California races to build AI safety oversight by 2027

On Friday, September 18, 2026, Governor Gavin Newsom signed Executive Order N-9-26, effective immediately. The order:

1. Accelerates SB 813 (McNerney) — the first-in-the-nation framework for certifying independent verification organizations (IVOs). GovOps must complete the requirements of Government Code § 8898.1 and publicly post IVO application requirements, procedures and criteria by May 1, 2027 (statutory deadline had been Jan 1, 2028 — accelerated ~8 months).
2. Accelerates AB 1405 (Bauer-Kahan) — the state AI Auditor Registry. GovOps must complete the registry infrastructure under § 11549.82(a) and begin the § 11549.82(b) actions (registration numbers, public information) by December 1, 2027 (statutory deadline had been Jan 1, 2029 — accelerated ~13 months). The statutory bar on offering/selling/conducting a covered AI audit without registration remains Jan 1, 2029 (unchanged).
3. Orders recommendations by November 16, 2026 from GovOps, in consultation with Cal OES and national experts, on the technical feasibility and potential efficacy of amending state AI safety/security law, covering at least four items:
   • (a) requiring all large frontier developers to embed designated IVOs onsite in their labs for periodic audits and evaluations;
   • (b) requiring that the safety frameworks, transparency reports and risk assessments frontier companies file under state law be independently verified;
   • (c) requiring the creation of a "kill switch" for frontier models, with the switch's efficacy verified on an ongoing basis by an IVO;
   • (d) updating the definition of critical safety incidents to include a range of loss-of-control incidents (e.g., the Hugging Face attack).

The preamble recites the trigger events: "multiple instances of apparent attempts by individuals to use AI products to create bioweapons and AI agents … to defeat security protocols that AI companies had put in place … in some instances undetected for months, to hack other companies," plus "inaction by Congress" and "a failure of leadership by the President." The order explicitly states it "is not intended to, and does not, create any rights or benefits, substantive or procedural, enforceable at law or in equity" — i.e., it imposes obligations on state agencies only; any private-sector duty requires legislative amendments.

In the accompanying release and remarks, Newsom said "the federal government's abject failure to create any form of meaningful AI oversight or accountability should alarm every American, especially when AI CEOs themselves are begging for regulation," and called on Congress and the President to adopt California's framework as a national floor. The same day he signed AB 1405/SB 813 referenced as "last week" (~Sept 9), the order arrives two years after Newsom vetoed SB 1047 (Sept 29, 2024) — the bill that would have mandated third-party auditors, a kill switch and clearer liability.

• Before: California's regime was disclosure-first. SB 53 (2025, in effect 2026) required frontier developers to publish safety frameworks, report specified critical safety incidents, and protect whistleblowers — but nothing mandated third-party verification, onsite auditors, or an emergency shutdown capability; SB 1047's kill-switch requirement was vetoed in 2024. SB 813/AB 1405 (signed ~Sept 9, 2026) created the framework for IVOs and an auditor registry with distant statutory deadlines (Jan 2028 / Jan 2029) but no requirement that any company use them.
• Change (Sept 18, 2026): EO N-9-26 (1) compresses the SB 813/AB 1405 implementation calendar by ~8–13 months with legally binding agency deadlines; (2) launches a 59-day expert-review process (due Nov 16, 2026) explicitly tasked with assessing onsite IVO embedding, independent verification of disclosures, a kill switch with ongoing efficacy verification, and expanded loss-of-control incident reporting; (3) signals, in the Governor's words, that California should be "the national baseline."
• After (as of window end): State agencies are on the clock; the four measures are formally "proposals under expert review" — not law. But the political direction is unambiguous and the Nov 16 recommendations are the obvious feedstock for a possible special session (Newsom floated one in POLITICO on Sept 17) and/or the 2027 legislative session, with the Jan 1, 2029 unregistered-audit ban as the backstop statutory landmark.

• Legal mechanism: A California executive order binds state agencies but cannot impose duties on private companies. All three operative paragraphs of N-9-26 name only the Government Operations Agency (with Cal OES consulted). Any measure in items (a)–(d) would require amendments to existing state law, i.e., the Legislature (possibly in a special session), which the order's own text presupposes ("amendments to existing state laws regarding AI safety and security").
• Deadline 1 (May 1, 2027): GovOps completes § 8898.1 — IVO application requirements, procedures, criteria — and publicly posts them. This operationalizes SB 813's certification regime for organizations that will (per the proposals) audit frontier models.
• Deadline 2 (Dec 1, 2027): GovOps completes § 11549.82(a) (AI Auditor Registry infrastructure) and begins § 11549.82(b) (issuing registration numbers, publishing auditor information). The statutory ban on unregistered covered AI audits still binds Jan 1, 2029.
• Deadline 3 (Nov 16, 2026): GovOps + Cal OES deliver recommendations on items (a)–(d). The order frames the deliverable as "technical feasibility and potential efficacy" — an explicit feasibility gate for the kill switch, which the order itself does not define (no activation triggers, no holder, no scope over weights/endpoints/deployed copies).
• Underlying law it accelerates/extends: SB 53 (Transparency in Frontier Artificial Intelligence Act, 2025) — disclosure + incident reporting + whistleblower protections; SB 813 (2026) — IVO certification framework; AB 1405 (2026) — auditor registry and independence/transparency/integrity standards; prior EOs N-12-23 (2023, safe state AI use) and N-5-26 (March 30, 2026, procurement civil-rights/privacy protections).

• California hosts the bulk of the world's frontier-model capacity (Anthropic, OpenAI, Google DeepMind, Meta AI, xAI labs among others; the order cites 32 of the top 50 private AI companies). A California rule effectively sets the US standard because there is no other domestic market of comparable weight — the "Brussels effect" applied to Sacramento.
• The order converts a two-year-old veto into a state-directed regulatory program with concrete dates: IVO criteria in ~8 months, registry in ~15 months, expert recommendations in 59 days. Enterprises, labs and their counsel now face a real compliance clock rather than a policy debate.
• The kill switch — previously rejected as "restrict[ing] AI development … at the potential expense of curtailing the very innovation that fuels advancement" (2024 veto letter) — is now an explicit state feasibility study item with IVO-verified efficacy as design constraint. Even as a study item, it reframes the national conversation: state government, not just safety advocates, is formally asking what "off" means for frontier models.
• It happens in a specific political context: Newsom's term ends January 2027, he is expected to weigh a 2028 presidential run, and the order is explicitly pitched as a national-adoption model — positioning AI governance as a 2028 Democratic primary differentiator (POLITICO, CNBC).

• A certified independent verification organization (IVO) industry — the state will define application requirements, procedures and criteria by May 1, 2027; "independent verification of AI" becomes a licensable, auditable business category.
• A kill-switch requirement with engineering consequences — if item (c) survives expert review and becomes law in 2027, frontier developers must design, maintain and prove an emergency shutdown capability, verified continuously by a certified third party.
• Onsite audits — auditors embedded inside frontier labs for periodic evaluations, a structural change to lab security, IP and data governance.
• Expanded incident reporting — a loss-of-control incident category would force reporting of events like the Hugging Face attack that currently fall outside SB 53's four statutory gates.
• A national floor narrative — California explicitly offering its framework as the "national baseline," which feeds federal preemption debates (the Trump administration's "AI Force"/czar posture vs. state action) and could shape other states' legislation (Illinois SB 315, New York RAISE Act, Connecticut CART Act pattern per AI Governance Update).

1. What does "kill switch for frontier models" mean operationally — training clusters, inference endpoints, deployed copies, downloaded weights, or some subset?
2. Who can pull the switch, under what activation triggers, and who verifies the verification (IVO-of-IVOs)?
3. How is "efficacy verified on an ongoing basis" measured — latency-to-stop, coverage %, reversibility tests, chaos drills?
4. Which developers count as "large frontier developers" for items (a)–(d) — does scope track SB 53's thresholds or broaden?
5. What qualifies as a "loss-of-control incident" — does it include near-misses, agent lateral movement, jailbreaks that defeat security controls (the CASRAI-flagged precursor gap)?
6. Will Newsom call a special session (he floated one in POLITICO on Sept 17) so recommendations become law before his term ends?
7. Will the Nov 16 recommendations become the 2027 legislative vehicle, and who authors it (Wiener? McNerney? Govt-ops-drafted)?
8. Does the federal AI Force/czar posture preempt, tolerate or fight a California kill-switch mandate?
9. What do the named national experts (announced Sept 23) bring to feasibility analysis — and how independent are they from the labs they would audit?
10. Will open-weight releases be carved out, and if so, does that hollow out the mandate?

• Sept 23, 2026 (observed, outside window): Gov.ca.gov announces the world-leading expert group that will deliver on the order — the "convening national experts" step of item 3 is underway (headline observed on gov.ca.gov news sidebar during research).
• Nov 16, 2026: GovOps + Cal OES deliver the four-part recommendations to the Governor's office — the single most important near-term artifact; watch for special-session signals.
• 2027 session (or special session): any kill-switch/onsite-IVO/verified-filing/incident-expansion measures would be introduced as amendments to SB 53's framework.
• May 1, 2027: IVO application requirements, procedures and criteria posted by GovOps.
• Dec 1, 2027: AI Auditor Registry infrastructure complete; registration actions begin.
• Jan 1, 2029: statutory ban on offering/selling/conducting covered AI audits without registration (unchanged by the EO).
• Ongoing: federal reaction (AI Force/czar posture), other states' copycat legislation, industry positioning on feasibility, and 2028-primary positioning by Newsom and rivals.

The real story of EO N-9-26 is a shift from disclosure to enforced assurance on a hard calendar: the same governor who vetoed a mandatory kill switch two years ago now orders his own agencies to design one — and to build, by spring 2027, the certification and registry machinery that could make it enforceable. The irresistible headline is "California orders an AI kill switch"; the accurate story is "California puts a kill switch, onsite auditors and verified safety filings on a 59-day study clock with binding implementation dates." Cover the substance, not the shorthand: the order creates obligations for Sacramento agencies today, and for Silicon Valley only if the Legislature acts next year — but every lab inside that pathway is now expected to show their work. For enterprises and auditors, the Nov 16, 2026 recommendations and the May/Dec 2027 milestones are the concrete dates that turn this from policy theater into a compliance calendar.