Separate the direction from the finished requirement
Executive Order N-5-26 directed DGS and CDT to submit recommendations within 120 days for certifications that may be incorporated into contracting, consistent with existing procurement law. It addresses safeguards concerning illegal content, harmful bias and civil rights. It also directs related work on contractor responsibility and watermarking guidance for certain AI-generated or significantly manipulated media.
The signed order is dated March 30. A department summary page lists March 20; the signed instrument is the source used here. That 120-day period has elapsed as of October 1, 2026. A recommendation deadline is not proof that a completed certification took effect on that date. A vendor must read the applicable solicitation, contract and issued guidance to determine its actual obligations.
Understand what purchasing power can—and cannot—do
A state can use its purchasing process to specify what it needs from a service and what evidence a contractor must provide within its legal authority. That makes procurement an important route for operational AI governance even while broader regulation remains debated.
It does not follow that procurement conditions are immune from federal preemption or other legal challenges. The distinction between government as a buyer and government as a regulator can matter, but outcomes depend on the specific law and measure. Counsel needs to assess the actual condition, not just the procurement label attached to it.
The practical point does not require that legal prediction: officials already writing specifications can make permitted requirements clearer and more testable. They should do so with counsel and technical reviewers, rather than assume a label such as certification settles the legal or operational question.
Build one evidence base and map it to each buyer
For vendors, differing state terms can create repeated evidence work. A reusable internal record should identify the product and version, intended uses, evaluation methods, known limitations, security controls, incident handling and relevant provenance capabilities. Map those records to each actual solicitation rather than assuming all fifty states use the same definitions—or all have adopted different AI regimes.
An evidence base should also make gaps visible. If an evaluation does not cover the buyer's population or workflow, do not present it as though it does. If a product depends on another provider's model, identify which claims the supplier can substantiate and which changes require reassessment.
This turns compliance planning into product governance. Sales, engineering and legal teams need the same account of what the system does and what the company is promising. An attestation that cannot be supported consistently across those teams is a delivery risk, not merely a paperwork problem.
Give the state capacity to evaluate the claim
A certification regime needs people who can distinguish a relevant test from a persuasive document. That capability can come from trained agency staff, shared technical resources or qualified independent support. The agency still needs an official responsible for deciding whether the evidence is sufficient for its use.
Review should continue after award. A model update, new data source or changed workflow can alter the basis for an earlier assurance. Contract terms should identify notification, access to evidence, revalidation and corrective action. The order itself does not establish the precise terms for every contract; these are implementation considerations for buyers developing them.
Translate one promise into an acceptance decision
Consider an illustrative purchase of an AI assistant that helps employees locate procurement policy. The vendor offers a broad assurance that its answers are accurate and responsible. The buyer's actual question is narrower: can staff retrieve the currently applicable policy, identify its source and recognize when the system cannot support an answer?
A useful specification connects that question to observable work. Provide authorized test material containing a current policy, a superseded version and a question the material cannot answer. Ask the supplier to show what the product returns, which source it cites and how it handles the missing answer. Include access restrictions where different users have different permissions. A correct answer obtained by exposing material to an unauthorized user is not an acceptable result.
The test should represent the intended deployment, with its limits recorded. It does not demonstrate that the system will answer every procurement question correctly or replace professional judgment. The procurement lead owns the acceptance record; technical and program reviewers assess the evidence within their disciplines. Counsel determines what commitments and remedies the contract can lawfully impose. Those roles are our recommended delivery model, not additional requirements created by the executive order.
Negotiate remedies the team can actually use
Now change the example after award. A supplier update causes the assistant to rely on superseded policy. A clause requiring accurate answers is difficult to use if the agency cannot identify the affected version, reproduce the result or preserve the output. Change records and usable evidence make the obligation actionable.
Before award, work through three practical questions:
- Can the defect be bounded? Identify affected functions, users and records. A limited failure may support disabling one feature while the rest of the service continues, if the product and contract permit it.
- Can the supplier demonstrate the repair? Specify the relevant retest, who reviews it and what happens while the issue remains unresolved. A supplier statement that the problem is fixed is different from a verified acceptance result.
- Can the agency continue the work? Establish a feasible fallback and the records or transition assistance needed if service must stop. An exit right has limited practical value without a way to recover essential information and resume operations.
These protections have costs. Requiring extensive custom testing for a low-consequence internal tool can consume more capacity than it saves. Reusing relevant supplier evidence and limiting a pilot may be appropriate. For a system affecting consequential public decisions, a broader evidence requirement and a workable continuity plan may be justified. Tie the burden to the use and consequences, not to a blanket AI label.
That is also useful discipline for vendors. A supplier that can explain its boundaries, produce relevant evidence and price support realistically gives the buyer a clearer delivery proposition. The strongest proposal makes the agency's acceptance decision easier without promising capabilities the product cannot sustain.
A sequence for a useful AI solicitation
- Define the use and affected decisions. Explain the task, users, data and actions the system may support. Avoid requesting generic responsible AI without operational context.
- Specify the evidence. Identify representative testing, security documentation, accessibility, privacy and error analysis appropriate to that use.
- Name the reviewer and acceptance decision. Establish who evaluates each category and how unresolved concerns reach an accountable official.
- Control material changes. Require notification and reassessment when model, data, permissions or delivery conditions change.
- Make remedies practical. Define correction, suspension, transition assistance and access to necessary records within applicable procurement law.
Purchasing language matters because it survives beyond a policy announcement. Its value depends on whether the agency can use it to decide, verify and respond throughout the service's life.
Sources and further reading
- Signed California Executive Order N-5-26 — controlling source for the order's date and directions.
- CDT executive-order index — department overview; its date differs from the signed document.
Spartan X connects AI consulting with engineering and program execution, helping turn a policy intention into requirements a team can evaluate, deliver and maintain. A stronger purchase order starts with that understanding of the work.
