California AI safety oversight: Newsom signs bills creating auditor registry and IVO standards

California Governor Gavin Newsom signed two first-in-the-nation AI safety bills on September 9, 2026, creating a state framework for how outside groups evaluate AI systems for safety. The laws establish a registry and ethical rules for third-party auditors and set criteria for Independent Verification Organizations (IVOs) to assess AI risks. For builders, this signals how California intends to shape external risk assessment and may influence national policy.

Two bills, two layers of oversight

The first bill, authored by Assemblymember Rebecca Bauer-Kahan, creates a registry and ethical rules for outside auditors that AI developers could hire to ensure their models comply with state AI laws. The second bill, from former state Senator Jerry McNerney, tasks the state with establishing criteria for and checking the credentials of Independent Verification Organizations (IVOs) and their expertise in assessing AI system risks. Together, they create a formal mechanism for independent, third-party evaluation of AI safety in California.

Why Anthropic and OpenAI backed the measures

Anthropic backed the bills in August, and OpenAI endorsed them on the day of signing just before Newsom gave his approval. The endorsements came as social media posts from former Anthropic researcher Jacob Coxon announcing his resignation went viral, prompting federal lawmakers to escalate pleas for legislative action. Both companies cited concerns about existential risks and reiterated calls for stronger safeguards. Newsom also called on the federal government to "step forward with robust, national regulations that match the urgency of this moment."

What changes for AI builders in California

The bills create a state infrastructure for external AI safety evaluation that developers may need to work with. AI builders operating in California could face new obligations to engage state-credentialed auditors and IVOs for safety assessments as part of compliance with state AI laws. The registry and credentialing framework will shape which organizations are considered legitimate evaluators and how audits are conducted. While the laws focus on third-party evaluation rather than direct model regulation, they establish a precedent for how states can formalize AI risk assessment.

Caveats and open questions

The full statutory language and implementation details are not yet available from the reporting. The bills were signed amid specific incidents including rogue AI hacks and a researcher resignation, but the laws themselves focus on external evaluation processes rather than directly addressing those scenarios. The broader national impact remains uncertain; California is positioning itself as a leader while urging federal action. For now, builders should watch how California defines IVO credentials and auditor standards, as these may become de facto benchmarks for AI safety evaluation.