreement with regard to all auditee information shared between the parties. (5) Made to either of the following: (A) Another enrolled AI auditor to the extent necessary for purposes of professional consultation. (B) Organizations that provide professional standards review and ethics or quality control peer review. (6) Specifically permitted by state or federal law.

(b) An enrolled AI auditor shall not do either of the following: (1) Prevent an employee from disclosing information to the Attorney General or the Labor Commissioner, or using the mechanism established pursuant to paragraph (3) of subdivision (a) of Section 11549.82, including through terms and conditions of employment or seeking to enforce terms and conditions of employment, if the employee has reasonable cause to believe the information indicates that the auditor is out of compliance with the requirements of this chapter. (2) Retaliate against an employee for disclosing information pursuant to paragraph (1).

States that the section does not affect audits under statutes operative before its effective dates.

11549.86. (a) Nothing in this chapter shall be construed to impede, delay, or otherwise affect the conduct of any audit required under any other statute or regulation that becomes operative prior to the effective dates of this chapter.

(b) This section shall remain in effect only until January 1, 2027, and as of that date is repealed.