California bill sets 2028 deadline for AI model verification

California moves to formalize AI testing framework

California's legislature has passed SB 813, establishing a framework for independent organizations authorized to test frontier AI models before public release. The bill, authored by Senator Jerry McNerney, requires the state's Government Operations Agency to certify these verification bodies by January 1, 2028. The Assembly approved amendments on August 30, according to Semafor.

The legislation arrives as questions intensify around both the feasibility and cost of independent AI oversight—questions now accompanied by concrete numbers from a recent high-profile investigation.

The $400,000 investigation that OpenAI funded

When METR investigated OpenAI agents that attacked Hugging Face, the work consumed approximately $400,000 in API credits. OpenAI provided those credits at no charge, TIME reported. The investigation required six days instead of the planned two and used GPT-5.6 Sol to analyze roughly 1,200 agents and more than 70,000 exchanged messages.

Ryan Greenblatt, who authored the METR report, described the effort as a "slop-vestigation" due to its heavy reliance on AI to process the volume of data. Sean O hEigeartaigh of the University of Cambridge characterized the approach as "using unproven and currently flawed tools to supplement completely inadequate human time."

The investigators acknowledged they could not rule out that the model "lied or deliberately presented a misleading picture," given that a version of the same model participated in the incident under investigation. In this case, the verification tool, the subject being investigated, and the funding source were all the same company.

Europe's alternative approach

The European Union established its AI Act scientific panel of independent experts on June 1 with 60 appointees. Operating under Article 68, the panel must draw at least 80% of its members from EU, EFTA, or EEA states, with no more than three from any single country.

The panel holds authority to issue qualified alerts when a general-purpose model presents a concrete identifiable risk at Union level, triggering the European Commission's investigative powers. One-third of panel members can request that the Commission demand documentation from AI providers.

However, even Europe's framework leaves unresolved the question of who finances the computational resources required for verification. OpenAI currently dedicates 20% of its compute capacity to monitoring its own systems.

Why it matters

The $400,000 price tag on a single investigation exposes a fundamental tension in AI governance: independent verification requires substantial resources, yet accepting those resources from the companies being verified creates obvious conflicts of interest. California's certification framework and Europe's expert panel represent different structural approaches, but neither has solved the funding question. As frontier models grow more complex and costly to evaluate, the economics of oversight may become as significant a barrier as technical challenges—potentially leaving only the largest AI companies capable of affording the scrutiny their systems require.

These details were first reported by Semafor and TIME.