California Governor Issues Executive Order Directing State Agencies to Draft AI Safety Requirements

On March 30, California Governor Gavin Newsom signed Executive Order N-5-26, directing state agencies to develop new AI vendor certification standards that would require companies selling artificial intelligence products to the state to attest to safeguards addressing bias, civil rights, illegal content, and free speech. The order, which Newsom explicitly framed as a response to the Trump administration rolling back federal AI protections, leverages California's enormous purchasing power to establish what could become de facto national standards for AI safety -- without passing a single new law.

What the Order Does

The executive order gives three California agencies -- the Government Operations Agency, the Department of General Services (DGS), and the Department of Technology (CDT) -- a 120-day window to develop new procurement certifications for AI vendors. That clock runs out on July 28, 2026, at which point the standards are expected to begin gating access to state contracts.

The certifications will require companies to attest to and explain their policies and safeguards across three core risk areas. First, the exploitation or distribution of illegal content, including child sexual abuse material and non-consensual intimate imagery. Second, harmful bias in AI models and the absence of bias governance. Third, violations of civil rights and civil liberties, encompassing free speech, voting rights, human autonomy, unlawful discrimination, detention, and surveillance.

In addition, the order directs CDT and GovOps to issue guidance on best practices for watermarking AI-generated or significantly manipulated images and video -- a first-of-its-kind state-level directive, according to the governor's office. The Chief Information Security Officer is also tasked with reviewing federal supply chain risk designations and issuing updated guidance for state procurement decisions.

Critically, the order is forward-looking. It does not require agencies to re-evaluate existing contracts with AI vendors, only future ones.

The Procurement Strategy

The most consequential aspect of EO N-5-26 may not be what it says but how it works. Rather than imposing broad regulatory mandates through legislation -- an approach that has repeatedly stalled or been vetoed in Sacramento -- the order uses the state's procurement apparatus as a regulatory lever.

California is the nation's largest state market for technology products and services, and its economy ranks as the fourth largest in the world. Any AI company that wants to sell to California state agencies will need to meet these certification requirements. In practice, that means the standards will ripple far beyond Sacramento. Companies are unlikely to maintain separate product lines for California government contracts versus commercial sales; instead, they will build to the most demanding standard, effectively making California's procurement rules a floor for the broader market.

Bloomberg Law described the approach as a "regulation shake-up," noting that procurement-based requirements are faster to implement and harder to reverse through the normal legislative process. Legal analysts at Wiley have characterized the order as establishing "new trust and safety procurement standards" that function as soft regulation without the political friction of statutory mandates.

The Shadow of SB 1047

The executive order also arrives in the long shadow of SB 1047, the Safe and Secure Innovation for Frontier Artificial Intelligence Models Act, which Newsom vetoed in September 2024. That bill would have imposed stringent safety requirements on the largest AI models, including kill-switch mechanisms and mandatory auditing, and would have created a new state regulatory body called the Board of Frontier Models.

Newsom argued at the time that SB 1047 was too broad, applying heavy-handed standards to basic AI functions simply because they were deployed by large systems, without accounting for the specific risks of how a system was actually used. But he also acknowledged that California could not wait for a catastrophe before acting on AI safety.

EO N-5-26 appears to be his answer to that tension. By channeling safety requirements through procurement rather than blanket regulation, Newsom can impose meaningful obligations on major AI companies without triggering the industry backlash that helped sink SB 1047. The approach is narrower in scope -- it applies only to companies doing business with the state -- but potentially broader in effect, given California's market gravity.

The Broader State Landscape

California is not acting in isolation. According to a Cooley analysis of state AI legislation published in April 2026, at least 45 states have introduced AI-related bills in the current legislative cycle, with several enacting laws that took effect on January 1, 2026. These include transparency requirements, employment discrimination protections related to automated decision-making, and sector-specific rules for healthcare and financial services.

At the federal level, the regulatory picture remains fragmented. The Trump administration's rollback of the Biden-era AI executive order left a vacuum that states have rushed to fill, producing a patchwork of requirements that AI companies must navigate. California's procurement-based approach sidesteps much of this complexity by operating within the state's existing contracting authority rather than creating new regulatory frameworks.

Drata's 2026 survey of AI regulations noted that the result is an increasingly state-driven regulatory environment where companies face compliance obligations that vary significantly by jurisdiction -- making California's standards particularly influential given the state's outsized market share.

What to Watch

The July 28 deadline is the first critical milestone. The specific language of the procurement certifications will determine whether the requirements amount to meaningful safety guardrails or perfunctory checkbox exercises. Watch for how narrowly or broadly the agencies define terms like "harmful bias" and "civil rights violations" -- the devil, as always, is in the definitional details.

Also worth monitoring: whether the California legislature attempts to codify similar requirements into statute during the current session, which would make them harder to rescind under a future governor. And keep an eye on how major AI vendors -- particularly those headquartered in California, such as OpenAI, Anthropic, Google DeepMind, and Meta -- respond. Their level of engagement with the certification development process over the next three months will signal whether the industry views this as a manageable compliance exercise or a genuine inflection point in state-level AI governance.