Two Governments Just Turned "AI Auditor" Into a Real Job

Within the same three weeks, on two continents, independent AI auditing stopped being a best practice and started becoming a regulated profession. On September 9, 2026, California Governor Gavin Newsom signed SB 813 and AB 1405, creating the first state framework in the United States for independent, third-party auditing of AI systems. A week earlier, on September 1, the European Commission's AI Office opened its first scheduled wave of compliance inspections, working with national authorities across the EU and sending formal information requests to more than thirty companies. (CIO Dive, European Commission)

If you have spent any time in audit or compliance, you know what this pattern means. When a government defines who is qualified to audit something and then starts showing up to inspect it, the work has crossed a line. It is no longer a slide that says "responsible AI." It is a control that someone has to test, document, and defend.

What California Actually Did

The two California laws work together to build an audit profession from scratch. SB 813 directs the state's Government Operations Agency to create a framework for "independent verification organizations," private assessors that evaluate AI systems and models for compliance with state law. AB 1405 establishes a state registry for AI auditors and sets standards for their independence, transparency, and integrity. (Transparency Coalition)

The timeline is the part to notice. The agency has to publish the criteria for designating an independent verification organization by January 1, 2028, and stand up the online AI Auditor Registry by January 1, 2029. After that date, registration becomes mandatory for anyone conducting a covered AI audit in California. In other words, the state is not just encouraging AI audits. It is deciding who is allowed to perform them, the same way other professions license the people who sign off on financial statements or building safety.

What the EU Is Doing at the Same Time

While California was defining the auditor, Brussels was acting like one. The AI Office, coordinating with national market surveillance authorities across member states, began its first structured inspection wave. Reporting indicates the early requests focus on three high-risk, high-impact sectors: automated resume screening in hiring, algorithmic credit assessment in retail banking, and AI triage tools in private healthcare. (OpsIntel)

What are the inspectors asking for? Up-to-date technical documentation, evidence of bias testing, human oversight records, and post-market monitoring. Read that list again, because it is an audit program. It is not a philosophical debate about AI ethics. It is a request for artifacts, on a deadline, from a regulator with the power to fine. Brussels has moved from writing rules to checking whether you followed them.

Why This Is Bigger Than It Looks

Audit is the mechanism that turns a principle into a practice. A policy that no one verifies is a wish. A control that an independent party tests, on evidence, is governance. That is why the arrival of a licensed AI auditor role and a live inspection regime, in the same month, is a genuine turning point rather than more regulatory noise.

We have watched this movie before. Sarbanes-Oxley took internal controls over financial reporting and made them a documented, tested, signed discipline, and in doing so it created the modern IT audit profession almost overnight. GDPR did the same thing for privacy, conjuring the Data Protection Officer into existence as a required role with a credential and a seat at the table. AI is now at exactly that inflection point. The difference is speed. What took financial audit decades is happening to AI in quarters.

What It Means for Your Organization

Strip away the jurisdictional detail and the message to any organization running AI is simple: you are going to be audited, either by your own internal team, by a registered independent verifier, or by a regulator. The only question is whether the evidence exists when they ask. In practice that means you need a short, unglamorous set of artifacts ready before anyone knocks:

  • A current inventory of every AI system you run, including the ones teams stood up without telling anyone. You cannot audit what you have not enumerated, and cheap models are multiplying the shadow AI you do not yet see.
  • Bias and performance testing records, with dates, methods, and results, not a one-time slide from a launch review.
  • Human oversight evidence that is real, capturing what a person actually reviewed and decided, not a rubber stamp. An audit log alone is not accountability.
  • Data lineage and rights, showing where training and input data came from and that you had the right to use it. This is where AI governance and privacy fully overlap, and where a DPIA quietly becomes an AI impact assessment.
  • Post-market monitoring, proving you watch systems after deployment, especially agentic ones that act on their own. That is the heart of the agentic governance gap.

None of this is exotic. It is classic assurance discipline applied to a new asset class. The organizations that treat it as a checkbox will find, the hard way, that a registered auditor and a regulator do not accept checkboxes.

The Skills Gap, and Where AIGov Prep Fits

Here is the opportunity hiding inside the obligation. Someone has to design these audit programs, produce the evidence, and, increasingly, hold a registered credential to sign off on them. There are not nearly enough people who can. If you already work in audit, risk, privacy, security, or compliance, you are closer to this role than almost anyone, because you already think in inventory, control, and evidence. What is missing for most people is a structured command of the AI-specific frameworks these audits are built on: the EU AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001.

That is exactly what the IAPP's Artificial Intelligence Governance Professional (AIGP) credential certifies, and it is why it is becoming to AI assurance what the CISA became to IT audit. If you want to see how these concepts show up on the exam, try 25 free AIGP practice questions and find your gaps before you build a study plan.

I built AIGov Prep after more than 18 years in IT audit and governance, watching this cycle repeat: a law lands, it creates real pressure, the pressure creates demand for people who can actually do the work, and there are never enough of them. I am pursuing the AIGP myself, and I built the platform to make preparation direct and practical rather than padded. The full study plans and question bank are on the AIGov Prep plans page.

California just decided who gets to audit AI. The EU just started doing it. The professionals who get ready now will be the ones signing off later. Start with 25 free AIGP practice questions and get ahead of the wave.