Independent third-party AI auditors will act like financial accounting firms: investigating and verifying safety protocols and legal compliance. They’re a critical part of the safeguards needed around powerful frontier AI models. (Photo: Getty Images for Unsplash+)
This article draws on data in the Transparency Coalition’s 2026 State AI Legislation Report.
Oct. 28, 2026 — The world became aware of the urgent need to create safeguards around powerful frontier AI models earlier this year with news of the OpenAI attack on Hugging Face. But even before that incident, state lawmakers were laying the foundation for those safeguards. One of the key elements: Independent third-party auditors.
What that means in plain language: Scrutiny and verification.
Third-party auditing happens every day in business. The big accounting firms (KMPG, Deloitte, et al) regularly audit and verify the financial records of Fortune 500 companies. Those firms put their reputation on the line when they sign off on a corporation’s financials. It’s a system that offers assurance to the world’s financial markets: The quarterlies filed by Apple and IBM are true. A single case of fraud can destroy an auditor. Case in point: Arthur Andersen, which signed off on Enron’s books and collapsed as a result.
In the world of tech and AI, it’s become clear that a similar kind of auditing is needed. It’s not financial. It’s technical and legal. Independent verification organizations, known as IVOs, need access to an AI developer’s internal systems in order to verify the company is following current state law (and eventually federal law) in terms of its safety protocols and legal compliance.
Establishing standards in state law
Currently the only generally recognized AI risk management framework is the one released in 2023 by the National Institute for Standards and Technology (NIST), an independent lab funded by the federal government. The NIST AI Risk Management Framework (AI RMF) is intended to improve the ability to incorporate trustworthiness considerations into the design, development, use, and evaluation of AI products, services, and systems. It is currently in the process of being updated.
The NIST standards are entirely voluntary. State lawmakers are using them as a baseline to build a robust set of standards that are codified into law.
New laws in California, Illinois, and Virginia
Lawmakers in three states this year enacted measures to get that process rolling.
In Virginia, legislators enacted HB 797, which directed the state’s Joint Commission on Technology and Science (JCOTS) to investigate and recommend legislation to license independent third-party AI auditors (IVOs) under the authority of an existing or new state agency. If HB 797 works as intended, Virginia legislators should be considering a bill in early 2027 that creates a state licensing process for IVOs. Given the Washington D.C. Beltway’s robust government-led tech industry, this could make Virginia fertile ground for IVO start-up companies.
In lllinois, the Artificial Intelligence Safety Measures Act, SB 315, requires frontier AI developers to conduct annual independent third-party audits. The new law also establishes access, retention, and publication requirements for those audit results. That audit mandate acts as the foundation for the overall Act, which requires frontier AI model developers to implement, publish, and annually update a frontier AI framework addressing catastrophic-risk assessment, mitigations, cybersecurity, internal governance, and risks. It also requires transparency reports before deploying new or modified frontier models, as well as summaries of catastrophic-risk assessments. We have further details here.
In California, legislators created a pair of complementary measures to establish both third-party audit standards and a state licensing process for IVOs. SB 813 and AB 1405 work in tandem to create industry standards and a state agency registry, putting up a framework within which independent verification organizations can begin to operate. SB 813 asks the state Government Operations Agency to convene stakeholder working groups to establish standards and procedures for IVOs. AB 1405 stands up a state AI Auditor Registry and prohibits any unregistered person or company from offering or conducting an AI audit.
Transparency Coalition experts involved
The Transparency Coalition’s team of policy and technical experts have been and continue to provide information to lawmakers working on third-party audit standards and legislation. Our team members offered input on bill language in Illinois, testified at hearings for the California measures, and presented an overview of issues and factors to Virginia’s Joint Commission on Science and Technology.
We’re committed to providing accurate information to lawmakers in the effort to construct strong, appropriate, and effective AI auditing standards. Third-party verification is a critical component in AI safety, while also providing the assurance that developers and their investors need to thrive while playing by the rules.
For more information on third-party audit legislation, contact TCAI co-founder Jai Jaisimha at info@transparencycoalition.ai.
More on the new ai laws of 2026
