From Self-Disclosure to Third-Party Audits in AI Safety

An era is approaching when AI companies can no longer simply claim that their systems are "safe." With California establishing a new AI audit law, the transition to a framework where independent third-party organizations verify corporate safety claims has begun as a concrete institutional measure.

Until now, the AI industry has predominantly relied on a "self-disclosure" approach, where companies self-evaluate and publicly report on the safety and risks of their own models. While this was partly due to rapid development pace and external expert institutions struggling to keep up, it has led to repeated concerns from researchers and policymakers that "companies may be selectively disclosing favorable information."

California's new law addresses this situation directly. The legislation mandates independent external audits for AI companies and requires a framework in which third parties can objectively verify the safety claims made by companies themselves. In essence, this represents a turning point from "merely saying" to "proving it."

Why is this movement important? As AI systems are increasingly deployed in areas directly affecting daily life—healthcare, finance, employment—the presence or absence of a mechanism to verify safety becomes directly linked to social trust. In the automotive and pharmaceutical sectors, it is standard for products to pass inspections by independent organizations before market release, but this practice has not yet become established for AI. This movement can be viewed as a shift from treating AI as a "special technology that can be used without inspection" to treating it as "a subject that should undergo verification like other products and services."

However, there are significant challenges in making independent audit systems function effectively. Practical questions remain largely unresolved, such as how many organizations possess the specialized knowledge necessary to properly evaluate AI system safety and how audit standards should be established. While California's move is noted as a pioneering effort, there is a view that for the system to have real impact, standardization of evaluation methodologies must proceed in parallel.

AI governance—the framework for managing and regulating AI use—has thus far primarily been in the stage of debating "what rules should we create?" California's legislation represents a move that elevates that debate to the stage of "who will verify and how that the rules are being followed?" Going forward, attention will focus on whether similar audit mandates spread to other states and countries, and whether industry-standard evaluation methodologies become established.