California has moved from guidance to policy on generative AI. Executive Order N-12-23 in 2023 led to statewide guidelines in 2024, and in 2025 the Department of Technology added a set of GenAI policies to the State Administrative Manual. The one that governs purchasing is SAM 4986.9, revised in November 2025.
What agencies must do
- Complete the SIMM 5305-F Generative Artificial Intelligence Risk Assessment before awarding a contract. This applies to IT, non-IT, and telecommunications procurements, and it classifies the use as low, moderate, or high risk.
- For moderate or high risk, consult the Department of Technology before award.
- For moderate and high risk, evaluate the vendor against the NIST AI Risk Management Framework and NIST SP 800-53 security controls.
- Include the state's GenAI disclosure notification language in solicitations and contracts for IT and telecommunications goods and services.
What vendors must do
The notification language requires a contractor to tell the state in writing if it intends to provide GenAI as a deliverable, or intends to use GenAI, including GenAI from third parties, to complete all or part of a deliverable in a way that materially impacts the functionality of a state system, risk to the state, or contract performance. That second clause is broader than many vendors expect: it can cover using AI tools to produce the work, not only selling an AI product.
How to make the assessment go smoothly
Risk assessments stall when nobody can answer basic questions about the system. Agencies and vendors that prepare the following in advance move faster:
- A data flow: what information goes to the model, where it is processed, and what is stored.
- The model and hosting arrangement, including whether state data is used for training.
- Human review: which outputs a person checks before they are used, and how that is enforced.
- Logging: a record of prompts, sources, and outputs sufficient for audit and for investigating errors.
- Evaluation evidence: results against a test set of the agency's own questions, including the failures.
Designing these into the system from the start makes the assessment faster to complete, and it gives reviewers evidence to work from instead of assurances.
This article is general information, not legal or procurement advice. Confirm current requirements with your agency's procurement office and the Department of Technology.