Part of the AI Regulation News hub.
Oregon's governor has made it state policy to seek frontier AI models that have had independent third-party safety review, and has given the State CIO 90 days to propose how that would work
The order binds state agencies, not AI vendors. Its operative verb is "shall seek to", and every standard a vendor would eventually have to meet is still unwritten.
Bottom line: Binding on Oregon state government from 23 September 2026, but what it binds is a policy statement and a drafting task. No procurement standard exists yet, and the order places no direct obligation on AI developers or vendors.
Who this affects: Public-sector technology and procurement counsel, Oregon agency CIOs and contracting officers, government contracts teams at frontier AI developers and resellers, and AI assurance firms that expect to act as third-party reviewers.
Issue date: Signed at Salem on 23 September 2026 and effective immediately. The State CIO's implementation proposal is due within 90 days, which by our count is 22 December 2026. The order itself gives no calendar date.
What changed: Oregon now has a stated policy that the State "shall seek to" buy or use frontier AI models that have received independent, third-party review for AI safety, plus a 90 day instruction to the State CIO to turn that into a definition, review criteria and procurement processes.
Analysis: In our reading, vendors are reached only indirectly, and only after the Governor approves a CIO proposal and agencies apply it through purchasing and contracting. Until then the order changes what the State is designing, not what any contract says.
Primary sources: Executive Order No. 26-26 (scanned, four pages, linked from the Governor's release) · Governor Kotek press release, 23 September 2026
- Instrument (EN)
- Executive Order No. 26-26, Establishing Responsible Artificial Intelligence Procurement Standards for State Government
- Authority
- Governor of Oregon, Tina Kotek
- Jurisdiction
- United States, State of Oregon (state government)
- Status
- Signed 23 September 2026. Effective immediately and in effect until terminated by the Governor
- Bindingness
- Directs the State Chief Information Officer and state agencies. Imposes no direct obligation on private AI developers or vendors
- Issue date / next deadline
- 23 September 2026. CIO proposal due within 90 days (22 December 2026 by our count). The Governor is to reassess the order every three months
- Document
- Four-page scanned order hosted on Google Drive and linked from the Governor's oregon.gov press release
- Primary source
- https://drive.google.com/file/d/1FHCBOBdcaUNZ3_Zg2WxtSXZpYzP8tk1h/view
What the order actually commits Oregon to
The operative policy is one sentence, the first bullet under "NOW, THEREFORE, IT IS HEREBY DIRECTED AND ORDERED" on page two. It says the State "shall seek to purchase, contract for, or otherwise utilize frontier artificial intelligence models that have received independent, third-party review for artificial intelligence safety, consistent with applicable state and federal law."
Two qualifiers do real work there. "Shall seek to" is a direction to pursue an outcome, not a prohibition on buying anything else. And the closing words tie the policy to applicable state and federal law, so the order does not purport to override procurement statutes.
The Governor's office published a two-page FAQ alongside the order, and its wording is stronger. It describes the policy as being "to utilize frontier AI models only if they have received independent, third-party safety review". The signed order does not say "only if". We treat the order's text as operative and flag the difference; the FAQ also says agencies will be required to seek reviewed models, which is closer to the order's own verb.
A nine-point brief for the State Chief Information Officer
The second bullet gives the State CIO 90 days from the date of the order to "develop and submit to the Governor a proposal for implementing the policy". The proposal is to address, "at a minimum", nine matters.
They are: a definition of "frontier artificial intelligence model" suited to state procurement and use; standards or criteria for deciding whether a model has had adequate independent, third-party safety review; the viability of a kill switch requirement; methods for judging the independence, qualifications, scope, methodology and transparency of reviewers; processes for building safety reviews into procurement, contracting and technology-use practice; exceptions or alternative requirements where no applicable review exists; ongoing monitoring and reevaluation; transparency and accountability recommendations; and any statutory, administrative, budgetary or policy changes needed.
The exceptions item deserves attention from anyone selling to the State. It expressly contemplates "emerging technologies, specialized applications, or state or public safety needs" as circumstances where an applicable third-party review may be unavailable. The order anticipates carve-outs before the rule itself exists.
The kill switch is an evaluation, not a requirement
The Governor's release names the kill switch. The order itself asks only for "Evaluation of the viability of a 'kill switch' requirement as one of the standards for frontier artificial intelligence models".
Nothing in EO 26-26 requires a kill switch today, defines one, or says who would operate it. Whether one appears at all depends on what the CIO proposes and what the Governor approves.
Where vendors actually sit
The third bullet sets the sequence. "Upon approval and direction by the Governor", the State CIO is to coordinate with state agencies to implement the approved policy, and agencies are to cooperate and provide information reasonably necessary to respond to the order.
So the chain has three links: a CIO proposal, gubernatorial approval, then implementation through agency purchasing and contracting. A frontier model developer or reseller is affected only at the third link, when a solicitation or contract term reflects the approved standard. The order itself addresses no private party.
The Governor's FAQ is consistent with that reading on timing. It says state agencies "will continue to abide by current policies and practices in place for responsible AI procurement and use" and that more will be communicated once the CIO submits a proposal.
What the recitals say, and what they do not do
The preamble includes an openly political finding. One recital states that President Donald Trump "has put up no barriers to the rapid, unregulated growth of artificial intelligence in the United States"; another says Congress should hold hearings and consider federal standards.
Other recitals connect the order to Executive Order 23-26, which established the State Government Artificial Intelligence Advisory Council, and list the kinds of expertise Oregon can draw on, including AI auditors, independent verification organizations, academic institutions and developers.
Recitals are findings. They explain the order; they do not add directions to it, and nothing in them binds an agency or a vendor.
What we did not verify
What we opened: the four-page executive order, reached through the "full text" link in the Governor's 23 September 2026 press release, which resolves to a Google Drive file. We downloaded it twice and the two copies were byte-identical. The document is a scan with no text layer, so we transcribed it by machine OCR and checked every quoted passage against the page images; typographic quotation marks in the original are rendered here as ASCII, and as single quotes where they fall inside a quotation. We also read the press release and the accompanying FAQ in full.
What we did not open: Executive Order 23-26, Oregon's existing statewide AI use requirements that the release refers to, any Oregon procurement statute or rule, and any copy of the order on an oregon.gov domain other than the Drive file the release links to. The Secretary of State's attestation line on page four of the copy we read carries no visible signature; we record that as an observation about this copy and draw no legal conclusion from it.
What we refuse to claim: that Oregon now bars agencies from using unreviewed frontier models, because the order says "shall seek to"; that any kill switch is required; that any vendor obligation exists yet; what "frontier" will mean; and that the CIO proposal will be delivered or approved on any particular date. The 22 December 2026 date is our arithmetic, not the order's.
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
EO 26-26 is a policy and a drafting instruction, not a procurement rule. The terms that would matter to a vendor, meaning the definition of frontier model, the review criteria, the reviewer-independence tests and the exceptions, are all assigned to a State CIO proposal due within 90 days and effective only on the Governor's approval. Counsel for AI suppliers to Oregon should track that proposal, not the order, for anything that would reach a contract.
Source File
https://drive.google.com/file/d/1FHCBOBdcaUNZ3_Zg2WxtSXZpYzP8tk1h/view
Open the order from the Governor's press release and check three things on pages two and three: the verb "shall seek to" in the policy bullet, the 90 day deadline and the nine listed topics in the CIO bullet, and the words "Upon approval and direction by the Governor" that gate implementation.
It is the policy of the State of Oregon that, in the interest of the safety and security of the people of Oregon, while supporting innovation and the responsible use of artificial intelligence, the State shall seek to purchase, contract for, or otherwise utilize frontier artificial intelligence models that have received independent, third-party review for artificial intelligence safety, consistent with applicable state and federal law. ยท Executive Order No. 26-26, first ordering bullet, page two, 23 September 2026
FAQ
Does EO 26-26 stop Oregon agencies from using frontier AI models that lack third-party review?
Not on its text. The order sets a policy that the State "shall seek to" use reviewed models, consistent with state and federal law, and asks the CIO to propose exceptions where no review is available. The Governor's FAQ uses stronger "only if" wording, but the signed order does not.
Does the order apply to AI companies directly?
No. It directs the State Chief Information Officer and state agencies. Vendors would be affected only if the Governor approves a CIO proposal and agencies then apply it through procurement and contracting.
What counts as a frontier AI model?
The order does not say. Producing a definition "appropriate for application to state government procurement and use" is the first item on the CIO's list.
When is the next step due?
The CIO's proposal is due within 90 days of 23 September 2026, which by our count is 22 December 2026. Implementation follows only upon the Governor's approval and direction, and the Governor is to reassess the order every three months.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.