Contributing Authors
Table of Contents
On March 30, Governor Newsom signed Executive Order N-5-26, directing California agencies to develop new AI procurement standards that require companies to demonstrate responsible policies around content safety, bias governance, and civil rights protections. The order doesn’t impose requirements on companies today but it does start a 120-day clock. By late July 2026, the certification framework will land, and the enterprises that prepared early will have a significant advantage.
Why Procurement Is the Governance Mechanism That Matters Right Now
The federal AI regulatory picture has been volatile. President Trump revoked Biden’s sweeping AI executive order on his first day in office. His December 2025 executive order created a DOJ AI Litigation Task Force to challenge state AI laws and threatened to withhold federal funding from states with regulations the administration considers “onerous.”
But that same order explicitly carved out state procurement from preemption. California’s new executive order operates entirely within that protected lane (using purchasing power rather than regulation to set AI governance standards).
This matters for every enterprise, not just those selling to California. When the world’s fourth-largest economy defines what questions to ask AI vendors about bias, content safety, and civil liberties, those questions quickly become the market’s questions. Other states follow California’s lead. Enterprise buyers adopt the same frameworks. And the governance infrastructure you build for procurement readiness becomes your governance infrastructure across the board.
What the Order Will Require
Companies seeking California state contracts will need to attest to and explain their policies across three areas:
Content safety: How does your technology prevent exploitation or distribution of illegal content, including CSAM and non-consensual intimate imagery?
Bias governance: Do your models display harmful bias, and what governance structures exist to reduce that risk?
Civil rights protections: What safeguards exist around free speech, voting, human autonomy, and protections against unlawful discrimination, detention, and surveillance?
What Enterprises Should Do During the 120-Day Window
The certification framework hasn’t been finalized yet, which means this is preparation time, not reaction time. Organizations that build governance foundations now will be positioned to respond quickly when procurement requirements become concrete.
Inventory your AI landscape. You can’t attest to what you can’t see. Knowing which models, agents, and data sources are operating across your organization is the prerequisite for any procurement attestation. A centralized AI registry (tracking ownership, risk classification, and compliance status) turns an overwhelming audit exercise into a manageable, ongoing process.
Map your governance documentation to the three attestation categories. Can you currently produce clear, defensible documentation of your policies around content safety, bias mitigation, and civil rights protections? If those policies exist but live in disconnected documents, spreadsheets, or team wikis, they won’t survive procurement scrutiny. Consolidating governance documentation into a single, auditable system of record is the difference between being ready and scrambling.
Classify risk and enforce accountability now. California’s framework will expect companies to demonstrate not just that policies exist, but that they’re implemented and monitored. Tiered risk classification is the foundation. Automated policy enforcement, human-in-the-loop approval workflows, and continuous monitoring create the evidence trail that procurement evaluators will be looking for.
Treat multi-jurisdictional compliance as a system, not a series of one-offs. Between California’s procurement standards, SB 53, the EU AI Act, NIST AI RMF, and ISO 42001, governance teams face overlapping but distinct requirements across multiple frameworks. Managing each one manually doesn’t scale. Organizations need governance infrastructure that maps controls to multiple regulatory frameworks simultaneously.
Governance as Strategic Infrastructure
California’s executive order reinforces what we’ve been saying at Airia: governance isn’t a compliance exercise you bolt on after deployment. It’s strategic infrastructure that determines whether your organization can move fast, sell confidently, and adapt as the regulatory landscape shifts.
The shift from regulation-driven to procurement-driven governance raises the bar. Regulators ask whether you’re compliant. Procurement evaluators ask whether you can prove it with documentation, audit trails, and evidence of ongoing monitoring. That’s a higher standard, and it requires governance capabilities embedded directly into your AI operations, not policies sitting on a shelf.
Airia’s unified platform combining AI governance, security, and agent orchestration is built for exactly this environment.
