California Built the Auditor. Your Vendor Has No Certificate.
You have sat in the demo. The vendor puts an accuracy figure on the screen, something in the high nineties, and everyone in the room writes it down. Nobody asks who measured it. There has been no one to ask.
That changed on September 9, 2026. Governor Gavin Newsom signed Senate Bill 813 and Assembly Bill 1405. SB 813, authored by Senator Jerry McNerney, establishes a framework for independent verification organizations that can assess AI systems and models for compliance with state law. AB 1405, authored by Assemblymember Rebecca Bauer-Kahan, who chairs the Assembly Privacy and Consumer Protection Committee, creates a state registry for AI auditors and sets standards for their independence, transparency and integrity (Office of Governor Gavin Newsom).
Two years of state AI legislation has been about telling people things. Tell them it is a bot. Tell them a model was involved. Publish your safety framework. California's own 2025 law, the Transparency in Frontier Artificial Intelligence Act, sits in that tradition: it requires frontier developers to disclose safety frameworks, report certain critical safety incidents to the state, and protect whistleblowers. That law is SB 53.
This week's pair is different in kind. California did not add a notice requirement. It stood up the institution that checks the claim.
That is the same structural move that produced the financial statement audit, and it carries the same eventual consequence. Once independent verification exists as a recognized practice, an unverified claim starts to look like a weaker claim. The machinery is not built yet. The Government Operations Agency has until 2028 to set the qualification criteria for independent verification organizations, and the SB 813 program is voluntary (Bloomberg Government). That is a runway, not a reprieve. And voluntary is what makes the question useful: a vendor who volunteers for verification and a vendor who does not have each just told you something.
Nothing in this framework is specific to any one industry, and that is exactly why it reaches yours. It aims at developers and high-risk deployments across the economy, which means the vendors selling into your operation are inside the perimeter even where your own entity is not. The Governor's release also asks the federal government to establish robust national regulation, which is the clearest available signal that no national floor is arriving soon. The state-by-state patchwork keeps widening, and California keeps functioning as its practical floor.
There is real relief here for buyers, and it is worth naming out loud. Somebody other than the vendor will eventually be in a position to say whether the tool works. There is also a quieter problem, and it belongs in the boardroom. Once a verification apparatus exists, choosing not to ask for verification becomes a decision with a date attached to it. Directors who have been receiving AI updates as an innovation item are about to find that oversight of a technology becomes documentable the moment a recognized standard of verification exists. Call it the Verification Turn.
Three things to do, none of which require waiting for 2028. This week, email every AI vendor that touches a customer, a record or a claim and ask a single question: do you operate in California, and what is your plan for independent verification under SB 813 and AB 1405? File the answers. The answers themselves will sort the companies building for scrutiny from the companies building for a demo. This month, add one line to the board's technology report: which of our AI tools would survive an independent audit of the accuracy claims we relied on when we bought them. If nobody can answer that, you have your answer. This quarter, put a verification clause in your next vendor renewal. Vendor agrees to disclose the results of any independent AI verification or audit and to notify us of material adverse findings within 30 days. You are not demanding a certificate that does not exist yet. You are securing the right to see it when it does.