Generates images with AI, in Ohio

Ohio Rev. Code sections 1354.01 to 1354.05 (enacted by Senate Bill 220, 132nd General Assembly, effective November 2, 2018; section 1354.01 last amended by House Bill 66, 132nd General Assembly, effective April 5, 2019) · Read the law's page

• This is an optional safe harbor, not a mandatory duty: this chapter requires no business to create a cybersecurity program (other Ohio laws, such as Chapter 3965 for insurance licensees, do bind particular sectors), and this chapter reaches only a covered entity, any business that accesses, maintains, communicates, or processes personal information (as defined by Ohio Revised Code 1349.19) or restricted information in or through a system, network, or service located inside or outside Ohio, that chooses to seek the affirmative defense described below.
• To seek that defense, create, maintain, and comply with a written cybersecurity program with administrative, technical, and physical safeguards, covering personal information alone or personal information together with restricted information, and scale the program to the covered entity's size and complexity, the nature and scope of its activities, the sensitivity of the information protected, the cost and availability of security tools, and the resources available to it.
• Make the program reasonably conform to the current version of the NIST Cybersecurity Framework, NIST Special Publication 800-171, NIST Special Publications 800-53 and 800-53A, the FedRAMP security assessment framework, the CIS Critical Security Controls, or the ISO/IEC 27000 family, alone or in combination, or, if already regulated under it, reasonably conform to the entirety of the HIPAA security rule, Gramm-Leach-Bliley Act Title V, the Federal Information Security Modernization Act, or HITECH, or comply with the PCI Data Security Standard together with one of the first group's frameworks.
• To keep the program's reasonable conformance current, adopt a revised version of a chosen framework in the first group, or of the PCI standard, no later than one year after the publication date stated in the revision, and an amended version of the HIPAA security rule, Gramm-Leach-Bliley Act Title V, the Federal Information Security Modernization Act or HITECH no later than one year after the effective date of the amended framework.
• A covered entity that does this earns an affirmative defense to a tort claim under Ohio law alleging that its failure to implement reasonable information security controls caused a data breach concerning the information its program covers; the chapter creates no cause of action of its own, and nothing in it may be read to create a private right of action, including a class action.

Ohio Rev. Code §§ 1349.13 and 1349.14, as proposed by S.B. 163, 136th General Assembly (2025-2026 Session) · Read the law's page

• What follows describes the bill as passed by the Ohio Senate.
• If you create, code, or otherwise produce a generative AI system publicly accessible to Ohio consumers for personal use, program it to place a distinctive watermark on any image or video it generates, informing the user the content is AI-generated, and to embed provenance data in content it creates.
• Do not knowingly and with intent to deceive a third party remove a required watermark, or knowingly distribute content fully generated by a generative AI system with false information about its authenticity.
• A business-to-business use of a generative AI system for an otherwise lawful purpose would fall outside this measure.

Ohio Rev. Code §§ 2907.321, 2907.322, 2907.323, and 2913.49, as proposed to be amended by S.B. 163, 136th General Assembly (2025-2026 Session) · Read the law's page

• What follows describes the bill as passed by the Ohio Senate.
• Do not create, reproduce, publish, sell, disseminate, or possess material showing a minor, a computer-generated or artificially generated depiction of a minor, or a depiction of a purported minor engaged in the prohibited conduct; this would reach material with no real child involved at all.
• Do not create or use a nonconsensual AI-generated replica of a real person's voice, image, or likeness to induce a financial decision or extend credit, or to damage that person's or an entity's reputation.
• Do not create, use, or disseminate a nonconsensual AI-generated replica of a real person, who is not a minor or impaired person, depicting them in a state of nudity, engaging in sexual activity, or in other obscene material.
• Providing or developing the underlying AI technology used to create a replica would not itself violate this measure unless the provider or developer is the one committing the violation.