Oregon Responsible AI Procurement Order

Overview

Oregon Executive Order No. 26-26, signed by Governor Tina Kotek at Salem on September 23, 2026, establishes responsible artificial intelligence procurement policy for state government. The State must seek to purchase, contract for, or otherwise utilize frontier artificial intelligence models that have received independent, third-party review for AI safety, consistently with applicable state and federal law. The signed executive order takes effect immediately and remains effective until terminated by the Governor. Secretary of State Tobias Read attested the order. Its mechanism is Oregon's purchasing, contracting, and technology-use authority, not a comprehensive market-wide licensing or private-sector regulatory regime.

The order addresses increasingly capable AI systems and potential risks to privacy, cybersecurity, public safety, civil rights, economic security, workforce demand, and the public interest. It recognizes independent review, testing, auditing, verification, and other third-party assessments as tools for safety, reliability, and accountability. Its immediate administrative requirements are preparation of an implementation proposal and agency cooperation. Detailed procurement standards require further development and gubernatorial approval and direction. Immediate effectiveness therefore does not make every contemplated safeguard, reviewer criterion, or contract condition finalized or universally mandatory.

Definitions and Scope

The order covers state purchase, contracting for, or other use of frontier artificial intelligence models. The State Chief Information Officer and state agencies involved in procurement, contracting, technology use, and implementation are its principal government actors. Suppliers and safety reviewers may experience procurement or contractual effects, but the instrument does not directly impose generally applicable requirements on all AI developers or operators.

The order does not establish a completed frontier-model definition. The State Chief Information Officer must propose a definition appropriate for state procurement and use, which will determine coverage under the approved implementation policy. No parameter-count threshold, training-compute threshold, capability benchmark, or list of covered models appears in the order. It does not incorporate another jurisdiction's definition or an industry-derived technical threshold.

Independent, third-party AI safety review is the central assessment concept, but adequacy standards remain for the implementation proposal. That proposal must address reviewer independence, qualifications, scope, methodology, and transparency. The order also requires evaluation of the viability of a kill-switch requirement. It supplies no technical specification for a kill switch and does not immediately require installation. Review, testing, auditing, and verification are recognized assessment approaches, not separate mandatory certifications or an exclusive prescribed methodology.

Governance and Institutional Framework

The Governor establishes the procurement policy, receives the implementation proposal, and controls approval and direction for implementation. The State Chief Information Officer must develop the proposal and subsequently coordinate implementation with state agencies. Agencies must cooperate with requests and provide information reasonably necessary to respond to the order. These responsibilities create centralized policy development with interagency implementation. The instrument does not establish a new AI regulator, independent certification authority, enforcement tribunal, or permanent procurement review board, and it does not designate an external organization as an approved reviewer.

The recitals recognize contributions from AI auditors, independent verification organizations, academic institutions, private-sector developers and operators, other states, consumer protection and labour organizations, civil society, and governmental and international organizations. This recognition supports drawing on diverse expertise but does not prescribe a consultation schedule or require appointment of those stakeholders to a new body. Oregon's earlier State Government Artificial Intelligence Advisory Council provides institutional background. The order does not expressly give that council a new approval power or transfer the Chief Information Officer's implementation duties to it.

Safety Review and Risk Management

The substantive focus is safety assurance for frontier AI models obtained or otherwise used by state government. Independent assessment can provide information about model capabilities, limitations, risks, and safety practices. The proposal must identify standards or criteria for determining whether a model has received adequate independent safety review and methods for evaluating reviewers. A review's existence is distinct from its adequacy: nominal third-party status does not settle independence, relevant qualifications, assessment coverage, methodological quality, or transparency.

Required risk-management subjects include the viability of a possible kill-switch standard, integration of reviews into procurement and contracting, and ongoing monitoring and reevaluation. The policy must address circumstances in which an applicable review is unavailable, including emerging technologies, specialized applications, and state or public safety needs. Transparency and accountability concerning state procurement and use also require recommendations. Privacy, civil rights, cybersecurity, economic security, and workforce impacts are policy concerns, but the order does not separately prescribe detailed privacy notices, discrimination-testing protocols, employment protections, security certifications, or public reporting templates for each concern.

Implementation Requirements

The State Chief Information Officer must develop and submit an implementation proposal to the Governor within 90 days of issuance. At a minimum, it must contain nine elements: a frontier-model definition; standards or criteria for adequate independent safety review; evaluation of kill-switch viability; methods for assessing reviewers; integration of reviews into procurement, contracting, and technology use; appropriate exceptions or alternatives when review is unavailable; ongoing monitoring and reevaluation procedures; transparency and accountability recommendations; and necessary statutory, administrative, budgetary, or policy changes. Additional relevant content is permitted. The order does not prescribe a proposal format or require a separate public consultation document.

After approval and direction by the Governor, the Chief Information Officer must coordinate with agencies to implement the approved policy consistently with applicable state and federal law. The proposal deadline is not a deadline for deploying every procurement standard, obtaining reviews for all state-used models, or installing shutdown mechanisms. No fixed gubernatorial approval or implementation-completion date is established.

Consideration of exceptions is a required proposal topic rather than an unrestricted exemption already available to every agency. Eligibility rules, approval routes, alternative safeguards, contract clauses, and administrative processes depend on the approved policy and any supporting legal or budgetary changes. Agency cooperation and provision of reasonably necessary information support both proposal development and implementation. Identifying necessary statutory, administrative, budgetary, and policy changes is an express duty, not an assumption that the order alone resolves every implementation obstacle.

Monitoring and Gubernatorial Reassessment

The proposal must include ongoing monitoring and reevaluation procedures responsive to changes in AI models, capabilities, risks, and independent review standards. A historical safety assessment may become less informative as a model or the assessment landscape changes. The order does not establish a model-level review interval, mandatory retesting event, incident-reporting deadline, audit-retention period, numerical safety benchmark, or required monitoring platform. It also does not prescribe a completed continuous-assurance system. The approved implementation policy must determine the operational procedures rather than treating a single historical review as conclusively satisfying every future standard.

A separate duty requires the Governor to reassess the order's necessity every three months and retain, modify, or supplement it as circumstances warrant. This review of the instrument is distinct from model-monitoring procedures developed by the Chief Information Officer. The first three-month anniversary is December 23, 2026, a date derived from issuance rather than separately stated in the order. Reassessment does not automatically terminate the instrument or require quarterly reissuance. The order has no fixed sunset date and remains effective until terminated by the Governor.

Penalties, Liability, and Appeals

The order establishes no monetary fines, criminal offenses, statutory damages, private right of action, or dedicated civil liability standard. Its operative mechanism is executive direction of state policy development and administration, supported by the agency cooperation duty. Suppliers may face procurement requirements or contractual conditions developed under the approved policy, but the order itself establishes no statewide sanction schedule for vendors or reviewers. It does not require insurance, prescribe indemnification, allocate liability between developers and agencies, or provide automatic debarment for models lacking independent review.

No special appeal procedure, hearing right, complaint mechanism, or procurement-protest timetable is created. Implementation must remain consistent with applicable state and federal law, including other governing legal requirements, but the order does not identify which existing remedies apply to a particular procurement decision. The duty to identify necessary statutory and administrative changes may reveal issues requiring further legal action. Contract disputes, agency decisions, and vendor exclusions must therefore be assessed under the approved policy and applicable law rather than a complete remedial framework established by this instrument.

Relationship to Other Instruments and Federal Alignment

The order builds on Executive Order 23-26, which established the State Government Artificial Intelligence Advisory Council and resulted in recommendations for AI awareness, education, and state-government use consistent with Oregon's policies, goals, and values. Executive Order 26-26 does not expressly repeal or supersede that earlier instrument. It adds a focused direction to develop independent safety-review standards for frontier AI procurement and use, rather than restating the entire advisory framework or making every prior recommendation a new binding requirement.

The Governor's official announcement describes existing executive-branch responsible-AI requirements involving risk management, human accountability, transparency, and oversight. This order directs additional safeguards specifically for frontier models. It does not name a mandatory NIST standard, incorporate a particular international AI instrument, or adopt another state's procurement criteria. Alignment with external assessment methods would require implementation action. Oregon's official executive orders page provides the governmental publication context for gubernatorial instruments.

The recitals recognize a federal role in clear national standards for frontier AI safety and security, including independent evaluation, oversight, and accountability. They call for congressional hearings and oversight and consideration of appropriate federal safeguards, and express the Governor's criticism of federal leadership on AI risks. These statements explain policy rationale; they do not impose federal duties, establish that Congress enacted a particular measure, or determine the legal effect of a specific federal AI instrument.

Both the procurement policy and implementation must comply with applicable state and federal law. This qualification does not resolve particular preemption questions or identify a federal certification scheme. Oregon's procurement-and-use approach is narrower in institutional reach than nationwide developer regulation. Federal orders and bills are not incorporated merely because they concern AI. The order creates no federal reciprocity rule, cross-state reviewer-recognition mechanism, or binding international conformity arrangement. Further legal, administrative, budgetary, or policy instruments may be needed for implementation.

Implementation Timeline

Sources and References