The California Test

---

California’s first answer to the frontier AI problem was SB 53, the Transparency in Frontier AI Act. It has been in force since January 1, 2026. It applies to developers that train models with more than 10^26 operations, and it places its heaviest duties, including the framework requirement, on ‘large frontier developers,’ those with more than $500 million in annual revenue (Business and Professions Code, Section 22757.11).

The law’s core requirement is a document the company writes itself. Each large frontier developer must ‘write, implement, comply with, and clearly and conspicuously publish’ a frontier AI framework describing how it identifies and manages catastrophic risk (Section 22757.12(a)). It must review that framework every year, and when it makes a material change, it must publish the change and a justification within 30 days (Section 22757.12(b)).

That is a real duty, and the page should say so plainly. A company that publishes a framework and then ignores it can be penalized. But notice who writes the rule. The law tells the company what its framework must cover. The company decides what it says. The standard the company is held to is the one the company drafted. In the language of Part 2, SB 53 answers the second question, who writes the standard, mostly with “the company.” 

The companies themselves describe two layers. Anthropic published its Frontier Compliance Framework for SB 53, and it keeps a separate Responsible Scaling Policy that it calls its “voluntary safety policy.” OpenAI says its Frontier Governance Framework is ‘designed to meet the baseline legal requirements,’ while its Preparedness Framework goes “beyond current legal requirements.”

Both companies keep the document the law requires separate from a broader one they maintain voluntarily. OpenAI says its broader framework goes beyond the law. Anthropic calls its own voluntary. But neither statement tells a reader which commitments the law can enforce and which the company can revise on its own, and neither proves that either layer is adequate. The same question applies to both companies, and the page asks it of both: when a company’s promises sit in two documents, which one can the state hold it to?  

One detail shows why that question matters. In the passages examined here, OpenAI’s Frontier Governance Framework, the one the law can enforce, doesn’t name who decides whether to deploy a model. Instead, it points elsewhere: “Additional detail about our deployment governance can be found in Appendix B of the PF,” meaning the voluntary Preparedness Framework (OpenAI SB 53 framework, Section 6, p. 18). Elsewhere, the same document says a model “may be approved,” without naming who approves it (Section 2.5).

Whether the appendix counts as part of the enforceable framework is an open question. The page doesn’t answer it, and it doesn't explain why the document was built that way. The point is narrower. A reader of the enforceable document can’t tell from that document who holds the authority to release a model. This cross-reference was first identified in a September 6 working session with ChatGPT.

SB 53 mentions outside checking several times. None of those provisions requires an independent check of whether the company complied.

The framework must describe the company’s approach to “using third parties to assess the potential for catastrophic risks” (Section 22757.12(a)(5)). The company’s transparency reports must state “the extent to which third-party evaluators were involved” (Section 22757.12(c)(2)). The extent can be none. The Office of Emergency Services ‘shall review’ the critical safety incidents companies report. That is real government review. But the law creates no process for independently verifying those reports (Section 22757.13(d)). The phrase closest to verification appears in a provision about the law’s own coverage. The state is to keep its definitions of covered companies “verifiable by parties other than the frontier developer” (Section 22757.14). Outsiders should be able to verify who is covered. Nothing in the law requires anyone outside the company to verify whether the covered companies comply.

The companies’ own documents follow the same pattern. OpenAI’s framework says outside evaluators “may” be included (Section 5). “May” is a description of an option, not a requirement.

No section of SB 53, from Section 22757.10 through Section 22757.16, requires independent verification. On the first question an auditor would ask, who chooses the checker, SB 53’s answer is that there is no checker to choose.

The law’s enforcement is real but narrow. A large frontier developer can be penalized for four kinds of failure: not publishing or transmitting a required document, making a false or misleading statement about its risk management, not reporting a critical safety incident, or not complying with its own framework. The penalty is up to $1,000,000 per violation, and an action may be “brought only by the Attorney General” (Section 22757.15). No one else can sue under it.

In this review, I found no public enforcement action under SB 53. On October 1, the Attorney General’s office announced an investigative subpoena served on OpenAI, but the announcement doesn’t identify the law it relies on, so the page can’t count it as an SB 53 action. Its status remains open.

So the floor holds this much: a company must write its own rules, publish them, follow them, and report critical safety incidents, under penalty enforced by a single office. What it doesn’t hold is a check in the auditor’s sense. The state can review incident reports, and the attorney general can pursue violations. But nothing in SB 53 requires anyone independent of the company to test whether it kept its promises. No independent check can come back “no,” because the law doesn’t require one. California’s next three laws take up that missing check.  

While California was building its parts, Congress put a different design on the table. On July 23, 2026, a bipartisan group in the House introduced the FRONTIER Act, H.R. 9925. It is a bill, not a law. As of October 18, 2026, it sits in committee with no further action recorded. Everything below describes what it would require if enacted.

The bill sorts developers by size. A ‘large frontier developer’ has, over the preceding 36 months, more than $50 million in revenue and at least $1 billion in AI development spending (FRONTIER Act, Section 2(15)). A ‘very large frontier developer’ has, over the same period, more than $5 billion in revenue and at least $10 billion in spending (Section 2(22)). Large developers get one kind of check. The very largest get both (Section 6).

Every large frontier developer would have to hire an outside auditor every year (Section 4(c)). Among California’s laws and the federal bill, this is the only required audit that writes both of accounting’s core money rules into the statute itself. The company could not hire an auditor if either one “has a financial interest in the other,” and it could not “condition any payment, or the amount of any payment, on the results of the third party’s audit” (Section 4(c)). That is accounting’s rule against financial ties and contingent fees.

But look at what the auditor measures. The audit is of “compliance with the frontier AI framework of such developer” (Section 4(c)). The yardstick is the company’s own rulebook, the same one SB 53 asks the company to write. The auditor would tell the public whether the company followed its plan. It would not be asked whether the plan was any good.

And look at what the auditor may see. The auditor would get “timely access to all materials, records, personnel, systems, and all other information reasonably necessary,” but the company “may impose security protocols,” including “restrictions on note-taking, copying, retaining, or removing materials” (Section 4(c)(1)). That is the same language California put in SB 1119, word for word in places. These stated reasons—trade secrets, security, and public safety—are legitimate. Yet any restriction on what an auditor is permitted to document directly limits the evidence the auditor can retain.

For the very largest developers, the bill goes much further. A very large frontier developer would have to retain a licensed independent verification organization for ongoing assessment (Section 5(b)), and this is where the bill comes closest to accounting’s design.

The yardstick is no longer the company’s own. The verifier would judge the company’s framework, governance and risk practices against a test Congress wrote: whether they achieve ‘acceptable levels of catastrophic risk mitigation,’ meaning mitigation adequate to ensure ‘the anticipated benefits of a frontier model’ outweigh ‘its level of catastrophic risk’ (Sections 2(1), 5(b)). The company still writes its framework, and the verifier would propose its own methods for the government to approve (Section 3(c)(2)(A)). But the question of whether the risk is acceptable comes from the statute.

The finding would go to the government directly. Each assessment report would be submitted “simultaneously to the Under Secretary and the very large frontier developer,” at least every six months (Section 5(f)(1)–(2)). The company would never be the only one holding the “no.”

The “no” would also start a clock. Within 14 days of a report, the company would have to tell the verifier what it has done or will do about the recommended corrections. Within seven days after that, the verifier would issue a signed opinion on whether those actions are adequate. Within 30 days of the original report, the company would file the whole exchange with the government (Section 5(g)). If the verifier later learns that an earlier clean finding “is no longer valid,” it would have seven days to file a supplemental report (Section 5(i)(1)). If it finds a risk that is imminent, it would have to refer the matter to the Secretary of Commerce within 72 hours (Section 5(p)(1)(B)).

The verifier would also have its own skin in the game. The government would have to revoke a verifier’s license if models it verified fail to achieve acceptable risk levels, unless the verifier had flagged the failure and recommended adequate fixes the company didn’t make (Section 3(c)(2)(C)(iv)). No other design on this page ties the checker’s own license to whether the models it cleared actually hold up. A verifier that stays quiet about a problem would put its license at stake.

There is one thing tier two does not do. It requires the company to respond in writing to the verifier’s findings and submit them to the government by a deadline. Within Section 5, I found no duty to actually achieve the fix. A company could answer a ‘no’ with a plan the verifier calls inadequate and still meet every deadline in Section 5. Only a finding of imminent catastrophic risk would bring in the halt power that Part 12 examines. Accounting works differently. A public company’s duty to maintain adequate internal controls exists whether or not anyone has found a weakness (Securities Exchange Act, Section 13(b)(2)(B)). The duty to respond is not a duty to cure. That conclusion is reasoned from the bill’s text, and a more complete reading of the implementing regulations, once written, could change it.

Even at its strongest, the design leaves several of the auditor’s questions answered by the company. The developer would still choose and hire its own verifier (Section 5(b)). I found nothing in the bill requiring rotation of the verifier or its people, and nothing restricting staff movement between the verifier and the company in either direction. The detailed conflict-of-interest rules would come later, from the regulator, not from the statute (Section 3(c)(1)).

Oversight of verifiers is real but different from accounting oversight. The government would license verifiers, could revoke their licenses, and could order a second assessment to “reproduce or validate” a verifier’s findings (Sections 3(c), 5(h)(1)). Congress would also get an annual report from the Government Accountability Office on the verifier market, including “the degree to which independent verification organizations are independent from the artificial intelligence industry” (Section 7). But the bill itself sets up no routine inspection of verifiers’ work comparable to the PCAOB’s inspection of audit firms. Those details would be left to regulation.

The bill also protects verifiers in ways that accounting does not protect auditors. A licensed verifier would be “immune from suit and liability under Federal and State law” for claims arising from a catastrophic risk of a model it assessed. The only exception would be a federal claim for death or serious physical injury caused by willful misconduct, proved by clear and convincing evidence (Section 5(q)). The reports and supporting materials the government receives would be exempt from the Freedom of Information Act (Section 5(r)), although the company would have to publish a redacted version of each report (Section 5(j)).

The shield has limits. Immunity from lawsuits is not immunity from the regulator: a verifier could still lose its license. And the Under Secretary and the attorney general could obtain the unredacted reports on request (Section 5(n)).

But the shield raises the question this part has to end on, one ChatGPT first raised in reviewing this page’s outline.  An auditor who issues a flawed opinion may be sued by investors who relied on it, if they can meet the legal requirements for liability. Under this bill, a verifier who signs a bad assessment largely could not be. So who holds the verifier accountable when its judgment is wrong?

Put the designs next to one another and a pattern shows. They don’t fail in the same places. They protect different parts of the check.

California’s laws protect mostly the question of who may verify. SB 813 sets criteria for verification organizations, and AB 1405 sets rules for auditors: no auditing your own work, no significant financial ties, no assigning people who just left the client. SB 1119 adds the one required audit and a path for its findings to the attorney general. The federal bill goes further on what happens after a verifier is hired: what the verifier may examine, where its findings go, and how quickly the company must answer. My own model act goes furthest on who appoints the checker. None of them reproduces the whole structure accounting built. As Part 7 cautioned, a missing safeguard is not always a failed law. Several of these laws were built for other jobs. It should be clear: adding up individual parts does not create a complete system. Safeguards dispersed across separate laws do not, by themselves, form a coherent whole. The real test is not how many safeguards exist, but whether they actually work together—especially when the checker says no.

The clearest pattern is the first one. Wherever one of these laws requires a check, the company being checked picks the checker. Some limit who it can pick. None takes the pick away.

SB 1119 requires an audit and names no one but the operator to obtain it (Business and Professions Code, Section 21814(a)(1)(A)). FRONTIER’s annual audit and its licensed verification would both have the company “retain” its checker (FRONTIER Act, Sections 4(c), 5(b)). The licensed tier would limit the pick to verifiers the government has licensed. SB 813 and AB 1405 require no check of their own. AB 1405 does narrow the pick another way: starting in 2029, only registered auditors may sell a covered AI audit (Government Code, Section 11549.82.5).

Accounting doesn’t take the choice away from the company either. But it moves the choice from management to an audit committee of independent directors (Sarbanes-Oxley Act, Section 301). Nothing in the AI laws or the federal bill does anything like that. The word “independent” appears throughout these laws, but on this question the word does more work than the text behind it.

Two of accounting’s protections are nearly absent everywhere else: rotation and cooling-off. They guard against different dangers. Rotation guards against familiarity. A partner who has audited the same company for ten years may stop seeing it clearly, so Sarbanes-Oxley moves the lead and reviewing partners off after five years (Section 203). Cooling-off guards against the revolving door. Sarbanes-Oxley bars a firm from auditing a company whose chief executive, chief financial officer, controller, or chief accounting officer worked on that company’s audit at the firm within the past year (Sarbanes-Oxley Act, Section 206).

On rotation, I found nothing in any of the AI designs, including my own model act. On cooling-off, AB 1405 comes partway. It bars an auditor from assigning someone who worked on the audited subject at the company within the past 12 months, and it bars job-seeking with the client during the audit (Government Code, Section 11549.83(f)(1)(C)–(D)). AB 1405 doesn’t bar an auditor’s people from joining the client after the audit ends, which is what Sarbanes-Oxley addresses. The model act has a two-year bar in both directions (Section 9(d)), but it is a proposal.

One caution belongs here. The absence of rotation shows that these designs differ from the benchmark. It doesn’t prove that rotation would work for AI verification, where the pool of qualified people may be small. That is an open question, not a finding.

The central comparison is the one Part 1 set up. When a checker finds a problem, who receives the finding, what authority do they have, and what does the law require of them?

In accounting, the finding goes to investors and the public through the company’s filings, and to the audit committee that hired the auditor. A regulator with enforcement power stands behind it, and the company carries a standing legal duty to keep its controls adequate.

Under AB 1405, the finding goes to the company that was audited, and nowhere else by requirement (Section 11549.83(d)(1)). Within AB 1405, what happens next is up to the company: the law requires no filing with a regulator and no correction. Under SB 813, the required reports describe the verifiers, not their findings (Section 8898.3).

SB 1119 builds a real path. A summary of the findings goes to the attorney general, the full report can be obtained “for cause,” and the attorney general may use it “for enforcement purposes” (Section 21814(b), (d), (e)(2)). The attorney general has authority to act, and separately the operator has safety duties that public prosecutors can enforce (Sections 21812(d)(5), 21816). But the summary is the company’s own, and the finding doesn’t itself order a correction or require the attorney general to act.

The federal bill would go further on the first two questions. Its annual audit would be published in summary and sent to regulators (FRONTIER Act, Section 4(c)(4)). Its licensed verifier’s reports would go to the government at the same moment they go to the company (Section 5(f)(2)). The receiving official would have real authority: to order a second assessment, to revoke a verifier’s license and, through the Secretary of Commerce, to halt a model in an emergency (Sections 3(c), 5(h), 8). On the third question, what the law requires, the bill asks the company to answer.

That last point is the most important finding in this part. Accounting’s duty concerns the condition. A public company must maintain internal accounting controls “sufficient to provide reasonable assurances,” whether or not anyone has found a weakness (Securities Exchange Act, Section 13(b)(2)(B)). The duty exists before the finding and after it. The SEC enforces it against companies that disclose a weakness and leave it in place.

FRONTIER’s duty concerns the response. Within 14 days of a finding, the company must describe what it has done or will do. Within 30 days, it must file that exchange with the government (Section 5(g)). Those are real obligations with real deadlines. But in Section 5, I found no duty to achieve the fix. The company must answer the ‘no.’ Section 5 doesn’t require it to cure what the ‘no’ found.

A response is not a remedy. A design can carry a finding to the right official, start a clock, and still leave the underlying condition untouched.

There is one more gap. Nearly every safeguard described so far protects the checker. Accounting also protects the evidence. Its standard says an auditor “is not expected to be an expert in document authentication,” but when a document “may not be authentic,” the auditor must change the planned procedures or add new ones (AS 1105.09). None of the enacted laws on this page has an equivalent. Only my own model act tries to protect the evidence the checker is handed, and Part 9 tests whether it can. Even when the checker is independent, how does anyone know the evidence being checked is authentic?

Every required check creates a buyer. This part follows the money: who pays for a check, who reads the result, and who carries the loss when the check fails. It stays with what the laws say. It doesn’t guess at anyone’s motives.

When a law requires a check, it creates customers. SB 1119 requires an independent child safety audit of each companion chatbot every two years (Business and Professions Code, Section 21814(a)(1)(A)(ii)). The FRONTIER Act would require a large developer to retain a third-party auditor every year (FRONTIER Act, Section 4(c)). It would require the very largest developers to retain a licensed verifier that reports at least every six months (Section 5(b), (f)(1)). Each requirement creates demand that doesn’t depend on whether the company wants the check.

The federal market is still hypothetical. FRONTIER is a bill, and none of its requirements apply until it becomes law. But the bill already anticipates the market. Each year, the Government Accountability Office would report on it: how many licensed verifiers exist, whether they can meet demand, and what keeps new ones out (Section 7(b)(1)). The GAO would evaluate “the degree to which” verifiers are independent from the AI industry, “including any factors that threaten such independence,” and recommend changes (Section 7(b)(2)–(3)). Nothing in the bill requires anyone to adopt those recommendations. Studying independence is not enforcing it.

One question the GAO would be well placed to ask is where the verifiers' expertise will come from. People who have built and tested frontier models may have knowledge an outside examiner needs. But when that expertise comes from the companies being examined, independence becomes harder to establish. How many qualified examiners are there outside those companies? How many could examine a former employer without reviewing their own work? And how many would remain after the conflict rules are applied? AB 1405's 12-month restriction and my model act's two-year restriction address parts of that problem (Government Code, Section 11549.83(f)(1)(D); Model Act, Section 9(d)). Neither establishes that enough qualified, independent examiners would remain. Counting them is a job for the study. Finding them is not.

California’s AB 1405 shows who enters this market with a head start. Licensed CPAs and accounting firms are “deemed to satisfy” its reporting and independence requirements if they follow the California Accountancy Act, the AICPA Code of Professional Conduct, and AICPA attestation standards (Government Code, Section 11549.83(d)(2), (f)(2)). Violations by CPAs go to the California Board of Accountancy (Section 11549.84(b)). My profession walks in with a lane already built.

None of these laws says what a check will cost. Congress would ask the GAO whether the market can supply enough verifiers at all (FRONTIER Act, Section 7(b)(1)). That question is open.

In accounting, the company pays the auditor, but the payment runs through an audit committee of independent directors, which is “directly responsible for the appointment, compensation, and oversight” of the auditor (Sarbanes-Oxley Act, Section 301). The PCAOB, which oversees the auditors, is funded by fees on public companies, not by the firms it inspects (Section 109).

SB 53 requires no outside check, so it sets no rule on payment.

SB 813 creates a voluntary program, and no company must use it (Government Code, Section 8898.4(a)(3)). In deciding whether to designate a verifier, the state must consider whether the verifier refuses payment terms tied to its findings. A designated verifier “may accept payment from a party being assessed at reasonable market rates but shall not accept terms which condition any payment or the amount of any payment on the results of their assessment” (Section 8898.1(c)(2)(C)).

AB 1405 says that “reasonable compensation received for performing a covered AI audit shall not, by itself,” impair independence (Government Code, Section 11549.83(f)(1)(A)). It sets no rule against contingent fees. For CPAs, the AICPA Code bars contingent fees only when the firm also performs certain services for the same client, such as an audit or review of its financial statements (AICPA Code of Professional Conduct, ET 1.510.001). An AI audit isn’t one of those services. So the bright-line ban reaches an AI audit only if the same firm also audits or reviews the AI company’s financial statements. Otherwise, the Code’s general independence framework applies, and it draws no bright line (ET 1.510.005, 1.230). The bright line attaches to the client relationship, not to the AI audit itself.

FRONTIER’s annual audit would bar any financial interest between the developer and the auditor. The developer “may compensate a third party for its services but shall not condition any payment, or the amount of any payment, on the results” (FRONTIER Act, Section 4(c)). The licensed tier would leave conflicts to regulations the Under Secretary writes (Section 3(c)(1)). Each report would carry the signature of the verifier’s lead partner certifying that the verifier “is free from conflicts of interest” (Section 5(f)(2)(F)). In both tiers, the company being checked retains and pays the checker.

My model act pools an assessment on all covered developers and pays the Examiner “without regard to the identity of the contributing covered developer” (Model Act, Section 9(e)).

One difference stands out. The PCAOB’s funding pays for oversight of the auditors. FRONTIER’s only fee provision covers “the expenses of administering” developer registration (FRONTIER Act, Section 4(k)(4)). The bill provides no dedicated funding to oversee the verifiers.

The party that pays for a check, the party that reads the result, and the party the check protects can all be different. In accounting, the company pays, but the audit report is filed with the company’s annual report, which anyone can read (Securities Exchange Act of 1934, Section 13(a)). Investors, lenders, and regulators can all read it.

AB 1405 sends the report to the audited company (Government Code, Section 11549.83(d)(1)). It doesn’t require the report to be published or filed with anyone, though it doesn’t forbid other distribution. The state’s registry lists the auditors, not their findings (Section 11549.82(b)(2)).

SB 1119 sends a summary to the attorney general within 30 business days and requires the operator to post a high-level summary on its website within 90 days (Business and Professions Code, Section 21814(b)(1), (2)). The attorney general may obtain the full report “for cause,” and a report in the attorney general’s hands is confidential (Section 21814(d)(1), (e)(1)).

SB 53 requires no outside check, but it does say where the company’s own findings go. When a large developer deploys a new model, it must publish summaries of its catastrophic-risk assessments, including “the extent to which third-party evaluators were involved” (Business and Professions Code, Section 22757.12(c)(2)). Summaries of assessments of risk from internal use go to the Office of Emergency Services every three months, confidentially. They are exempt from the Public Records Act (Sections 22757.12(d), 22757.13(b)(1), (f)).

FRONTIER would reach the public in both tiers. The annual audit’s high-level summary and a redacted report would be published within 30 days and sent to the Under Secretary, the Attorney General and opted-in state attorneys general (FRONTIER Act, Section 4(c)(4)). Each licensed verifier’s report would go to the Under Secretary and the developer at the same time (Section 5(f)(2)). A summary and a redacted copy would be published within 30 days (Section 5(j)(1)).

My model act requires publication of each final finding within 30 days and an annual compliance summary for each developer (Model Act, Sections 11(f), 8(k)).

FRONTIER would give licensed verifiers a shield that auditors don’t have. It covers lawsuits over the very disaster the verifier was hired to guard against. A licensed verifier “shall be immune from suit and liability under Federal and State law with respect to all claims for loss caused by, arising out of, relating to, or resulting from the materialization of a catastrophic risk of a frontier model assessed by the IVO” (FRONTIER Act, Section 5(q)(1)). There is one exception. It is a federal claim for death or serious physical injury caused by “willful misconduct,” which the injured person must prove by clear and convincing evidence. A verifier that “acted consistent with its obligations” under the law and the Under Secretary’s rules “shall not have engaged in willful misconduct as a matter of law” (Section 5(q)(2), (2)(B)). No discovery is allowed until the verifier has had the chance to move to dismiss (Section 5(q)(2)(D)).

The immunity protects the verifier from lawsuits, not from its regulator. The Under Secretary must revoke a verifier’s license if models it verified fail to achieve acceptable levels of risk mitigation (Section 3(c)(2)(C)(iv)). Even that has an exception: a verifier can avoid revocation by showing it identified the failure in its report and recommended corrective action. In Part 8’s terms, the verifier is protected by its response.

Accounting carries the risk the other way. When a registration statement contains a material misstatement, investors can sue the accountant who certified the financial statements in it. The accountant then has to prove it did the work a reasonable auditor would have done (Securities Act of 1933, Section 11(a)(4), (b)(3)). Audit firms carry that risk.

Consider what that means if a check fails. This is reasoned, not demonstrated: FRONTIER is a bill, and no loss has occurred under it. The company has paid its fee. The verifier is shielded from suit unless an injured person can prove willful misconduct, by clear and convincing evidence, against a verifier that may have followed every rule. The injured may still pursue the developer. But they lose the one defendant paid to catch the problem. California’s SB 813 takes a different course. An audit performed under its standards is “relevant to, but not conclusive of,” a lawsuit for harm (Government Code, Section 8898.4(b)). Under SB 813, the courthouse door stays open.

Part 5 described a law that carries a child’s name. SB 1119 carries that name because someone paid a price before any check existed.

When the check fails, the company has paid its fee, the verifier is shielded from suit, and the people the check was meant to protect can’t sue the one party paid to catch it.

I do not currently perform or solicit AI audits. My interest in this page is grounded in the standards developed by my profession. The full statement appears in the disclosures at the end of this page.

The money question leads to a power question. If Washington builds the market, licenses the sellers, and shields them from suit, may California keep rules of its own?

Part 1 asked an auditor’s question: when the check comes back “no,” must anyone act? This part asks the harder version. When an examiner finds a dangerous model, who can stop it? The answer has three pieces: a finding, the legal authority to act on it, and the technical ability to carry out the order. The laws on this page treat those as three different things.

Under the FRONTIER Act, a licensed verifier that finds that a very large developer’s model poses “an imminent catastrophic risk” must act quickly. It “shall refer the matter to the Secretary, for consideration of an emergency order under section 8, as soon as practicable, and in any event not more than 72 hours” after its determination (FRONTIER Act, Section 5(p)(1)(B)). That is a duty to report. The verifier can’t stop anything itself. The Secretary of Commerce “may issue an emergency order” (Section 8(a)(1)). “May” means the Secretary isn’t required to. The law would require the warning to reach someone with power. It would not require that person to use it.

Accounting works differently, though not in the way a reader might expect. An auditor can’t shut a company down either. An adverse opinion says the financial statements are not fairly presented. A disclaimer of opinion says the auditor couldn’t reach one. Neither stops the business. But under the Exchange Act and the SEC’s rules, a public company’s annual report must include financial statements certified by independent accountants (Securities Exchange Act of 1934, Section 13(a)(2)). Either opinion puts the problem in a public filing that every investor can read. The SEC, like FRONTIER’s Secretary, “may” act on its own: it can suspend trading in a company’s stock for up to 10 business days (Section 12(k)).

The difference is narrow but real. In accounting, a negative finding goes straight into the company’s public filing. Under FRONTIER, a finding of imminent catastrophic risk produces a referral, and the Secretary decides what happens next. A required warning is not a required halt.

The FRONTIER Act would give one federal official the power to halt a frontier model. The Secretary of Commerce could issue an emergency order “suspending or restricting a frontier developer’s development, deployment, or internal use of a frontier model” upon finding that it “presents an imminent catastrophic risk” (FRONTIER Act, Section 8(a)(1)). What follows is demonstrated from the bill’s text.

The Secretary could act fast. The Secretary could issue a provisional order before a formal finding. Notice to the developer could be skipped if “the imminence of the catastrophic risk forecloses such notice,” and the reason would have to be put in writing (Section 8(e)(1), (2)). A provisional order lapses after 45 days (Section 8(e)(3)). A final order lasts 90 days and can be renewed only on a new finding (Section 8(f)(2), (3)).

The order would reach further than the model named in it. It would cover models produced by fine-tuning, quantization, pruning, or merging, and models trained “in substantial part” on the halted model’s outputs or weights (Section 8(d)(3)). It would bind the developer’s affiliates, successors, and anyone acting in concert with them who has notice (Section 8(d)(2)).

Violations would be expensive. The civil penalty runs up to $10 million per violation, and each day counts separately. Willful violation carries a fine of up to $1 million per violation and up to 10 years in prison (Section 8(m)(1), (3)).

The authority would rest with one person. The Secretary must consult the Under Secretary, but nothing makes the order depend on “the concurrence of the Under Secretary” (Section 8(b)(4)). And the section would be “the exclusive means” by which any federal official, “including the President,” could limit a frontier model on the ground of imminent catastrophic risk (Section 8(l)(1)). Any other attempt “shall be unenforceable” (Section 8(l)(3)).

A developer could fight the order. Before a final order, no court could review or stay a provisional order (Section 8(k)(1)). After that, the U.S. District Court for the District of Columbia would have exclusive jurisdiction. Filing suit would not stay the order “unless the district court orders otherwise,” and the court could set aside a final order only if it was “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law” (Section 8(k)(2)–(4)). Those rules favor the order while it stands. But a provisional order lapses in 45 days, a final order in 90, and each renewal requires a new finding. The ability to issue an order differs from the ability to sustain it.

The Secretary of Commerce serves at the President’s pleasure, as cabinet secretaries always have. Congress may not have had a better option. In Trump v. Slaughter, decided June 29, 2026, the Supreme Court held that the removal protection for Federal Trade Commission commissioners was unconstitutional. The consequence is plain: even the commissioners of an agency built to be independent now serve at the President’s will. Whether Congress could protect anyone holding this power from removal is now in doubt. That is reasoned, and Part 9 found the same problem in my own design. Under FRONTIER, an official the President can remove would decide whether to halt a model. The bill’s check on that decision is notice: the Secretary must send each order to Congress within three days (FRONTIER Act, Section 8(i)(1)).

California has proposed the other half. The Governor’s executive order asks for recommendations by November 16, 2026, on “requiring the creation of a ‘kill switch’ for frontier models, with the efficacy of the switch verified on an ongoing basis by an independent verification organization” (Executive Order N-9-26, paragraph 3(c)). It’s a request for recommendations, and nothing more. The order states that it does not “create any rights or benefits, substantive or procedural, enforceable at law or in equity” against anyone.

The FRONTIER Act takes the opposite approach. It gives the Secretary the authority to order a halt. I searched its text for “shut,” “shutdown,” “terminate,” “deactivate,” “disable,” “cease,” “kill,” and “switch,” and found no requirement that a developer be able to stop its own model. A word search isn’t a full legal reading, so that finding is reasoned.

California has proposed a switch without a hand. Washington has proposed a hand without a switch.

An order works only if three things are true. Someone has to be able to identify the system, reach it, and disable it. FRONTIER’s order would identify the model and its derivatives in detail (Section 8(c)(1)(A), (d)(3)). Nothing in the bill requires that the developer be able to disable it. Whether a frontier model can be stopped once it is running, copied, or released is a technical question no law on this page answers. An order can name every copy. Only someone holding a copy can turn it off.

The federal halt power reaches only one kind of harm. “Catastrophic risk” means a foreseeable and material risk that a frontier model will contribute to the death of, or serious injury to, “more than 50 people,” or “more than $1,000,000,000” in property damage, “arising from a single incident.” The model also has to be doing one of three things: giving non-public help in making a chemical, biological, radiological, nuclear or cyber weapon; acting without meaningful human oversight in a way that would be a cyberattack or a serious crime; or “evading control of such developer or a user of such model” (FRONTIER Act, Section 2(6)(A)).

Harms outside that definition can’t trigger a halt under Section 8. A model that could harm one person, or 50, falls outside it, unless it could also cause more than $1 billion in property damage. The same goes for harm spread across separate incidents, no matter how many people it reaches. So does harm from any conduct other than the three kinds listed. And because some risk is always present, a qualifying risk isn’t enough: a halt requires one that is “imminent” (Section 8(a)(1)).

The exclusivity clause is limited in the same way. It controls only actions taken “on the ground that” a model “presents an imminent catastrophic risk” (Section 8(l)(1)). Other federal authorities acting on other grounds would be untouched. That is reasoned from the text.

That brings the page back to Part 5. A child harmed by a companion chatbot is one person, in one incident. That alone can’t trigger a halt under Section 8. Among the laws on this page, California’s only required audit is aimed at a harm the federal emergency power doesn’t count.

That leaves the two systems covering different ground. The federal power to halt is reserved for an imminent risk of disaster of a defined size: more than 50 people killed or seriously injured, or more than $1 billion in property damage, from a single incident. The incident must involve weapons help, an unsupervised cyberattack or crime, or a model escaping control (Sections 2(6), 2(13), 8(a)(1)). Some examples fall inside that line. A model that gives help not available elsewhere toward building a biological weapon would. So would a model that, without human oversight, carries out a cyberattack or fraud large enough to cross the threshold. Much falls outside it. Harm spread across many separate incidents doesn’t count, however large the total, because the test is a single incident. Neither does risk from information already publicly available in similar form, or harm the model didn’t materially contribute to (Section 2(6)(B)). A serious risk that isn’t yet present or impending doesn’t count either.

The harm California’s audit addresses happens one person at a time, and California’s tools work after the fact: an audit every two years, a summary to the attorney general, civil penalties, and an injunction to enforce its rules (Business and Professions Code, Sections 21814, 21816). Neither system gives anyone the power to stop a model because it is harmful, rather than because it broke a rule. That is demonstrated from the text. Whether either system should give someone that power is a question this page leaves open.

That question is open. The exclusivity clause binds “any department, agency, officer, or employee of the United States” (FRONTIER Act, Section 8(l)(1)). It says nothing about the states. The preemption section names transparency, verification, and incident reporting, not halts (Section 9(a)). But silence alone doesn’t establish that a state’s power to halt a model would survive. A court would have to decide.

California’s own laws offer little to test the question. SB 53 provides civil penalties of up to $1 million per violation, recovered “only by the Attorney General,” and no power to stop a model (Business and Professions Code, Section 22757.15). SB 1119 lets the attorney general seek “injunctive or declaratory relief” for violations of its rules (Business and Professions Code, Section 21816(a)(1)(C)). A court may issue an injunction to restrict how a chatbot operates, but only as needed to enforce SB 1119’s rules. This authority does not extend to halting a model solely because it is considered dangerous.

New York’s 2025 law came closest, with a rule that a developer “shall not deploy” a model that creates “an unreasonable risk of critical harm” (General Business Law, Section 1421(2), as enacted in 2025). As Part 11 showed, New York replaced it in 2026.

My own model act doesn’t fill this gap. It restricts deployment only after a final finding, and it has no emergency procedure (Model Act, Sections 11(g), 12). That is on the agenda for Version 2.

The laws show who may examine, who must respond, and who could order a halt. Twelve parts in, the auditor’s question has an answer, and the page’s own claims must now meet the same demand for evidence.

What follows is my judgment, as a CPA with more than three decades in the profession. It is not a finding. Readers can weigh it against the evidence above. 

This page is not an ode to California. California moved first, and the page has given it credit where its text earns it. But being first is not the standard. AI verification is arriving everywhere at once, and the problems it has to solve will keep coming. The question is whether the checks being built can do what checks are for.

Accounting never promised perfection. Its own statute asks companies to keep internal controls “sufficient to provide reasonable assurances” (Securities Exchange Act of 1934, Section 13(b)(2)(B)). That is the right standard for AI verification. No check will eliminate the risk. A good one manages it, and a reader can see how. 

Measured against that standard, California’s and New York’s designs fall well short. They let the company describe its own safeguards and, where a check is required, choose its own checker. That is too close to self-certification, and accounting learned what self-certification costs. 

The federal bill goes further than either state. FRONTIER’s licensed tier would test developers against a government-set standard, send the findings to a regulator, and give one official the power to halt a model. My model act, the Independent AI Provenance and Examination Act, goes further still on the questions this page asks: who chooses the checker, who pays, and what happens when the answer is no. The two designs address different risks, but the gap in independence between them is wide. Version 2 will build on that lead.

Some people argue that a bad law is better than no law. The best case for that view is real. A first law builds infrastructure: registries, reporting channels, a vocabulary that legislators and courts can use. It gives future lawmakers something to amend instead of a blank page. But a weak check does something an empty statute book never could: it lends trust it hasn’t earned. It can spread before anyone tests it. And under a federal preemption clause, it can be locked in. New York shows how quickly a design can move. Its 2025 law barred deploying a model that posed an unreasonable risk of critical harm (General Business Law, Section 1421(2), as enacted in 2025). Its 2026 law replaced that rule with California’s disclosure design. The question is not law or no law. It is whether the design can be fixed before it spreads. 

It can be. The fixes are known, and most of them have been tested for decades in another field. This page points to six.

A workable statute — capable of closing the core gaps in independence and accountability—would need to deliver six essential safeguards:

1. Independent choice. Someone other than the company chooses the checker.
2. Rotation. The people who lead the checking rotate off, and a cooling-off period blocks moves in both directions, from checker to company and from company to checker.
3. Outside reporting. The report goes to someone other than the company.
4. A duty to fix. The company must cure the condition the check found, not merely respond to it.
5. Outside evidence. The checker tests the company’s records against sources the company doesn’t control, rather than taking them at face value.
6. Halt power. An official holds the power to stop what the check finds dangerous, and a system exists to carry out the order.

Accounting offers a precedent for the first five, though not always in this form. Auditing standards have long treated evidence from outside the company as more reliable than evidence the company provides (AS 1105.08). The sixth is new. An auditor never had to stop a machine. AI verification will. 

 AB 1405 gives CPAs a ready lane into AI audits (Government Code, Section 11549.83(d)(2), (f)(2)). That lane is an opportunity, and it should be earned, not assumed. The profession’s bright line against contingent fees attaches to the client relationship, not to the AI audit itself (Part 10). The AICPA and the firms that will do this work, especially the largest, can close that gap themselves. They can hold AI audits to the same independence they require for financial statements before any legislature asks them to. The profession that built the standard for financial truth is best placed to build one for AI.

None of this argues against AI. It is a case for checks that work. Independent audits did not keep capital markets from growing. They are a large part of why people trust those markets. AI can earn the same trust in the same way: a checker the company doesn’t choose, evidence the company can’t write alone, and a “no” that someone is bound to act on. Built that way, verification protects the people who use these systems and the people who build them. That is a future worth working toward, and it is within reach.

I am not currently engaged in performing AI audits, nor do I solicit or participate in them. I do not take paid advisory work or speaking fees from AI developers. If that changes, I will update this page. If I become involved in founding a nonprofit related to AI’s effects on people, I will note that here, along with any funding it may receive from AI companies.

This page shows both human and AI contributions. I set the framework, made the key decisions about what to include, and wrote the analysis and conclusions. Three AI systems, Claude (Anthropic), ChatGPT (OpenAI), and Gemini (Google), assisted at various stages. Gemini provided the initial draft of my model act. Claude and ChatGPT helped draft language, suggest improvements, identify gaps, and raise objections. I remain responsible for the structure, content, and judgments. Each AI system is made by a company whose oversight this page examines, so their feedback served as an additional check, not an independent one.

Accountability is not only about detecting a problem. It is the assurance that someone must act when the alarm sounds.

When the first required check of an AI system comes back “no,” who, if anyone, will be bound to act on it?

Stay Sovereign.

Jim Germer

October19, 2026

© 2026 Jim Germer. All rights reserved.