Newsom signed Executive Order N-5-26 on March 30. AI companies seeking California state contracts must now certify safeguards against bias, CSAM distribution, and civil rights violations. The Department of General Services and the California Department of Technology have 120 days to build the certification framework. State-level AI watermarking guidance comes bundled in.

This matters for what it isn't. It isn't legislation.

Ten days earlier, the Trump administration published its National Policy Framework for Artificial Intelligence. Seven pillars, a call for Congress to create a single federal standard, and explicit language about preempting what it called a fragmented patchwork of state AI regulation. The message: states should stop. But the framework's own text carves out state government procurement from preemption. The administration conceded, in writing, that it cannot dictate how states buy AI.

Newsom's team read the fine print more carefully than the people who wrote it.

California hosts 33 of the world's top 50 privately held AI firms. It captured over half of U.S. AI startup funding between Q3 2024 and Q2 2025. The state budget runs to roughly $300 billion annually. When California tells vendors they need certification to bid, that isn't a suggestion. Neil Shah at Counterpoint Research called it "a benchmark for de facto AI standards when it comes to procurement, safety, and ethics." Smaller vendors face a heavier compliance burden. The ones who pass have something to show for it elsewhere.

The sharpest provision targets the Anthropic situation. After the company refused to strip safeguards preventing autonomous weapons deployment and mass domestic surveillance, the Pentagon designated it a supply-chain risk to national security. A federal judge called the move "Orwellian." California's order now gives the state CISO authority to review such designations independently and, where warranted, override them for state procurement.

So California is building a parallel regulatory structure through spending power alone. No legislation required. No direct challenge to federal preemption. Just a procurement policy that sets safety standards the federal government specifically declined to set.

The ACLU's Cody Venzke described the administration's preemption strategy as "a hodgepodge of faulty legal theories." Even Republican legislators pushed back, with Utah and Texas among the states objecting to federal overreach. The administration retains leverage. The DOJ can sue. They can threaten broadband funding. But procurement sits in the carve-out. The federal government's own policy document says so.

California didn't break through the wall. It walked through the door that was already open.

Sources: