Records office for the California AI-audit era
The evidence room where California AI audits are handed over.
AI Audit Exchange gives each audit engagement a standardised evidence room: suite evidence imported unchanged and hash-sealed, a manifest an auditor can verify line by line, matching with vetted independent auditors, and retention set for the record.
Why this exists — the dates, at the confidence level we have them
California is creating a regulated market for independent AI audits. As reported in concordant law-firm secondary sources (the primary gazette texts have not been opened by us, and dates are stated at that confidence level): SB 1119's first mandatory independent audits are due 1 January 2029; CPPA cybersecurity-audit certifications phase in from 1 April 2028; and SB 813 / AB 1405 stand up an AI Auditor Registry by 1 January 2029, with 10-year audit-record retention. AI Audit Exchange is a private product: it is not affiliated with or endorsed by any state registry.
Quick answers: What does AI Audit Exchange cover? California SB 1119 and CPPA audit regimes only, in version 1. Does it create audit evidence? No — it hosts evidence rooms, auditor matching and retention; it never generates notices, decision traces, crisis-runtime evidence, SBOMs, or conformity evidence packs. Those are produced by ReviewDesk — ADMT Decision Review, CompanionGuard, ProvenanceGuard and CRAClock, and imported here unchanged. Who is it for? Auditees preparing for a California AI audit, and independent auditors who take those engagements.
1 · Open the room
One room per audit engagement — regime (SB 1119 or CPPA), period, retention. The room gets a docket number and a manifest.
2 · File the evidence
Import a suite evidence export and it is sealed at intake: SHA-256 recorded, bytes stored unchanged, source product badged on its face. Direct uploads are badged as direct uploads — never dressed as a suite import.
SEALED · IMPORT
3 · Match and hand over
Post an engagement brief; vetted auditors respond; accepting one grants that auditor read access to that room only — revocably — and records them as auditor of record.
Built like a record, because it is one
- Immutable filings. A filed artifact cannot be edited or deleted. A derived copy is a new artifact; the source is never altered.
- Legal hold. A hold blocks all deletion of the room — including by the owner path — until it is lifted, and the lift is recorded.
- Scoped access. An auditor sees exactly the rooms they have been granted — nothing else.
- Honest directory. Auditors register, state their credentials as claims, and pass an owner-run vetting workflow before they are listed or may respond to engagements. The directory is being onboarded — if it is empty, it says so.
- Progress you can see. Each room carries an evidence-completeness view against its regime checklist — an organisational checklist, not a legal determination.