Oregon's new executive order on buying AI: what EO 26-26 says

Informational only, not legal advice. TacticalMS is not a law firm. Read more.

Oregon Governor Tina Kotek issued Executive Order 26-26 on September 23, 2026, to add safety review and oversight to the frontier AI models that Oregon state government buys and uses ¹. The order directs the State Chief Information Officer to write standards for independent, third-party AI safety review and to submit an implementation proposal within 90 days ^{1, 2}. For law firms that advise state agencies, contract with them, or share vendors with them, it is the newest Oregon primary document on how the state approaches AI.

What Executive Order 26-26 directs

The order's full title is "Establishing Responsible Artificial Intelligence Procurement Standards for State Government" ¹. According to the governor's release, it has three main directives ¹:

• Third-party safety review. The State Chief Information Officer must develop standards or criteria for adequate third-party review of AI safety ¹.
• A kill switch assessment. The state must assess the viability of a "kill switch" requirement for frontier AI models ¹.
• More procurement safeguards. The state must develop additional safeguards for buying and using frontier AI models, building on existing statewide requirements for responsible AI use ¹.

GovTech reported that, under the order, the state will buy, contract for and use frontier AI models "that have received independent, third-party review for artificial intelligence safety," consistent with state and federal law ².

What the 90-day implementation proposal must cover

The order took effect immediately and stays in effect until the governor terminates it ¹. The governor's release says the governor will reassess whether the order is still needed every three months ¹.

The State Chief Information Officer must submit an implementation proposal to the governor within 90 days ¹. Counting from September 23, 2026, that falls in late December 2026 ¹. According to GovTech, the proposal must address ²:

• A definition of frontier AI suitable for state procurement and use.
• Whether a "kill switch" requirement is viable as a standard for frontier AI models.
• Processes for building AI safety reviews into state procurement, contracting and technology-use practices.

What EO 26-26 does not settle yet

The standards themselves are not written. GovTech reported that Oregon's Enterprise Information Services said it did "not have a separate timeline to share yet" for adopting any resulting standards ². The definition of "frontier" AI for state purposes is also still to come, since it is one of the items the proposal must address ².

The kill switch item is an assessment of viability, not a requirement ¹. KATU described the order as asking the state "to evaluate" whether a kill switch should be required ³.

The sources describe the order as covering how the state buys and uses AI ^{1, 3}. None of them describe it as directly regulating private businesses. How the eventual standards might show up in state contracts is not yet known, and a licensed Oregon attorney is the right person to ask about a specific contract.

How EO 26-26 builds on Oregon's Responsible AI Usage Policy

KATU reported that the order builds on Oregon's existing Responsible AI Usage Policy, which governs generative and agentic AI in executive branch agencies, boards and commissions ³. That policy, Oregon Department of Administrative Services Policy 107-004-190, took effect June 16, 2026 ⁴.

Policy 107-004-190 applies to state agencies as defined in ORS 174.112, including entities within the Oregon executive department, and excludes the Secretary of State and the State Treasurer ⁴. It covers generative and agentic AI systems "used to conduct the business of the state," whether standalone or embedded in other software ⁴. Its main requirements include ⁴:

• Human oversight. The policy says human oversight "must be intentionally built into AI adoption and day-to-day use" ⁴. For the questions a law firm's own AI policy commonly covers, see our small-firm AI use policy checklist.
• Disclosure. Disclosure of AI use and a way for users to give feedback on AI-generated results are required ⁴.
• A statewide registry. The State CIO or a designee oversees a registry of AI-using applications in use or in development at state agencies ⁴.
• Approved environments. AI development, training and hosting are limited to approved, secure environments ⁴.

What other states are doing, as reported

GovTech placed Oregon's order alongside recent moves in other states ². As GovTech reported:

• California SB 813, signed in September 2026, sets up a framework for independent third-party assessments of AI safety risks, and California AB 1405 creates a state registry for AI auditors ².
• New York is implementing its Responsible AI Safety and Education Act, with developer registration in November and transparency standards in January 2027 ².
• Officials said Oregon will likely look to California for guidance as it builds its framework ².

The governor's release says states "must act with more urgency" while federal action is lacking ¹. KATU reported that the governor framed the order as a stopgap until the Legislature and Congress pass comprehensive AI standards ³.

Where to read it

The governor's release links the full text of Executive Order 26-26 and an accompanying FAQ ¹. The Responsible AI Usage Policy is published by the Department of Administrative Services ⁴. Both are listed below.

Not legal advice. This post is general information about law and technology, not legal advice. It does not create an attorney-client relationship, and TacticalMS is not a law firm. Laws, rules and ethics opinions change; check the cited sources and talk with a licensed Oregon attorney about any specific situation. Researched and drafted with AI tools from the sources above and checked against our editorial standards. Spot an error? Email intake@tacticalms.dev and we'll fix it.