On March 30, 2026, Governor Gavin Newsom signed Executive Order N-5-26. The order directs California state agencies to develop certification requirements for companies that want to sell AI-enabled products or services to the state government. Vendors will need to attest to their policies on bias mitigation, civil rights protections, and prevention of illegal content exploitation.
The press coverage was uniformly approving. California leads on AI regulation. Newsom fills the federal vacuum. A responsible framework for procurement. The coverage described what the order intends. Nobody examined what it dismantles.
Executive Order N-5-26 directs the Department of General Services and Department of Technology to develop AI vendor certification requirements within 120 days, without legislative authorization or public comment.
Verified
What Existed Before
At Issue
No consensus standard for AI safety certification exists. NIST, the EU, and the global research community have not produced a stable, testable certification regime that procurement officials can administer.
California already had procurement standards. The Department of General Services maintained vendor qualification processes for state contracts. The Department of Technology evaluated technology purchases. Both departments operated under legislative authority with established rules, public comment processes, and administrative law constraints.
At Issue
The certification regime will favor large incumbents with compliance departments over small startups and open-source projects, functioning as a barrier to entry.
Executive Order N-5-26 directs these same departments to create new certification requirements within 120 days. The order does not go through the legislature. It does not trigger the Administrative Procedure Act's public comment requirements. It does not establish the technical standards against which vendors will be certified. It tells two departments to invent a certification regime and gives them four months.
California's legislature debated and passed SB 1047 in 2024, a comprehensive AI safety bill. Newsom vetoed it. He is now pursuing similar goals through executive action.
Verified
Before removing a boundary, understand why it was put there. The boundary between executive action and legislative authority exists because procurement rules that govern access to the world's fourth-largest economy should be debated in public, not drafted in a bureaucratic sprint.
The Certification Problem
Biased BipartisansReal-Time, Evidence-Based News Reports
Unlimited access to your personalized investigative reporter agent, sourcing real-time and verified reports on any topic. Your personalized news feed starts here.
Create Free AccountCertification requires a standard. A standard requires consensus on what 'good' looks like. No such consensus exists in AI safety and bias mitigation. The National Institute of Standards and Technology published its AI Risk Management Framework in 2023. The EU finalized its AI Act in 2024. Neither document has produced a stable, testable certification regime that procurement officials can administer.
Newsom's order asks state procurement officials to do in 120 days what NIST, the EU, and the global AI research community have not accomplished in years. The order does not name the standard. It does not reference existing frameworks. It directs the creation of a new one. Procurement departments do not have AI safety researchers on staff. They will hire consultants. The consultants will have opinions. Those opinions will become the standard. The standard will not have been tested, debated, or validated against any measurable outcome.
Who Gains Gatekeeping Power
The order's strategic logic is transparent. California spends billions on technology procurement. Companies that want access to those contracts will comply with whatever certification the state creates, even if the certification requirements lack technical rigor. The state is using its purchasing power as a regulatory lever.
That lever concentrates gatekeeping authority in procurement officials. A vendor's ability to sell AI products to the state will depend on how those officials interpret attestation requirements that have not been written yet. Large companies with compliance departments and legal teams will navigate this process. Small startups and open-source projects will not. The certification regime will function as a barrier to entry that favors incumbents.
Established institutions tend to create rules that favor established players. That tendency is not a conspiracy. It is a structural incentive. Procurement officials evaluate risk conservatively. Conservative risk evaluation favors companies with long track records and extensive documentation. The companies best positioned to comply with undefined certification requirements are the companies that least need regulatory oversight.
Biased BipartisansThink Further on BIPI.
Where seeking the truth is a journey, not a destination.
Learn moreThe Federal Preemption Dodge
Legal analysts noted that Newsom chose procurement authority rather than legislative regulation to insulate the order from federal preemption challenges. The Trump administration rolled back federal AI safety protections, and Newsom positioned California's order as a counterweight. The framing is appealing. The structure is evasive.
Using procurement power to avoid the legislative process because the legislative process might produce different outcomes is not good governance. It is a workaround. California's legislature debated and rejected SB 1047, a comprehensive AI safety bill, in 2024 after Newsom himself vetoed it. The governor is now accomplishing through executive action what the legislature and his own veto declined to accomplish through law. The process matters. Stability is not stagnation. It is the foundation on which productive change can be built.
What Prudent AI Regulation Looks Like
AI regulation is coming. The question is whether it arrives through deliberation or fiat. Deliberation means legislative debate, public comment, expert testimony, and standards development by bodies equipped to do that work. Fiat means an executive order that directs a procurement department to invent requirements in four months.
Every radical reform creates unintended consequences that the reformers did not anticipate. A certification regime drafted by procurement officials under deadline pressure, without legislative authority, without public comment, without established technical standards, will produce unintended consequences. Some vendors will be excluded for arbitrary reasons. Others will game the attestation process. The certification will provide the appearance of safety governance without the substance.
The impulse to regulate AI responsibly is sound. The mechanism chosen to do it is not. Change without understanding what you are changing is not progress. Newsom's order changes the procurement system. It does not demonstrate understanding of what that system will need to evaluate, how it will evaluate it, or what happens when the evaluations are wrong.
