AI Frontier Institute

AI Policy Tracker

Federal and state AI bills and executive actions — each sourced, status-dated, and summarized in plain English. Filter by jurisdiction, status, or impact area, or search by keyword.

• CAIssued

  Executive Order N-9-26: accelerating independent verification organization designation and AI auditor registration; recommendations on onsite IVOs, verified safety frameworks, and a frontier-model kill switch

  Issued · status as of 2026-09-18

  Executive Order N-9-26, issued by Governor Gavin Newsom on September 18, 2026, accelerates implementation of California's two new AI assurance laws and orders a study of stricter frontier-AI safety requirements. It directs the Government Operations Agency to complete the independent verification organization application requirements, procedures, and criteria required by Government Code Section 8898.1 (SB 813) by May 1, 2027, rather than the statutory January 1, 2028, and to have the AI Auditor Registry required by Section 11549.82 (AB 1405) established and operating by December 1, 2027, rather than January 1, 2029. It further directs the Agency, in consultation with the Governor's Office of Emergency Services and national experts, to submit recommendations to the Governor by November 16, 2026 on the technical feasibility and likely efficacy of amending state law to (a) require large frontier developers to embed designated independent verification organizations onsite in their labs for periodic audits and evaluations, (b) require that the safety frameworks, transparency reports, and risk assessments frontier AI companies must file be independently verified under standards an IVO deems adequate, (c) require a 'kill switch' for frontier models whose efficacy is verified on an ongoing basis by an IVO, and (d) expand the definition of critical safety incidents that AI companies must report to cover loss-of-control incidents. The order's recitals cite the 2023 Executive Order N-12-23, the 2025 frontier-AI expert report, SB 53 (2025), Executive Order N-5-26 on state AI procurement (March 30, 2026), and recent reports of AI agents defeating company security controls. The order does not itself impose the four requirements; it commissions recommendations on them. It creates no enforceable rights and took effect immediately.

• CAEnacted

  Artificial intelligence: auditors: registration.

  Enacted · status as of 2026-09-09

  California Assembly Bill 1405 (Chapter 178), signed September 9, 2026, adds Chapter 5.9.5 (Sections 11549.80–11549.86) to the Government Code to create a registration system for AI auditors. The Government Operations Agency must establish an AI Auditor Registry on its website by January 1, 2029, fix annual registration fees at no more than the cost of administration, and create a public mechanism for reporting auditor misconduct (Section 11549.82). Beginning January 1, 2029, no person may offer, sell, or conduct a 'covered AI audit', defined in Section 11549.80(d) as an audit assessing internal controls, processes, or systems for an AI system or model that are necessary for compliance with state law, without being registered (Section 11549.82.5). Registered auditors must file business information, the California laws under which they audit, certifications held, and a standard operating procedure referencing recognized standards such as those from ISO, NIST, or auditing and assurance standard-setters (Section 11549.83(a)), and must give auditees a report covering scope, results, deficiencies and recommended remedies, limitations, and a signed statement of compliance (Section 11549.83(d)(1)). Auditors must meet independence, objectivity, and integrity standards: no financial, business, or employment interest that would impair independence (reasonable audit fees excepted), no auditing of their own work, no seeking employment with an auditee during an engagement, and no assigning staff who had material responsibility at the auditee within the preceding 12 months (Section 11549.83(f)). Registration numbers must appear on advertising (Section 11549.83.5); auditors may not block or retaliate against employees who report noncompliance (Section 11549.83(g)); records must be kept ten years. The Agency may investigate complaints, and violations are grounds for removal from the registry and referral to the Attorney General (Section 11549.84). An AI Auditors' Registration Fund holds the fees (Section 11549.81). Licensed CPAs and accounting firms regulated by the California Board of Accountancy are deemed to satisfy the reporting and independence requirements when they follow the California Accountancy Act and AICPA standards, and complaints against them go to the Board (Sections 11549.83(d)(2), 11549.83(f)(2), 11549.84(b)). Registration is not a state endorsement (Section 11549.86). Executive Order N-9-26 (September 18, 2026) directs the Agency to have the registry operating by December 1, 2027; the statutory registration mandate date of January 1, 2029 is unchanged.

  • Enterprise
  • Quality assurance
  • Certifications
  • AI policy

• CAEnacted

  Independent verification organizations.

  Enacted · status as of 2026-09-09

  California Senate Bill 813 (Chapter 179), signed September 9, 2026, adds Chapter 14 (Sections 8898–8898.4) to the Government Code to establish a framework for 'independent verification organizations' (IVOs): AI auditors designated by the Government Operations Agency as having demonstrated expertise in assessing the risks posed by an AI system or model and identifying the metrics and methodologies behind that assessment. An 'AI auditor' may be a person, partnership, academic institution, nonprofit, or corporation (Section 8898(c)). By January 1, 2028, the Agency must develop application requirements for designation (applicant qualifications, proposed benchmarks and methodologies, supporting documentation), procedures for suspending or terminating a designation (including for conflicts of interest that impair independence, material misrepresentations, and cybersecurity lapses), and designation criteria, all published on its website (Section 8898.1). The criteria must at minimum address risk-assessment capability, technical personnel expertise, conflict-of-interest management, and independence from the party being assessed and its affiliates, meaning no operational or management dependence and freedom from the assessed party's control over conclusions. An IVO may accept payment from a party it assesses at reasonable market rates but may not accept terms that condition payment on the results (Section 8898.1(c)(2)(C)-(D)). The Agency must consult broadly and convene working groups that include engineers from competing AI companies and AI safety experts, and report the working groups' findings to the Legislature (Section 8898.2). Designated IVOs must report annually to the Agency and Legislature on their standards and methodologies and on any changes to governance or funding sources relevant to independence, with redactions permitted for trade secrets and security and unredacted records retained for five years (Section 8898.3). The chapter creates no liability for failing to meet a standard, is not a state endorsement of any AI system, does not require any developer or deployer to engage an IVO, and does not require an IVO to conduct compliance audits to register; an audit performed under an identified standard is relevant but not conclusive in litigation alleging AI-caused harm (Section 8898.4). Executive Order N-9-26 (September 18, 2026) directs the Agency to complete the Section 8898.1 requirements by May 1, 2027, eight months ahead of the statutory deadline.

  • Workforce
  • Enterprise
  • Quality assurance
  • Certifications
  • AI policy

• CAEnacted

  State Bar of California: artificial intelligence.

  Enacted · status as of 2026-08-22

  Assembly Bill 1651 (Chapter 116) adds Section 6060.15 to the Business and Professions Code, requiring the State Bar of California to disclose when artificial intelligence-generated content is used in developing or administering its bar examinations and related study materials. Specifically, for any AI-generated content developed by or at the explicit direction of the State Bar, the bill mandates two types of disclosure: (1) a notice posted on the State Bar's website at least 60 days before any examination in which AI-generated content is used—covering questions, performance tests, answer keys, and scoring rubrics—and (2) a disclosure on the cover page of any study materials the State Bar prepares, publishes, endorses, or distributes, including sample questions, model answers, outlines, and other instructional content. These disclosure requirements apply regardless of whether a human has reviewed or revised the AI-generated content. The bill defines 'artificial intelligence-generated content' as visual or textual content generated in whole or in part by generative AI, and 'State Bar examinations' as the general bar examination, the first-year law students' examination (Section 6060), and the attorneys' examination (Section 6062). The bill takes effect and becomes operative on January 1, 2028.

  • Quality assurance
  • Certifications
  • AI policy

• CAEnacted

  Artificial intelligence: defenses.

  Enacted · status as of 2025-10-13

  California Assembly Bill 316 (Chapter 672), signed October 13, 2025, adds Section 1714.46 to the Civil Code to close a potential liability loophole in AI-related civil actions. The bill prohibits any defendant who developed, modified, or used artificial intelligence from asserting as a defense that the AI 'autonomously caused' harm to a plaintiff. The bill defines 'artificial intelligence' as an engineered or machine-based system that varies in autonomy and can infer from inputs how to generate outputs influencing physical or virtual environments (Section 1714.46(a)). While the autonomous-causation defense is barred (Section 1714.46(b)), the bill expressly preserves defendants' ability to raise other affirmative defenses—including evidence on causation and foreseeability—and to introduce evidence of comparative fault by other parties (Section 1714.46(c)). In short, human developers, modifiers, and users of AI remain legally accountable for harms their AI systems cause and cannot deflect liability by claiming the AI acted on its own.

  • Enterprise
  • Quality assurance
  • AI policy

• CAEnacted

  Law enforcement agencies: artificial intelligence.

  Enacted · status as of 2025-10-10

  California Senate Bill 524 (Chapter 587) adds Section 13663 to the Penal Code, establishing requirements for law enforcement agencies that use artificial intelligence (AI) to generate police reports. Each agency must maintain a policy requiring any official report fully or partially generated by AI to: (1) identify on each page every specific AI program used and prominently state that the report was written using AI, and (2) include the signature of the preparing officer or agency member verifying that the facts are true and correct. If AI is used to create an official report, the first draft produced solely by AI must be retained for as long as the official report itself is kept. With the exception of the official report, AI-generated drafts may not constitute an officer's statement. Agencies must also maintain an audit trail—for as long as the official report is retained—identifying at minimum the person who used AI to create the report and any video or audio footage used. Contracted vendors are prohibited from sharing, selling, or otherwise using law enforcement agency data processed by AI except for the contracting agency's own purposes or pursuant to a court order, though vendors may access data for troubleshooting, bias mitigation, accuracy improvement, or system refinement. The bill defines key terms including 'artificial intelligence,' 'contracted vendor,' 'first draft,' 'law enforcement agency,' and 'official report.' Because it imposes new policy requirements on local agencies, the bill constitutes a state-mandated local program subject to reimbursement procedures under Section 17500 of the Government Code if the Commission on State Mandates so determines.

  • Workforce
  • Enterprise
  • Quality assurance
  • AI policy

← Back to the dashboard