California Governor Gavin Newsom signed an executive order on September 18 calling for a panel of experts to be convened and to deliver, within two months, guidance on how the state should strengthen its artificial intelligence safety laws.
The order lays out three areas for evaluation: requiring frontier AI companies to undergo regular independent third-party safety audits; mandating that companies report "runaway incidents" in which AI agents behave erratically; and equipping the most advanced models with a "kill switch," an emergency shutdown mechanism. All three are, for now, options under review — not obligations already in force.
What the executive order actually does
It's worth being precise about the limits of this document. It does not create new compliance requirements; what it does is kick off a process — naming who convenes, setting a deadline, and framing the topics for review. Binding rules will have to come either from legislation the panel later pushes for, or from administrative rulemaking under existing legal frameworks. The two-month window means the guidance should surface before mid-November.
In a video address, Newsom said, "California will do everything it can, but the whole country needs to act — Washington needs to do its job." He framed the order as laying the groundwork for a safety framework. His office was blunter, saying the federal government has "completely failed" to establish any meaningful AI oversight and accountability.
"We will not sit idle—we will accelerate substantive, responsible AI regulation before it is too late."
The milestones on California's timeline this year
Zoom out and this isn't an isolated move. In early September, California had already signed a law establishing a framework for third-party AI auditing bodies — the independent-audit requirement this new order is evaluating picks up exactly where that law left off. Further back, California's legislative fights over frontier-model safety disclosure have run for two years, with some bills vetoed and others passed only after being narrowed.
The sequence is deliberate: first build a qualification framework for auditors, then evaluate turning audits into a mandatory requirement; first require disclosure, then debate reporting and shutdown mechanisms. Each step nudges forward from the last one; none jumps straight to a final form. That pacing buys companies time to adjust, and gives opponents room to fight it clause by clause.
There's also a deadline that shouldn't be overlooked. Newsom's term as governor ends on January 4 next year. The two-month window falls within his remaining time in office, but the legislative push that would follow the guidance will most likely fall to his successor. Whether an executive order eventually becomes law isn't entirely up to the person who signed it.
A sharp contrast with the federal track
The backdrop here is a vacuum at the federal level. Trump has rejected calls to tighten regulation, calling AI safety concerns a "hoax," and Congress is unlikely to advance national AI legislation before the 2026 midterm elections. California has positioned itself as the opposite pole — Newsom's office, the same day, publicly criticized the White House and Congress for inaction on the issue.
California has real leverage to do this. Most frontier AI companies are headquartered in the state, so state law binds them directly rather than being an extraterritorial reach they can dodge by relocating servers. Over the past several years, California's approach to data privacy and emissions standards has repeatedly ended up becoming the de facto national standard.
But what's being proposed this time is harder than privacy rules. Regular third-party audits mean outside parties entering a company's model-evaluation pipeline; incident reporting means companies have to proactively hand over anomalies in their own systems; a kill switch touches the deployment architecture itself. If any one of the three actually lands, it will trigger pushback at the lab level.
Three things to watch over the next two months
Over the two-month window, there are three things worth watching: who makes up the expert panel, how narrowly "runaway incident" ends up being defined, and whether the kill switch emerges as a mandatory requirement or merely a recommended practice.
None of the three has an answer yet. The executive order provides a list of topics and a timeline, not conclusions. Whether that guidance actually appears before mid-November — and what it says — is the next checkpoint on this story that can be verified.
Sources: Office of the Governor of California, Sing Tao Daily, CocoLoop, Sina Finance; the executive order's three evaluation areas, the two-month deadline and Newsom's remarks were cross-checked against the Governor's Office's own account.