No, California Doesn’t Have an Approved AI Vendor List. Here’s What It Actually Has.

Last verified: September 6, 2026. By Abbas Khan, who covers SLED buying for Civic IQ. He works from primary records: council and board agendas, adopted budgets, and public purchase orders. Checked against the text of Executive Order N-5-26 at gov.ca.gov.

Is there a California approved AI vendor list?

No. No such list has been published. Not by the Department of General Services. Not by the California Department of Technology. Not by the Government Operations Agency.

The mix-up traces to a real document that says something else. Here is Executive Order N-5-26, section 1:

Three things follow. Each is a step away from a vendor list.

• The deliverable is advice, not a rule.
• It goes to the Governor, not to the public. Nothing had to be published on July 28.
• Adoption is conditional. The words are “may be incorporated.” They apply only “where consistent with existing procurement statutes and regulations.” Some of the plan may need a change in law first.

Ropes & Gray called the order modest. It said the order plainly creates no rights you can enforce. Akin Gump noted the order is not law, and looks forward. It does not tell agencies to reopen contracts they already hold. Baker Botts read section 1 the same way. Advice, sent, within 120 days.

Is a certification approach the same as an approved vendor list?

No, and the difference decides whether a vendor is shut out.

Section 1 is built on attestation. A vendor would vouch for its own policies and safeguards, and explain them. That is a paperwork burden. It is not a gate held by a state panel. Under this model, a two-person startup that can document its safeguards stands where a hyperscaler stands.

The three attestation areas in section 1 are:

• Illegal content. Exploitation or distribution of illegal content, including child sexual abuse material and nonconsensual intimate imagery.
• Harmful bias. Models that show harmful bias, or that lack the governance to reduce that risk.
• Civil rights and civil liberties. Free speech. Voting. Human autonomy. And protection from unlawful bias, detention and surveillance.

Want something concrete to do? Build your files in those three areas. It is the one piece of advice from the April legal alerts that has held up.

Does N-5-26 apply to cities, counties and special districts?

No. The order directs state departments and agencies. By its own terms it does not bind cities, counties, school districts or special districts. Each of those holds its own buying power.

This matters. Much of the local AI buying now credited to N-5-26 sits outside the order entirely. City building departments are not state agencies. Nor are county sanitation districts, city police departments or housing authorities. When they buy AI tools, they buy under their own rules. No state certification unlocked anything for them. Our guide to selling to government agencies in California covers those separate tracks.

Local agencies may copy state standards once those standards exist. Several likely will. That is the normal pattern in California. But copying a future template is not a mandate. And it is not happening yet, because the template does not exist.

What actually governs selling AI to California state agencies right now?

A rulebook that predates N-5-26 and is unchanged by it.

• Executive Order N-12-23, from September 6, 2023. The founding GenAI order.
• The State of California GenAI Guidelines for Public Sector Procurement, Uses and Training, from March 2024. It carries out N-12-23. GovOps, CDT, DGS, ODI and CalHR wrote it together. It went out as interim guidance.
• SIMM 5305-F, the risk assessment state entities apply before they deploy GenAI.
• SIMM 71A. This is the existing Certification of Compliance with IT Policies, used for statewide technology buying.
• The Transparency in Frontier Artificial Intelligence Act, in force January 1, 2026. It covers large frontier developers. It does not cover vendors in general.
• The California AI Transparency Act, Business and Professions Code sections 22757.2 to 22757.3. It took effect August 2, 2026. It sets disclosure and provenance duties for large GenAI providers.

Sell AI to a California state agency this month and you comply with that stack. Not with N-5-26. For where the money has gone, see our analysis of California government technology contracts and spending.

What else is in the order that nobody is covering?

Two provisions matter more than the certification headline, and get almost no coverage.

Section 2: California can override national supply-chain-risk labels. The order tells CDT’s State Chief Information Security Officer to review them. These are the labels the national government puts on companies it calls a supply chain risk. If the officer finds a label improper, DGS and CDT issue joint guidance. State agencies can then keep buying from that company. So the state is saying it will judge who may sell to it, on its own, apart from what Washington decides. That is genuinely new. It is also the part most likely to end in a real fight.

Section 4: wider state use of AI. This is where the demand is. The order tells agencies to give staff access to vetted GenAI tools, with privacy and cybersecurity safeguards. It tells them to update the State Digital Strategy. It orders a pilot app. That app would give Californians AI-powered access to state services, sorted by life event. It widens staff training on new technology. And it calls for a data minimization toolkit.

Every item on that list is a future purchase. Section 4 is the buying signal in this order. Section 1 is the paperwork attached to it. Most coverage flipped the two. Law firms wrote most of that coverage, for compliance counsel, not for anyone trying to sell. Our guide to AI buying signals in the public sector covers how these show up early.

Why is the order built this way?

Because buying power may be the one lane left open.

In December 2025, a national executive order told agencies to challenge state AI laws. It also set up a Department of Justice task force to argue those cases. Then in March 2026 the White House put out a National Policy Framework. It urged broad preemption of state AI laws, but kept some carve-outs. One carve-out is state government purchase and use of AI.

N-5-26 sits inside that carve-out. California used its buying power instead of writing rules that bind everyone. That may shield these terms from a preemption challenge. It also explains the attestation model. Self-certification inside normal buying power is easier to defend than a detailed rule.

It also explains why the order is non-binding on purpose. A memo of advice is a much smaller target in court than a rule.

What would actually signal that this became real?

Watch for artifacts, not anniversaries. The July 28 date has passed and produced no public change. These five would.

1. A DGS contract template or General Provisions change adding AI attestation language. This is the clearest tell. It is the document that shows up in a real bid.
2. A CDT SIMM update. Most likely to the 71A package or the 5305-F risk assessment.
3. A GovOps release that replaces the March 2024 interim guidelines with permanent policy.
4. Solicitation language itself. An RFP whose terms cite N-5-26 or require a new attestation.
5. An act by the Governor adopting the advice. Section 1 leaves that step to the Governor.

Until one of those exists, claims that California “now certifies” AI vendors describe a document nobody has written.

What should you do this week?

Five things, and none of them involve applying for anything.

• Do not chase a list. There is nothing to apply to and no registry to appear on. Any service offering to get you certified or listed in California right now is selling you something that does not exist.
• Build the three attestation files. Illegal content. Bias governance. Civil rights. Those three hold across every version of this that could ship. They also map onto what most enterprise security reviews already ask for.
• Read SIMM 5305-F. That is the assessment a California state entity applies to you today.
• Point your pipeline at section 4, not section 1. Staff GenAI access. The State Digital Strategy refresh. The life-event services pilot. Those are the purchases this order generates. Our guide to finding government GenAI opportunities early covers how to catch them. And where cities and counties actually are sets the baseline.
• Ignore the state and local mix-up. If you sell to cities and counties, N-5-26 does not change your position at all.

Which technology bids are open right now?

The forward-looking record is the useful one. These four were open on September 6, 2026. Three are state agencies. One is a township. That is the same state and local split this order turns on. Status changes daily.

• South Carolina Department of Transportation AI for Transportation Project Estimating and Costing RFI 2026, SC. Due September 11, 2026.
• Pennsylvania DL&I Identity Verification Services RFP-13755 2026, PA. Due September 14, 2026.
• Texas Workforce Commission Assistive Technology Services Open Enrollment 3202600208, TX. Due February 4, 2027.
• Township of Vernon Information Technology Consulting Support CC #26-09 RFP 2026, NJ. Due September 9, 2026.

The list worth more is the one nobody prints. It is the AI and technology contracts up for renewal in your state in the next twelve months. Ask Civic IQ for the AI contracts expiring in your state →

Related questions

Is there a California approved AI vendor list?

No. No such list has been published. Not by the Department of General Services, not by the California Department of Technology, and not by the Government Operations Agency. Executive Order N-5-26 ordered advice to the Governor, not a list. Nothing in it stops any vendor from bidding on a California contract today.

What did Executive Order N-5-26 actually require?

It told two state departments to send the Governor advice on new certifications. Those may one day be built into state contracts. The order was signed March 30, 2026. The advice was due July 28, 2026. The deliverable was a memo to the Governor. Nothing had to be published.

Can I get certified as an AI vendor in California right now?

No. There is no standard, no registry and no application. Any service offering to get you certified or listed in California today is selling you something that does not exist.

Does N-5-26 apply to California cities and counties?

No. The order directs state departments and agencies. It does not bind cities, counties, school districts or special districts. Each of those holds its own buying power. Local agencies may copy state standards once they exist. That is voluntary, and it is not happening yet.

What rules govern selling AI to California state agencies today?

Executive Order N-12-23 from September 2023. The March 2024 GenAI Guidelines, issued as interim guidance. SIMM 5305-F for risk assessment. And SIMM 71A, the existing IT policy compliance certification. Two disclosure laws also apply to large providers: the Transparency in Frontier Artificial Intelligence Act and the California AI Transparency Act.

What should a vendor prepare for?

Build files in the three areas the order names. Illegal content. Harmful bias, and the governance to reduce it. Civil rights and civil liberties. Those three hold across any version of this that ships. They also map onto what most enterprise security reviews already ask for.

How will I know when this becomes real?

Watch for documents, not anniversaries. A DGS contract template or General Provisions change adding attestation language is the clearest tell. A CDT SIMM update would count. So would a GovOps policy replacing the interim guidelines, bid language citing the order, or an act by the Governor adopting the advice.

How we verified this

We checked this page against the text of Executive Order N-5-26 at gov.ca.gov. Section numbers refer to that document. Where we cite a law firm, we name it and link the alert. We treat it as that firm’s reading, not as settled law. Status is current as of September 6, 2026.

Open bid items come from Civic IQ records pulled on September 6, 2026. Each is named with its issuing body, state and due date. So any reader can go check it. We update this page when a DGS, CDT or GovOps document changes the answer.

1. California Executive Order N-5-26, signed March 30, 2026. gov.ca.gov
2. Ropes & Gray, “Newsom Signs Executive Order Establishing AI Vendor Certification and Procurement Framework,” April 2026. ropesgray.com
3. Akin Gump, “Executive Order N-5-26: AI Certification Standards,” April 2026. akingump.com
4. California Executive Order N-12-23, September 6, 2023.
5. State of California, GenAI Guidelines for Public Sector Procurement, Uses and Training, March 2024, issued as interim guidance.
6. California Department of Technology, SIMM 5305-F and SIMM 71A.
7. Transparency in Frontier Artificial Intelligence Act, effective January 1, 2026.
8. California AI Transparency Act, Business and Professions Code sections 22757.2 to 22757.3, operative August 2, 2026.