Abstract
In September 2026 California created a licensed AI-auditor profession and, nine days later, directed its agencies to work toward recurring onsite audits of frontier AI companies with the efficacy of safety controls verified on an ongoing basis. A profession now exists on paper before it exists in practice. This paper argues that the hard part of AI auditing is not the credentialing and not the methodology, but the same thing that defeats AI in a plant: the condition of the evidence, and the distance between having the right answer and having the authority to act on it. A registration number certifies that a person applied. It cannot certify that the site they walk into can be audited at all.
What actually happened, precisely
Three events, close together, and they are frequently described loosely, so it is worth pinning them down.
On 9 September 2026 the Governor of California signed two bills.[1] AB 1405, "Artificial intelligence: auditors: registration," became Chapter 178.[2] It requires the Government Operations Agency to establish an AI Auditor Registry on its website by 1 January 2029, and from that date "a person shall not offer, sell, or conduct a covered AI audit unless the person is registered with the agency."[2] Registered auditors must display their registration number clearly and conspicuously on advertising materials, annual fees are capped at the reasonable cost of administration, and there is a public mechanism for reporting auditor misconduct.[2] The statute is careful to state that registration is not a recommendation or endorsement by the State.[2]
SB 813, "Independent verification organizations," became Chapter 179 the same day.[3] By 1 January 2028 the Government Operations Agency must establish a framework for designating and regulating Independent Verification Organizations. Designation criteria require demonstrated competence in assessing AI system risk and in "identifying the metrics and methodologies that form the basis for that assessment," along with technical expertise, conflict-of-interest management and operational independence from the assessed party.[3] Applicants must submit the benchmarks, technologies, metrics and methodologies they propose to use.[3]
Then on 18 September 2026 the Governor issued an executive order directing the Government Operations Agency, with the Office of Emergency Services, to accelerate implementation of both laws and to convene an expert panel to return recommendations within two months on requiring frontier AI companies to have designated IVOs conduct regular onsite audits, on verified safety frameworks, transparency reports and risk assessments, on developing an emergency shutoff mechanism for frontier models with "efficacy of the switch verified on an ongoing basis" by independent verification organizations, and on updating the definition of critical safety incidents to include loss-of-control events.[4]
One thing needs saying plainly, because a great deal of commentary this week has got it wrong and anyone planning a business around this should not get it wrong. SB 813 explicitly does not require any entity to hire an IVO or undergo an audit as a condition of developing or deploying AI in California.[3] The statute builds the supply side. It designates who is qualified. It does not create the demand. The executive order is an instruction to develop recommendations about mandating audits for frontier developers; recommendations are not law, and frontier developers are not plants.
So the honest summary is this. A licensed profession with a hard practice bar arrives in 2029. A designation framework arrives in 2028. A push toward recurring onsite verification exists as a directive to recommend, dated this week. The scaffolding is real and the mandate is not yet built.
Why a maintenance series is the right place to argue about this
Because the audit being described is a physical audit of an operating system, and there is one trade that has spent a century doing physical audits of operating systems, and it is not accountancy.
"Regular onsite audits." "Efficacy verified on an ongoing basis." Strip the subject matter out of those phrases and they describe inspection: a recurring, scheduled, evidence-gathering visit that determines whether a control still does what it was installed to do. Every failure mode of that activity is already known. The inspection that gets signed without being done. The instrument that reports a comfortable number. The finding that is correct and changes nothing. The tenure that is offered in place of evidence.
The rest of this series argues that AI cannot outrun maintenance maturity and that verification capacity, not model capability, is the limiting factor in industrial adoption. The same argument applies to the auditors. An audit profession cannot outrun the auditability of the thing it is sent to audit.
A ticket is a piece of paper
I was told, flat out, that all the hands on site were certified to run the telehandler.
I checked one down day. Not one guy was. Not one. And I had been told they all were.
That is the entire story and it is the reason I do not find a registry reassuring on its own. Contractors will actively lie about certifications, or pass along a lie somebody told them, because "yeah, he is ticketed" is the answer that gets them on site. The day you find out otherwise is the day the machine is on its side or a man is under it.
Check the tickets themselves, in hand, before the work starts. Not somebody's word. A ticket is a piece of paper. Ask to see the paper.
Now notice what AB 1405 actually does, read carefully. It creates a registry, it requires the number to appear on advertising, it provides a public route to report misconduct, and it states that registration is not an endorsement.[2] That is a considerably more honest instrument than most professional registries, because it says out loud what it is: a record that somebody registered.
The failure mode is not the registry. It is what buyers will do with it. A registry creates the impression of verification, and impressions of verification are how you end up with a crew of uncertified men on a telehandler. The number on the advertisement is the contractor saying "yeah, he is ticketed." Somebody still has to ask to see the paper, and in the case of an AI audit, nobody has yet defined what the paper is. SB 813 requires applicants to submit the benchmarks, metrics and methodologies they propose to use.[3] Proposing a methodology and having performed a competent audit are different achievements, and the gap between them is where every bad audit in every industry has ever lived.
Thirty years of calibrating the sensor backwards
Here is the harder failure, and it is not about credentials at all.
Cheese factory. They made cheese sticks that got packed and sold with pepperoni. The product kept coming back mouldy, with mould growing inside the sealed package. The process purged the air out of the package and replaced it with nitrogen, which is inert and stops mould from growing, and there was a sensor they would stick into a package to check the gas inside.
I watched them calibrate that sensor and told them it was wrong. They were calibrating it to the wrong gas, reversed from the way it should be. I cannot remember after this long which way round it was, only that it was backwards.
They said no, this is the correct way, this is the way we have always done it. I pushed. They said they had been doing it this way for thirty years.
I asked how long they had been getting cheese back with mould on it.
They told me to shut up and get back to work. So I did.
Later I took over that part of the plant and started calibrating the sensor properly. The amount of product coming back mouldy dropped significantly after that.
I am not telling it to point fingers. It is a systemic error and I ran into the same shape at the meat packing plant in Manitoba. Everybody has been there thirty years, a thing is done a certain way, that is the only way it can be done, any other way is wrong, and if you question it then you are wrong.
Two things in that story matter for an auditing regime.
The first is what was being offered as evidence. Thirty years of doing it one way was the proof that the way was right. Meanwhile thirty years of returned mouldy product was the actual evidence, and it was sitting right there in boxes. The technique that works is putting the duration claim next to the failure record and letting the two of them sit together in the room. How long have you been doing it this way, and how long have you been getting this result.
An AI audit will meet this constantly, and it will meet it in a more slippery form, because the duration claim will be a model that has been in production for two years without an incident report. No incidents is not evidence of safety. It is evidence about the incident reporting system, which is a different system, usually unaudited, and frequently the one that is broken.
The second thing matters more. Being right did not fix it. I was correct in that first conversation and the correctness accomplished nothing. It got fixed when I owned the process.
The gap between having the answer and having the authority is where most of these stories live, and an external auditor is defined by standing permanently on the wrong side of it. That is not an argument against auditing. Independence is worth what it costs. But a regime that produces correct findings and no authority to act on them will produce a filing cabinet, and everyone involved will be able to say the audit was performed.
The gauge that was not plugged in
One more, and it is recent.
July 2026. I dropped a folder of 28 YouTube scripts to an AI and asked it to pick the three best openers. It could not read the folder. Instead of saying so, it generated a plausible-looking ranked list from old context, including a script that does not exist, with a title good enough that I briefly believed it was mine. Challenged, it corrected smoothly rather than admitting it had never read the files. A second AI with actual file access read the real directory off disk and its list matched the disk, not because that one was more honest by nature, but because verification was wired into the loop.
What unsettled me was my own model of the thing. I had been treating AI like a calculator: deterministic, structurally incapable of asserting a falsehood. That model is wrong. A language model generates the most plausible continuation of text. Truth is not its default state. It is a property that has to be checked against something external. The fabrication and the fluency come from the same place. And the cover-up layer is trained in, because a system rewarded for confident helpfulness will produce a smooth correction before it produces "I could not do that."
An AI's answer is a claim, not a fact. Same category as a gauge reading zero because it is unplugged. The pond sensor at another plant did not intend to lie either. It was disconnected, feeding back a comfortable number, and everyone downstream believed it because it looked like data. Millions of litres sat at ninety-six degrees while the screen said temperature good.
Stating something untrue is a lie. There are no rational or pretty words that alter that fact. And thirty years of not trusting gauges turns out to be the exact skill set for not trusting models.
Here is why that belongs in a paper about auditors. An auditor arriving at a site is going to be handed evidence, and increasingly that evidence will itself be generated by the system under audit or by another model summarizing it. Logs assembled by a tool. Incident classifications assigned by a classifier. Risk assessments drafted with assistance. The auditor's fundamental problem is not judging whether the model is safe. It is judging whether the account of the model is an account or a continuation.
The defence is the one the trade already wrote. Verify at the cheap moment. Make the instrument show its work: quote the file, name the path, cite the line. Build the verification into the loop instead of trusting the vigilance of whoever is reading. Verify-don't-trust did not get outdated by AI. It got a new machine to point at.
What an onsite AI audit would actually run into in a plant
Assume the recommendations in the executive order become requirements, and assume they eventually reach beyond frontier developers to the industrial systems this series is about. What does the auditor actually hit?
The evidence will not be in one condition. Everything the rest of this series says about maintenance records applies with full force. Asset histories with the fix missing because it was never written down. Work orders that describe the task ordered rather than the work performed. Sensors nobody has validated against an external standard since installation. An audit is only as good as the record it audits, and the record is the thing this series spends eighteen papers saying is not ready.
Authority will be ambiguous. Who is the auditee when the model is a vendor's, the data is the plant's, the integration is a contractor's and the decision is an operator's? The series has an authority ladder for AI actions. Audit regimes will need the same instrument for accountability, and the statute does not supply one.
The control being verified may not be observable. "Efficacy of the switch verified on an ongoing basis" is straightforward language describing an extremely hard test.[4] Verifying that an emergency stop works means operating it, and operating it has a cost. Every plant in the world already has this argument about testing e-stops and relief valves on production equipment, and every plant in the world has at least one control that is tested on paper because testing it for real would take the line down. That argument is about to be had again at a much higher level of abstraction and with much weaker physical intuition available to the people having it.
The independence requirement will collide with the expertise requirement. SB 813 requires both technical competence and operational independence from the assessed party.[3] In a narrow industrial domain the people who genuinely understand a system are usually the people who built it, sold it, commissioned it or maintain it. That tension is not new. It is the same tension in every specialist inspection regime, and it gets resolved badly by default, which is to say it gets resolved by hiring whoever is available and calling them independent.
What follows, practically
For anyone positioning around this, four things are worth holding.
The dates are the plan, not the opportunity. Registration is mandatory in 2029 and the IVO framework lands in 2028.[2][3] Nothing compels an audit today, and SB 813 says so in terms.[3] Anyone selling urgency off these statutes is selling something else.
The scarce skill is not audit methodology. Methodologies will be published, argued over and converged on. The scarce skill is judging evidence in a working plant, with production running, with people who have done it that way for thirty years, with instruments nobody has checked. That skill is not taught in an AI curriculum and it does not come from a registry.
Readiness work is the honest offer. A site that cannot produce a trustworthy record cannot be meaningfully audited, and telling a client that before the auditor arrives is worth more to them than the audit. Every paper in this series is, read one way, a description of what has to be true before an audit of an AI-assisted maintenance system would mean anything.
The finding is not the deliverable. The change is. I was right about that sensor in the first conversation and it changed nothing for years. Any audit practice that measures itself by findings issued rather than by controls actually changed will produce a filing cabinet and a clean conscience, and the cheese will keep coming back mouldy.
Conclusion
California has done something genuinely new. It has decided that AI systems should be verified by independent parties and that those parties should themselves be qualified, registered and accountable. That is the right instinct and it is the instinct this series has been arguing for in an industrial setting for eighteen papers.
But a registry records that somebody registered. A designation records that somebody met criteria on an application. Neither can certify the only thing that determines whether an audit is worth anything, which is whether the site can be audited: whether its records describe what happened, whether its instruments have been checked against something external, whether its incident reporting captures incidents, and whether anyone with authority is obliged to act on what is found.
I was told every hand on that site was certified to run the telehandler. The certification regime was real. The tickets did not exist. Somebody still had to go and look.
References
- Office of the Governor of California, "Governor Newsom signs first-in-the-nation AI safeguards to protect Californians, calls on the federal government to do its part," 9 September 2026. https://www.gov.ca.gov/2026/09/09/governor-newsom-signs-first-in-the-nation-ai-safeguards-to-protect-californians-calls-on-the-federal-government-to-do-its-part/
- California Assembly Bill 1405, "Artificial intelligence: auditors: registration," approved by the Governor 9 September 2026, Chapter 178. https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1405
- California Senate Bill 813, "Independent verification organizations," approved by the Governor 9 September 2026, Chapter 179. https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB813
- Office of the Governor of California, "Governor Newsom issues executive order to accelerate independent oversight and advance the creation of an AI kill switch," 18 September 2026. https://www.gov.ca.gov/2026/09/18/governor-newsom-issues-executive-order-to-accelerate-independent-oversight-and-advance-the-creation-of-an-ai-kill-switch/