New California AI Regulations Signal a Shift for All Businesses

Artificial intelligence is moving fast. Regulations are starting to catch up.

California just made its position clear.

Under a new executive order signed by Gavin Newsom, companies seeking contracts with the state must now demonstrate safeguards around how they use AI. This includes protections against misuse, bias, and violations of civil rights.

While this directly impacts government contractors, the bigger story is what it signals for every business.

What’s Changing

At its core, the order requires businesses to take responsibility for how their AI tools operate.

That means putting safeguards in place to:

• Prevent AI from generating illegal or harmful content

• Address bias and ensure fair, ethical outputs

• Protect civil rights in automated decision-making

• Clearly identify AI-generated media to reduce misinformation

This is a shift away from experimentation toward accountability.

Transparency Is Becoming the Expectation

One of the more notable elements of the order is the push for transparency. State agencies are now expected to watermark AI-generated images and videos. The goal is simple: make it clear what is real and what is AI-generated.

For businesses, this points to a broader expectation. Clients, partners, and regulators are beginning to expect visibility into how AI is being used. Not just behind the scenes, but out in the open.

Supply Chain Risk Is Getting More Complex

The order also highlights a growing focus on supply chain risk tied to emerging technologies.

Even if a company is flagged at the federal level, California may conduct its own independent review rather than automatically disqualifying it.

This comes amid recent developments involving Anthropic, which was labeled a supply chain risk in certain federal contexts. What this tells us is that businesses will need to understand not just their own AI usage, but also the risks associated with the vendors and platforms they rely on.

Certifications Are Likely Next

Within the next 120 days, California agencies are expected to introduce new AI-related vendor certifications.

These will likely require businesses to formally attest to responsible AI governance, security controls, and public safety protections.

We’ve seen this before.

Cybersecurity followed a similar path, moving from best practices to expectations, and eventually to requirements tied to compliance and insurance.

AI is now on that same trajectory.

Why This Matters Beyond California

Even if your business has no plans to work with the state, this still matters.

California often sets the tone for broader regulation. What starts here tends to expand into other states, industries, and even federal standards. More importantly, expectations are already shifting.

Businesses are being asked:

• How are you using AI?

• What safeguards are in place?

• Could your tools introduce risk to your clients or operations?

If those questions are difficult to answer, that’s a gap worth addressing now.

The Bigger Shift

This isn’t just about compliance. It’s about control and accountability.

AI is no longer just a tool. It’s becoming part of how businesses make decisions, interact with clients, and handle data. That means the risks are real.

The businesses that take a proactive approach now—putting structure, policies, and oversight in place—will be in a much stronger position as regulations continue to evolve.

Final Thoughts

California’s latest move makes one thing clear: Responsible AI is no longer optional.

Whether you are actively deploying AI tools or just beginning to explore them, now is the time to understand the risks and put the right safeguards in place. Because this shift is just getting started.

---

About Shield IT Networks

Shield IT Networks provides enterprise-grade cybersecurity solutions for businesses of all sizes, helping organizations stay ahead of evolving threats, technologies, and regulatory expectations.

From proactive threat detection and endpoint protection to compliance alignment and ongoing security leadership through our vCSO program, we help businesses build a structured and defensible approach to cybersecurity.

As AI adoption grows and new regulations emerge, having visibility into your risks is more important than ever.

If you’re unsure how AI, vendor risk, or compliance requirements may impact your business, schedule a quick Cyber Readiness Assessment with our team and get a clear understanding of where you stand and what to do next.