California GovOps and its role in state AI governance

What the Government Operations Agency is

The California Government Operations Agency — GovOps — is a cabinet-level agency created on July 1, 2013 to run the operational backbone of state government. It oversees more than a dozen departments and offices; the exact roster varies by source, but its consistent members include the California Department of Technology (CDT), the Department of General Services (DGS), the California Department of Human Resources (CalHR), and the Office of Data and Innovation (ODI).

Its remit is deliberately unglamorous: statewide information technology, purchasing and contracting, the civil-service workforce, and the state's data practice. GovOps does not write consumer-protection statutes or run a single public-facing program; it owns the shared machinery every other department depends on. That structural position — sitting on procurement, IT standards, workforce training, and data all at once — is what later made it the natural home for AI policy.

Why GovOps became the hub of California's AI work

On September 6, 2023, Governor Gavin Newsom signed Executive Order N-12-23, directing the state to study the development, use, and risks of generative AI (GenAI) and to build a deliberate and responsible process for evaluating and deploying GenAI within state government. GovOps was placed at the center of that effort; in the agency's own description, GovOps is leading the GenAI work across the administration.

The choice follows from structure. Generative AI enters government the same way any technology does — it is bought (procurement, DGS), it runs on state systems and standards (IT, CDT), it changes how staff work (workforce, CalHR), and it consumes data (ODI). Those are precisely the levers GovOps already controls. Rather than stand up a new AI regulator, California routed the work through the agency that owns the mechanisms AI touches.

What GovOps has produced under the 2023 order

Under Executive Order N-12-23, GovOps coordinated a sequence of public deliverables — a risk study, procurement and training guidance, a workforce plan, and an adoption playbook for state entities. Together they trace California's move from studying GenAI to setting rules for how the state buys, uses, and staffs it.

The 2024 GenAI procurement guidelines

Released March 21, 2024, the State of California GenAI Guidelines for Public Sector Procurement, Uses and Training implement Executive Order N-12-23 and were jointly authored by GovOps, CDT, DGS, ODI, and CalHR. They are explicitly interim guidance, with a final procurement and training policy targeted for 2025 after piloting.

For procurement, the guidelines ask state entities to work through a defined sequence before and after a purchase.

• Identify a clear business need before procuring a GenAI tool.
• Assess the risks and impacts of the intended use, and complete a Generative AI Risk Assessment (SIMM 5305-F) to gauge exposure.
• Test models before deployment "to reduce bias and errors."
• Stand up a GenAI team to evaluate the deployed system on a continuing basis.

Training: mandatory for the teams that buy AI

The 2024 guidelines also make GenAI training a requirement for executive and procurement teams, not an optional extra. Beginning March 29, 2024, state purchasing officials access a Procurement GenAI Training through the California Procurement and Contracting Academy (CalPCA).

The pairing is deliberate: the same instrument that tells entities how to buy GenAI also requires the people doing the buying to be trained first. It is a concrete example of why the work sits with GovOps — the training runs through CalHR-adjacent and DGS procurement channels the agency already operates.

The 2026 Trusted AI Procurement order (N-5-26)

On March 30, 2026, Governor Newsom signed Executive Order N-5-26, titled Trusted AI Procurement. It builds explicitly on N-12-23 and is forward-looking — it does not reopen existing contracts — but it reaches any vendor nationwide that seeks to sell AI to California. The order is not itself a statute; it leverages the state's purchasing power to shape vendor behavior, and it hands most of the concrete work to GovOps components on a 120-day clock.

The headline item is a set of vendor certifications. N-5-26 directs DGS and CDT to recommend new certifications that contractors would attest to — these are directed recommendations, not yet an enacted mandate — covering three areas as summarized by legal analysts of the order:

• Illegal content — safeguards against generating or distributing material such as child sexual abuse material and non-consensual intimate imagery.
• Harmful bias — avoiding models that display harmful bias or that lack governance to reduce that risk.
• Civil rights and civil liberties — protections spanning free speech, voting, human autonomy, and protections against unlawful discrimination, detention, and surveillance.

Beyond certifications: the wider N-5-26 agenda

The order tasks GovOps and its component agencies with more than vendor attestations. Read together, these directives extend GovOps's role from setting procurement rules to steering how the state itself deploys AI and communicates it to the public.

As with the certifications, several of these are directives to recommend, publish, or pilot rather than services in force today — the public portal in particular is a directed pilot, not a tool that exists now.

• With DGS and CDT, propose "contractor responsibility" reforms targeting entities judicially determined to have unlawfully undermined privacy or civil liberties.
• With CDT, issue watermarking guidance for AI-generated or significantly manipulated images and video.
• Publish a data-minimization toolkit and update the State Digital Strategy.
• Develop a pilot GenAI-powered public portal organized around life events — the order names "disaster relief, starting a business, and finding a job."

Why an operations agency, not a dedicated AI regulator

California's approach is administrative rather than legislative. Its state-level AI governance so far runs on executive orders and agency guidance channeled through GovOps, not on a standalone AI statute. That is a meaningful contrast with binding law such as the Colorado AI Act (SB 24-205) or the EU AI Act (Regulation (EU) 2024/1689), which impose obligations by statute and regulation.

The trade-off is speed for force. Routing AI through the agency that already buys, builds, staffs, and standardizes technology lets the state move quickly and attach expectations to the act of purchasing — a real lever, given California's market size. But much of what GovOps issues is guidance and interim policy rather than law, and several of the 2026 order's most-cited requirements are still directives to recommend or to pilot, not rules in force. Reading GovOps output well means keeping that distinction in view.

Frequently asked questions