Who this is for: AI auditors, compliance officers, C3PAOs, audit firms, regulatory agencies, AI system deployers subject to third-party audit. Maps SB 813 auditor registration and methodology requirements to cryptographic witness evidence.

Bill Status: Introduced

SB 813 has been introduced in the California Legislature. This crosswalk reflects the introduced text and will be updated as the bill progresses. Why prepare now: California's AI legislative pattern -- SB 942, SB 1000, SB 1119, AB 2013 -- shows a trajectory toward enforceable auditor standards. Firms that build evidence infrastructure before the registry opens will be positioned to register immediately, while competitors scramble to retool. The methodology requirements in SB 813 formalize what sophisticated AI auditors already do. SWT3 makes it provable.

Why This Changes the AI Audit Conversation

Today: When a regulator or client asks "how do I know your AI audit was thorough," the auditor produces a PDF report. The report claims bias testing was performed, documentation was reviewed, and independence was maintained. But nothing in the report is independently verifiable. The reader must trust the auditor's word -- the same trust model that failed in financial auditing and led to SOX.

With SWT3: Every step of the audit methodology -- independence screening, bias evaluation, explainability assessment, documentation access, human oversight -- produces a tamper-evident Witness Anchor. The CDT registry, the client, or any third party can verify that the claimed methodology was actually executed, in what order, and by whom. The audit report becomes a summary of evidence that already exists in a verifiable chain, not the sole record of what happened.

The shift: AI auditing moves from "trust the auditor" to "verify the audit." SB 813 sets the regulatory expectation. SWT3 provides the evidence infrastructure to meet it.

Contents

1. Quick Reference 2. What Does SB 813 Require? 3. Requirement-to-Procedure Mapping 4. Procedure Detail Cards 5. Independence and Conflict of Interest 6. Quick Reference: Examiner Questions 7. Quick Start 8. References

1. Quick Reference

BillSB 813 -- California AI Auditor Registry Act
AuthorCalifornia State Senate
StatusIntroduced -- advancing through committee
Registry authorityCalifornia Department of Technology (CDT)
ScopeAll entities performing AI audits for California-regulated businesses
Key provisionsAuditor registration, competency standards, conflict of interest rules, standardized methodology, annual reporting, enforcement with civil penalties
EnforcementCDT registration revocation; civil penalties for unregistered auditors
SWT3 procedures mapped7

2. What Does SB 813 Require?

SB 813 establishes California's first mandatory registry for AI auditors. Any entity performing AI audits for businesses regulated under California law must register with the California Department of Technology (CDT) before conducting audit work. This is a structural shift -- previously, any firm could claim AI audit competency without demonstrating it to a regulatory body.

The bill introduces competency standards that registered auditors must satisfy. These include demonstrated expertise in AI systems evaluation, bias testing methodologies, and risk assessment frameworks. The competency requirement is ongoing -- auditors must maintain their qualifications, not simply demonstrate them at initial registration.

A critical provision addresses conflict of interest. Auditors are prohibited from auditing AI systems they helped develop, train, or deploy. Mandatory independence disclosures must accompany every audit engagement. This mirrors established financial audit independence rules (SOX Section 201) but applies them specifically to the AI audit context.

SB 813 also mandates standardized audit methodology. Registered auditors must follow prescribed methods that include bias evaluation, explainability assessment, and documentation review. This eliminates the current fragmented landscape where audit firms define their own scope and methods, often producing incomparable results across engagements.

Annual reporting creates ongoing accountability. Registered auditors must submit reports to CDT detailing audits conducted, findings identified, and remediation outcomes tracked. This creates a public accountability layer -- CDT can identify audit firms that consistently fail to identify issues, or that perform a high volume of audits with suspiciously low finding rates.

The enforcement mechanism is straightforward: CDT may revoke registration for non-compliance, and unregistered auditors performing AI audits face civil penalties. This creates a two-sided incentive -- auditors must register to operate legally, and must maintain standards to keep their registration.

Why This Matters for SWT3 Users

SWT3 witness evidence directly supports multiple SB 813 requirements. Audit firms can demonstrate methodology compliance through cryptographic witness anchors that record each step of the audit process. The immutable evidence chain provides CDT with verifiable proof that prescribed methods were followed, bias evaluations were conducted, and findings were documented with cryptographic integrity.

For organizations being audited, SWT3 anchors serve as pre-existing evidence that registered auditors can verify. Rather than producing compliance artifacts on demand during an audit engagement, organizations with continuous SWT3 witnessing already have the evidence trail that SB 813's methodology requirements call for.

3. Requirement-to-Procedure Mapping

SB 813 RequirementProvisionSWT3 Procedure(s)Evidence Description
Auditor registration and qualificationRegistrationAI-AUDIT.1Audit log integrity records auditor identity, credentials, and registration status for every engagement
Competency in bias testingCompetency StandardsAI-FAIR.1Fairness evaluation witnessing records bias testing methodology, protected attributes evaluated, and statistical results
AI systems evaluation capabilityCompetency StandardsAI-ASSESS.1Champion-challenger assessment records evaluation methodology and comparative analysis
Conflict of interest disclosureIndependence RulesAI-GOV.1Governance attestation records independence declarations, prior relationships, and conflict screening results
Explainability assessmentMethodologyAI-EXPL.1Explanation generation witnessing records interpretability methods applied and explanation fidelity metrics
Documentation reviewMethodologyAI-ACC.1Access control witnessing records what documentation was reviewed, by whom, and evidence of completeness
Human oversight of audit processMethodologyAI-HITL.1Human-in-the-loop witnessing records reviewer identity, override decisions, and escalation points during audit
Annual reporting to CDTReportingAI-AUDIT.1Audit log aggregation provides cryptographically verifiable summary of all engagements, findings, and remediation outcomes
Remediation outcome trackingReportingAI-ASSESS.1, AI-AUDIT.1Assessment witnessing records pre- and post-remediation state; audit log tracks remediation verification
Standardized methodology complianceMethodologyAI-GOV.1, AI-AUDIT.1Governance attestation records methodology selection; audit log records each methodology step executed

4. Procedure Detail Cards

AI-AUDIT.1

Audit Log Integrity

SB 813 requires: Registered auditors must maintain complete records of all AI audits conducted, including findings and remediation outcomes. Annual reports submitted to CDT must accurately reflect audit activity. Unregistered auditors face civil penalties, making registration status a critical audit metadata element.

How SWT3 addresses it: SWT3 witnesses every audit engagement as an immutable anchor. Each anchor records auditor identity, registration status, methodology applied, and findings produced. The cryptographic evidence chain provides CDT with tamper-evident proof that audit records submitted in annual reports match the actual work performed. Factor data captures engagement scope, system under audit, and finding severity classification.

Assessor Tip

Verify that AI-AUDIT.1 anchors exist for every engagement claimed in the auditor's CDT annual report. Cross-reference anchor timestamps with engagement dates. Missing anchors for reported engagements -- or anchors for unreported engagements -- indicate record integrity issues that CDT should investigate.

AI-GOV.1

Governance Attestation

SB 813 requires: Auditors must disclose conflicts of interest before every engagement. They cannot audit AI systems they helped develop. Mandatory independence declarations must accompany audit reports. The governance structure of the audit firm itself must support these independence requirements.

How SWT3 addresses it: SWT3 witnesses governance attestations including independence declarations, conflict screening results, and organizational separation documentation. Each attestation anchor records the auditor's relationship history with the auditee, any prior development involvement, and the independence determination. This creates a verifiable chain that CDT can audit across multiple engagements to detect undisclosed conflicts.

Assessor Tip

Look for AI-GOV.1 anchors dated before the audit engagement start date. Independence screening must precede audit work, not follow it. If the governance attestation timestamp is after the first AI-AUDIT.1 anchor for the same engagement, the firm may have begun work before completing conflict screening.

AI-ASSESS.1

Champion-Challenger Assessment

SB 813 requires: Auditors must demonstrate competency in AI systems evaluation. The standardized methodology requires comparative analysis, including evaluation of the AI system's performance against stated objectives, alternative approaches, and risk thresholds.

How SWT3 addresses it: SWT3 witnesses assessment events that record evaluation methodology, comparative baselines, and assessment outcomes. The anchor chain documents how the auditor applied the standardized methodology and whether the AI system met, exceeded, or fell short of each evaluation criterion. Pre- and post-remediation assessments are linked, enabling CDT to verify that remediation claims are substantiated.

Assessor Tip

Pair AI-ASSESS.1 anchors with AI-FAIR.1 and AI-EXPL.1 to confirm that the auditor applied all three required methodology components (system evaluation, bias testing, explainability). An audit with assessment anchors but no fairness anchors suggests incomplete methodology application.

AI-EXPL.1

Explanation Generation

SB 813 requires: Audit methodology must include explainability assessment. Auditors must evaluate whether the AI system under review can produce meaningful explanations of its decisions, particularly for high-risk applications affecting individuals' rights, employment, or access to services.

How SWT3 addresses it: SWT3 witnesses explainability evaluations, recording the interpretability methods applied (feature importance, counterfactual analysis, attention visualization), explanation fidelity metrics, and the auditor's determination of whether explanations meet the threshold for the system's risk classification.

Assessor Tip

Check that AI-EXPL.1 anchors reference the specific interpretability methods used. SB 813 requires substantive explainability assessment, not a checkbox. Anchors that record only "explainability reviewed" without method details may indicate superficial compliance.

AI-FAIR.1

Fairness Evaluation

SB 813 requires: Registered auditors must demonstrate competency in bias testing. The standardized methodology requires bias evaluation across protected attributes. Audit findings must document any disparate impact identified and the statistical methods used to detect it.

How SWT3 addresses it: SWT3 witnesses fairness evaluation events, recording protected attributes tested, statistical methods applied (disparate impact ratio, equalized odds, demographic parity), sample sizes, and results. The anchor chain provides CDT with verifiable evidence that the auditor applied rigorous bias testing, not a cursory review.

Assessor Tip

Verify that AI-FAIR.1 anchors document the specific protected attributes evaluated. California law recognizes a broad set of protected classes. An anchor that records testing for only one or two attributes when the system makes employment or housing decisions may indicate insufficient scope.

AI-ACC.1

Access Control Witnessing

SB 813 requires: Audit methodology must include documentation review. Auditors need controlled access to system documentation, training data descriptions, model cards, and deployment records. The access itself must be documented to ensure the audit was conducted with sufficient information.

How SWT3 addresses it: SWT3 witnesses access control events during the audit engagement, recording what documentation was requested, what was provided, what was withheld, and the access control decisions at each step. This creates an auditable trail of the auditor's information access, supporting both the auditor's methodology claims and the auditee's cooperation obligations.

Assessor Tip

Review AI-ACC.1 anchors for evidence of documentation gaps. If the auditor requested model training documentation but the anchor records it as withheld, this should appear as a scope limitation in the audit report. Missing access anchors for critical documentation categories suggest the auditor did not request necessary materials.

AI-HITL.1

Human-in-the-Loop Oversight

SB 813 requires: Audit methodology must include human oversight at critical decision points. Automated scanning tools may assist, but human judgment is required for findings determination, risk classification, and remediation recommendations. The auditor's professional judgment must be documented.

How SWT3 addresses it: SWT3 witnesses human-in-the-loop events during the audit process, recording reviewer identity, decision points where human judgment was applied, any overrides of automated findings, and escalation actions. This distinguishes audits conducted with genuine human oversight from those that relied entirely on automated tooling.

Assessor Tip

Look for AI-HITL.1 anchors at key audit milestones: findings review, risk classification, and final report approval. An audit engagement with many AI-AUDIT.1 anchors but no AI-HITL.1 anchors may indicate excessive reliance on automated tooling without the human oversight that SB 813 methodology requires.

5. Independence and Conflict of Interest

SB 813's conflict of interest provisions deserve special attention because they represent the bill's most enforceable requirement. The prohibition on auditing systems you helped develop is absolute, not qualified. There is no materiality threshold or de minimis exception in the introduced text.

What Constitutes a Conflict

How SWT3 Supports Independence Documentation

The AI-GOV.1 procedure witnesses the independence screening process itself. Each screening event produces an anchor that records the conflict categories evaluated, the determination reached, and the evidence basis for that determination. Over time, this creates a registry-wide independence record that CDT can query across all of a firm's engagements.

For audit firms with multiple practice areas (consulting and audit), the anchor chain can demonstrate organizational separation. AI-GOV.1 anchors from the consulting engagement and AI-AUDIT.1 anchors from the audit engagement should reference different personnel, different engagement teams, and different approval chains. Overlapping personnel across both anchor sets would indicate a potential independence violation.

6. Quick Reference: Examiner Questions

Examiner QuestionWhere to Look
Is this auditor registered with CDT?AI-AUDIT.1 anchors should include registration status. Cross-reference with the CDT public registry when available.
How does the auditor demonstrate competency?AI-FAIR.1 + AI-EXPL.1 + AI-ASSESS.1 anchors collectively show bias testing, explainability assessment, and systems evaluation capability.
Was independence screening performed before the engagement?AI-GOV.1 anchor timestamp must precede the first AI-AUDIT.1 anchor for the same engagement.
Did the auditor follow standardized methodology?Check for anchors across all three required methodology components: AI-FAIR.1 (bias), AI-EXPL.1 (explainability), AI-ACC.1 (documentation review).
Are annual reports consistent with actual audit activity?Aggregate AI-AUDIT.1 anchors by calendar year and compare engagement count, finding count, and remediation tracking against the CDT annual report.
Was human oversight applied during the audit?AI-HITL.1 anchors at findings review, risk classification, and report approval milestones.
How are remediation outcomes tracked?Paired AI-ASSESS.1 anchors (pre- and post-remediation) linked by engagement identifier, with timestamps showing re-evaluation after remediation.
Does the audit firm maintain organizational separation?AI-GOV.1 governance attestations referencing information barriers, separate engagement teams, and independent approval chains for audit vs. consulting practices.

7. Quick Start

Python

pip install swt3-ai
from swt3_ai import Witness

w = Witness(
    endpoint="https://sovereign.tenova.io/api/v1/witness",
    api_key="axm_live_...",
    agent_id="ai-audit-engagement"
)

# Witness independence screening (SB 813 conflict of interest)
gov_anchor = w.record(
    procedure="AI-GOV.1",
    factor_a="independence_screening:complete",
    factor_b="conflicts_identified:none",
    factor_c="registration_status:active"
)
print(f"Governance attestation: {gov_anchor}")

# Witness bias evaluation (SB 813 methodology requirement)
fair_anchor = w.record(
    procedure="AI-FAIR.1",
    factor_a="protected_attrs:race,gender,age,disability",
    factor_b="method:disparate_impact_ratio",
    factor_c="sample_size:50000"
)
print(f"Fairness evaluation: {fair_anchor}")

# Witness audit finding (SB 813 annual reporting)
audit_anchor = w.record(
    procedure="AI-AUDIT.1",
    factor_a="engagement:ENG-2026-0142",
    factor_b="finding_severity:high",
    factor_c="remediation_status:open"
)
print(f"Audit finding: {audit_anchor}")

TypeScript

npm install @tenova/swt3-ai
import { Witness } from "@tenova/swt3-ai";

const w = new Witness({
    endpoint: "https://sovereign.tenova.io/api/v1/witness",
    apiKey: "axm_live_...",
    agentId: "ai-audit-engagement"
});

// Witness explainability assessment (SB 813 methodology)
const anchor = await w.record({
    procedure: "AI-EXPL.1",
    factorA: "method:feature_importance+counterfactual",
    factorB: "fidelity_score:0.87",
    factorC: "risk_classification:high"
});
console.log(`Explainability assessment: ${anchor}`);

Full SDK documentation: sovereign.tenova.io/docs

Create a free account: sovereign.tenova.io/signup

8. References