A running record of state and national measures on third-party AI oversight, and what each one does and does not require. The clock on the main page tracks the Accord's items 3 and 4. This page tracks the law around them.
No. Use of third-party assessors must be disclosed.
Signed Sept. 29, 2025. State reports begin Jan. 1, 2027.
Upcoming milestones
Virginia's Joint Commission on Technology and Science must report its findings and recommendations on a framework for independent verification organizations. HB 797
California's Office of Emergency Services and Attorney General begin annual anonymized reports on critical safety incidents and whistleblower reports. The Department of Technology's first recommendations on the law's definitions are due, and a framework report on the CalCompute public computing cluster is due if funded. SB 53
Connecticut's pilot for approved independent verification organizations takes effect, subject to appropriations. SB 5
California must have its application and designation framework for independent verification organizations in place. SB 813
Illinois's annual independent audits for large frontier developers begin, on the later of this date or 90 days after a developer first qualifies. SB 315
California's AI Auditor Registry must be live, and registration becomes required to offer, sell, or conduct a covered AI audit. AB 1405
Connecticut's independent verification pilot ends. SB 5
Timeline
Newest first. Each entry has a permanent link, so you can point readers straight to one.
A voluntary, four-part commitment announced by President Trump and signed by Google, Meta, Anthropic, SpaceXAI, Nvidia, and OpenAI. Items 1 and 2 cover internal controls and an internal team. Items 3 and 4 call for an independent external auditor or evaluator and an independent board committee. The Accord sets no deadlines, no public reporting, and no enforcement.
Requires audits?
Not enforceable. Item 3 commits each company to partner with an independent external auditor or evaluator, but nothing confirms or compels it.
Key dates
Announced at 5:24 PM ET on September 29, 2026. No deadlines for any item.
Relevance to items 3 and 4
This is the source of items 3 and 4. Both are marked not completed on the main page.
Directs California's Government Operations Agency to create a voluntary designation for "independent verification organizations": AI auditors with demonstrated expertise in assessing AI risk. The criteria are developed with stakeholder working groups that must include safety experts and engineers from competing AI companies. A designated organization may be paid at reasonable market rates but may not accept payment that depends on the results of its assessment.
Requires audits?
No. The law states that no developer, deployer, or operator must hire one of these organizations or undergo an audit to operate in California.
Key dates
Signed September 9, 2026 (Chapter 179, Statutes of 2026). The agency's application and designation framework is due by January 1, 2028.
Relevance to items 3 and 4
Creates a state pathway for the kind of independent evaluator item 3 describes. It does not require any company, including Accord signers, to use one.
Starting January 1, 2029, no one may offer, sell, or conduct an audit of an AI system's compliance with California law unless registered with the Government Operations Agency. Registered auditors must follow independence rules (no conflicting relationships, no auditing their own work, no job negotiation with the audited company during an audit), keep records for ten years, and may not retaliate against employees who report problems. Violations can lead to removal from the registry and referral to the Attorney General.
Requires audits?
No. It regulates who may perform covered audits, not whether any company must be audited. It sets no fines and creates no private right of action.
Key dates
Signed September 9, 2026 (Chapter 178, Statutes of 2026). Registry must be established and registration required by January 1, 2029.
Relevance to items 3 and 4
Sets conduct and independence rules that could apply to an external auditor like the one item 3 describes. It covers only audits of compliance with state law, so it may not reach every audit an Accord signer commissions.
Requires large frontier developers (over $500 million in annual revenue, training models above 10^26 operations of compute) to retain an independent third-party auditor each year to audit their compliance with the Act, which covers their published safety framework, transparency reports and incident reporting. The auditor must follow generally accepted auditing standards, have demonstrated frontier-AI safety expertise, and have no financial interest in the developer (or the reverse). The developer may pay the auditor but cannot tie payment to the audit's results. The audit report must assess the developer's internal controls, including how it designates and empowers senior personnel responsible for compliance, and must disclose the auditor's conflict-of-interest procedures. Within 30 days of receiving the report, the developer must publish a high-level summary and a redacted copy and send them to the Illinois Emergency Management Agency and Office of Homeland Security and to the Attorney General. Only the Attorney General can enforce the law, with civil penalties of up to $1 million for a first violation and up to $3 million for later ones; failing to obtain the audit is a listed violation. A developer can instead follow a federal standard only if the state agency designates it, and a designated federal standard must require independent third-party audits substantially equivalent to or stricter than Illinois's.
Requires audits?
Yes. Annual independent third-party audits of compliance. Of the laws tracked here, it is the only one that mandates them.
Key dates
Signed July 6, 2026. Takes effect January 1, 2027. Audits begin on the later of January 1, 2028 or 90 days after a developer first qualifies as a large frontier developer.
Relevance to items 3 and 4
The first enacted law tracked here that requires what item 3 describes: an independent external auditor, with results published in redacted form. Item 4 (an independent board committee) has no counterpart: the law does not require a board committee, though the audit must assess how the developer designates and empowers senior personnel responsible for compliance. Its federal-equivalence clause would matter if a federal bill sets a lower standard.
A broad act on online safety and AI, most of which concerns other topics such as companion chatbots, hiring tools, and workforce programs. Its Section 33 creates a pilot in which the Department of Consumer Protection approves up to five independent verification organizations to assess whether AI models meet standards for preventing personal injury, property damage, data privacy harms, and other harms. Evidence of verification can be used only in private civil lawsuits and cannot be used in Attorney General or state-agency enforcement, with exceptions for reckless conduct, misrepresentation, and failure to implement required corrective action. Separately, Section 2 protects employees of frontier developers who report catastrophic-risk concerns and requires large frontier developers to keep an anonymous internal reporting process.
Requires audits?
No. The pilot is voluntary, and nothing in the act requires a developer to be verified or audited.
Key dates
Signed May 27, 2026. Whistleblower provisions take effect October 1, 2026, and large frontier developers' internal reporting process is due by January 1, 2027. The pilot section takes effect July 1, 2027, is subject to available appropriations, and ends June 30, 2030. The state's evaluation of the pilot is due December 31, 2028.
Relevance to items 3 and 4
A state-run test of the third-party verification model behind item 3, limited to up to five organizations and with no mandate for developers. The act does not require an independent auditor (item 3) or an independent board committee (item 4); internal reports go to officers and directors.
Directs the Joint Commission on Technology and Science (JCOTS) to evaluate the feasibility and impact of a framework for independent verification organizations that would assess whether AI models or applications meet standards for preventing personal injury and property damage. If JCOTS recommends a framework, it must also study a licensing scheme and whether the Virginia Information Technologies Agency or another state agency could run it. This is a study only. It creates no framework, licensing, or audit requirement.
Requires audits?
No. Study only.
Key dates
Approved April 8, 2026 (Chapter 425), effective July 1, 2026. JCOTS must report its findings and recommendations by November 1, 2026.
Relevance to items 3 and 4
Shows another state weighing the verification-organization model that California's SB 813 and Connecticut's pilot are building. The November 1 report is the next milestone to watch. Nothing here requires an audit.
New York's frontier AI safety law, signed in December 2025 and amended in March 2026 (reported signing date: March 27, 2026) to align closely with California's SB 53. The original version required large developers to retain a third party each year for an independent compliance audit. The amendment (Senate bill S8828) replaces the law with a disclosure regime: large frontier developers (over $500 million in annual revenue, models trained with more than 10^26 operations) must publish a frontier AI framework that says how they use third parties to assess catastrophic risk and the effectiveness of mitigations, and each transparency report must summarize the extent to which third-party evaluators were involved. There is no audit mandate. Critical safety incidents must be reported within 72 hours (24 hours if there is imminent risk of death or serious injury) to a new office within the Department of Financial Services, which also runs a developer registration and disclosure process. The Attorney General can seek civil penalties up to $1 million for a first violation and $3 million for later ones. There is no private right of action.
Requires audits?
No. The original audit mandate was removed in the amendment.
Key dates
Original signed December 2025. Amendment reported signed March 27, 2026. Effective January 1, 2027. The amendment's text also directs the new office to report annually starting January 1, 2028.
Relevance to items 3 and 4
A contrast case. New York's original text included the independent audit that item 3 describes, then removed it. What remains is disclosure of whether and how third-party evaluators were used, with no requirement that anyone independent verify the developer, and no independent board committee requirement. It shows an audit mandate proposed and then dropped.
Requires "large frontier developers" (those with over $500 million in annual revenue that train models using more than 10^26 operations of compute) to publish a safety framework and transparency reports, report critical safety incidents to the state, and protect employees who raise safety concerns. Developers describe their own risk practices, including whether and how they use third-party assessors. The Attorney General can seek civil penalties of up to $1 million per violation.
Requires audits?
No. Developers must describe how they use third-party assessors and summarize their involvement in transparency reports, but nothing requires them to hire one.
Key dates
Signed September 29, 2025 (Chapter 138, Statutes of 2025). Annual state reports on incidents and whistleblower disclosures begin January 1, 2027.
Relevance to items 3 and 4
The closest existing California law to the Accord's controls. It requires disclosure of risk practices, incident reporting, and internal governance, and it asks developers to say how they use third-party evaluators. It does not require an independent external auditor (item 3) or an independent board committee (item 4).
Updated the Illinois SB 315 entry from the enrolled text.
Updated the New York RAISE Act entry from the text of S8828.
Updated Connecticut SB 5 from the enacted text (Public Act 26-15).
Added Illinois SB 315, Connecticut SB 5, Virginia HB 797, and the New York RAISE Act (as amended).
Added SB 53 (California).
Page created. Added the White House Accord, SB 813, and AB 1405.
This page summarizes public documents in plain language and is not legal advice. Check each linked source for exact wording. Spotted an error? Contact Lisa Bates.