Oregon Requires Outside Safety Reviews for Frontier AI Used by State Agencies

Oregon has put a safety condition on the most advanced AI models its executive agencies buy or use: they must receive independent, third-party review. Governor Tina Kotek’s order is already in effect, but the state still has to define which models qualify and what counts as an adequate review.

A new condition for state purchases

Kotek issued Executive Order 26-26 on September 23. It says Oregon will buy, contract for and use frontier AI models that have received independent safety review, consistent with state and federal law. The order governs state executive agencies’ purchasing and use; it does not impose a general review requirement on AI companies’ sales to other customers.

The step builds on statewide rules requiring executive agencies to manage AI risks and maintain human accountability, transparency and oversight. Kotek argued that states must act while federal safeguards remain insufficient. She said she would use her executive authority until Oregon lawmakers and Congress pass comprehensive standards for AI companies.

It's encouraging to hear AI companies are beginning to come forward with proposals to address safety concerns, but we cannot simply wait for the private sector to self-regulate a technology that poses such an existential and evolving risk.

Oregon Governor Tina Kotek, in a statement reported by KTVZ

Woods must turn the condition into a test

State Chief Information Officer Terrence Woods must develop criteria for an adequate outside safety review and a definition of frontier AI suited to state purchasing and use. He must also work out how agencies should incorporate reviews into procurement, contracts and technology-use practices. Those decisions will determine how officials apply the order to particular models and purchases.

Another assignment is to assess whether a kill-switch requirement for frontier AI models would be viable. An emergency shutoff is an option under study, not a safeguard the order has already required. That leaves a separate choice alongside the order’s condition for outside review.

A deadline for the proposal, not for adoption

Woods has 90 days to submit an implementation proposal to Kotek. Hope Hiebert, communications director at Oregon Enterprise Information Services, said it will address the criteria for adequate independent review. Oregon has no separate timeline yet for adopting any resulting standards, she said. The proposal therefore has a deadline, but the state has not set one for putting its detailed review criteria in place.

The order remains active until Kotek terminates it. She will reassess its necessity every three months, giving the policy a recurring review even as agencies await the standards for applying it.