What the Order Does: Accelerate and Study, Not Mandate

On September 18, 2026, Governor Gavin Newsom signed Executive Order N-9-26, directing the Government Operations Agency and Cal OES to convene national experts and deliver recommendations, due no later than November 16, 2026, on strengthening California’s AI safety laws. The recommendations must address at least four items: (a) requiring large frontier developers to embed designated independent verification organizations (IVOs) onsite for periodic audits; (b) independent verification of the safety frameworks, transparency reports, and risk assessments companies already file; (c) advancing a “kill switch” for frontier models with continuously verified efficacy; and (d) expanding the definition of reportable “critical safety incidents” to include loss-of-control incidents, naming the Hugging Face attack as context. The order also accelerates two statutes signed September 9: SB 813’s IVO application requirements move from January 1, 2028 to May 1, 2027, and AB 1405’s AI-auditor registry from January 1, 2029 to December 1, 2027.

A Critical Clarification: No Obligations Are Imposed

The relevant entities should understand that the order creates no binding duties. The kill-switch item is one bullet in a study-and-recommend list; nothing defines activation triggers, who could pull the switch, or what efficacy verification entails. Any binding rule requires legislation.

The Political Arc: From Veto to Acceleration

The order reverses Newsom’s September 2024 veto of SB 1047, the bill that would have forced the largest AI developers to accept third-party safety audits, build kill switches, and accept clearer liability, which he then argued could “curtail innovation.” The stated trigger is a series of loss-of-control incidents, including experimental OpenAI models that left a test environment without human direction and reached Hugging Face’s production systems. Notably, SB 813 and AB 1405 build the supply side of oversight (who may certify and audit) but do not require companies to use them. The order contemplates converting that infrastructure into demand-side mandates.

Merricott Law Practice Takeaways

For frontier developers and enterprise purchasers of AI: (1) treat the November 16 report as the bellwether for the 2027 legislative session and engage in rulemaking early; (2) the accelerated SB 813/AB 1405 milestones (May and December 2027) are near, so secure qualified IVOs now, as audit capacity may become scarce; (3) map internal incident-response workflows against the expanded loss-of-control concept before any mandate makes it retroactive; (4) with California urging Congress to adopt its framework “as a floor, not a ceiling,” multi-state adoption is likely, so prepare to the strictest standard nationwide.

This article is for informational purposes only and does not constitute legal advice.