california just built a registry for ai auditors. it does not open until 2029. anyone selling you an ai audit this week answers to nobody.

the condition is a service category that grew faster than the standard it claims to measure against. newsom signed sb 813 and ab 1405 on 9 september, and the operative dates say where things actually stand: the government operations agency has until 1 january 2029 to stand up the auditor registry, and only from that date is an unregistered person barred from running a covered audit. until then the word auditor carries no requirement of independence, no disclosed method, and no consequence for issuing a clean opinion on a system nobody tested. the cost is not the invoice, it is the second payment: you buy the audit, you get a pass, and the pass becomes the reason your hiring tool or your pricing model runs unexamined for two more years, which is precisely the period a regulator or a plaintiff will later ask you about.

the fake fix is hiring a bigger firm, which raises the price and not the standard, because the standard does not exist yet. before anyone audits anything, make them put four things in writing: the standard they are auditing to, the specific tests they will run, the failure threshold, and whether they or an affiliate sold you any part of the system under review. then keep your own file as you go, decision logs, where the training data came from, the named human who reviewed each adverse outcome, dated at the time, because that file costs you minutes a week now and a forensic project in 2029.