AI Governance Is Becoming Evidence Work
AI governance is increasingly becoming evidence work. As lawmakers and regulators develop audit requirements, disclosure rules, and new theories of accountability, organizations must be prepared to demonstrate what they knew, what they tested, what they approved, and what they changed. An artificial intelligence policy may establish expectations, but inventories, risk assessments, testing records, change logs, and documented human decisions provide the evidence that those expectations were actually followed.
Audit Infrastructure Is Taking Shape
California has begun constructing a formal system for independent AI auditing. Senate Bill 813, approved on September 9, 2026, directs the Government Operations Agency to develop requirements and standards for independent verification organizations by January 1, 2028. Assembly Bill 1405, approved the same day, requires the creation of an AI Auditor Registry by January 1, 2029 and establishes expectations concerning auditor independence, competence, documentation, reporting, and retention of evidence.
The Audit Begins Before the Auditor Arrives
Neither California law imposes a universal requirement that every AI system undergo an independent audit. The significance lies in the infrastructure being created around audits and the detailed expectations concerning evidence, independence, methodology, and reporting. An organization cannot reliably reconstruct years of design decisions, testing activity, risk treatment, and human review after an auditor arrives. Audit readiness therefore begins during the design and operation of the system, when that evidence can be created and preserved as part of ordinary governance.
From Policy to Proof
Organizations do not need to wait for a legal mandate before becoming audit-ready. The voluntary NIST AI Risk Management Framework already provides a structured foundation for incorporating trustworthiness into the design, development, use, and evaluation of AI systems. An organization can begin by inventorying its AI systems, identifying responsible owners, documenting intended purposes and known limitations, preserving testing results, recording material changes, and retaining evidence of human review. These practices do more than prepare an organization for an eventual audit. They turn governance principles into activities that can be examined, evaluated, and improved.
Governance That Can Be Demonstrated
The emerging lesson is straightforward: having an AI governance policy is not the same as being able to demonstrate governance in practice. Evidence supports audits and regulatory inquiries, but it also strengthens incident response, organizational learning, and accountability. Human-led AI governance requires people to make reasoned decisions and preserve a reliable record of how those decisions were reached. Evidence does not replace judgment. It makes judgment visible.
References
- SB 813: Independent Verification Organizations, California Legislative Information, 2026.
- AB 1405: Artificial Intelligence Auditors: Registration, California Legislative Information, 2026.
- AI Risk Management Framework, National Institute of Standards and Technology.