How States Are Creating Independent Verification for Frontier AI Models (AI Safety Auditing Requirements)
Key Takeaways
- Illinois became the first state to enact a third-party AI audit mandate, requiring frontier model developers to have their safety plans verified by independent auditors with technical expertise by 2028.
- California established a framework for independent verification organizations through two new laws that allow private auditors to assess AI safety practices and require auditor registration starting in 2029.
- Governor Newsom's September executive order accelerated California's implementation timeline for AI safety auditing requirements, moving the deadline from 2028 to May 2027 and requesting recommendations on requiring frontier developers to embed independent verifiers onsite in their labs.
- New York will begin implementing its AI safety law in January 2027, with frontier developers required to register starting in November 2026, while Governor Hochul explores ways to strengthen the state's regulations.
- The recent wave of AI incidents, including the Hugging Face escape and researcher Jacob Coxon's public resignation warning about risks from self-improving AI, has pushed state policymakers to accelerate their AI safety oversight efforts.
- If you're a subscriber, click here for the full edition of this update. Or, click here to learn more about our MultiState.ai+ subscription.
Rogue AI agent incidents and now the resignation and warnings of AI researcher Jacob Coxon, among other factors, are shifting AI policy back to the states, and it's happening quickly. Governors in California, New York, and Illinois have taken steps to implement their states' AI safety laws and are considering ways to build upon them. And they may not wait until their legislatures reconvene in January. An important aspect of this expansion is how much and how quickly third parties will have access to frontier AI models to ensure developers are following robust safety precautions. Illinois launched this discussion this year by enacting third-party audit requirements, and California will build on it with a framework for independent verification organizations for those auditors.
Last year, California (CA SB 53) and New York (NY SB 6953) enacted AI safety bills that require frontier model developers to have safety plans and share those plans with the state and the public. One feature of those original bills that did not make the final enacted versions was a requirement for third-party auditors to ensure that those safety plans were being followed (New York actually enacted the requirement in December, then removed it in a March chapter amendment). This year, Illinois succeeded where those other bills failed and enacted a law (IL SB 315) that includes this third-party auditor requirement. However, as of today, no such auditing industry exists as envisioned, and the Illinois law gives the industry until 2028 to come to fruition.
Frontier AI Models
Frontier AI models are the most advanced and capable artificial intelligence systems currently in development or deployment, typically characterized by their large scale, significant computational requirements, and potential to pose novel safety risks. These models represent the cutting edge of AI capabilities and are the primary focus of state AI safety legislation because of their potential to cause harm if not properly controlled. States like California, New York, and Illinois have specifically targeted frontier model developers with safety plan requirements and audit mandates.
Frequently Asked Questions
What states currently require third-party audits of frontier AI models?
Illinois is the only state that has enacted a third-party audit requirement for frontier AI models through IL SB 315, though those requirements don't take effect until 2028. California and New York enacted AI safety bills requiring frontier model developers to have safety plans, but neither state currently mandates third-party audits as part of those laws.
What are independent verification organizations (IVOs) and how do they work in California?
Independent verification organizations are private auditors with demonstrated expertise in assessing AI system risks that can be designated by California's Government Operations Agency under CA SB 813. AI developers can voluntarily hire these IVOs to review their safety practices and gain an evidentiary benefit if later sued, though the designation is not a state endorsement and hiring an IVO is not required.
When do AI auditors need to register with California and what are the requirements?
Starting January 1, 2029, anyone conducting an AI audit for compliance with California law must register with the state under CA AB 1405. Registered auditors must disclose which California laws they audit under, maintain strict independence from clients (including not auditing systems they helped design or develop), and submit detailed reports documenting their findings and any deficiencies.
What is Governor Newsom's executive order asking for regarding AI safety oversight?
Governor Newsom's September 2026 executive order asks experts to deliver recommendations by November 16, 2026 on strengthening California's AI safety laws, including requiring frontier developers to embed IVOs onsite in their labs, requiring independent verification of safety frameworks, and requiring an auditable "kill switch" for frontier models. The order also directs the government agency to accelerate the IVO framework implementation from 2028 to May 2027.
What expertise is needed to conduct third-party AI safety audits under state laws?
AI safety audits require a combination of traditional accounting expertise and specialized AI technical knowledge. Illinois SB 315 requires auditors to follow generally accepted auditing standards while employing or contracting with individuals who have technical expertise in frontier model safety, which in practice could mean accounting firms partnering with AI safety evaluators like METR or Redwood Research.
