Law / United States / 
Montana
Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management duty
In force since .
An AI risk obligations rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- If a deployer of a critical artificial intelligence system controls, in whole or in part, a critical infrastructure facility, develop a risk management policy after deploying the system
- The policy must be reasonable and consider a nationally or internationally recognized AI risk management framework, such as the National Institute of Standards and Technology (NIST) AI risk management framework
- A risk management plan already prepared to satisfy a federal requirement counts as compliance
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.4The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Logging duty
Section 2-10-205 requires a deployer whose critical artificial intelligence system controls a critical infrastructure facility to develop, after deploying the system, a risk management policy that considers a recognized artificial intelligence risk management framework. The section never uses the words logs, records, or audit trail, but a policy that must be developed and shown to consider a named framework cannot be demonstrated without documenting it. The section states no period the policy must be kept for and names nobody who may demand to see it; a plan already prepared to meet a federal requirement satisfies the duty on the same terms.
- Kind
- Implicit
- As of
- Provision
- Mont. Code Ann. 2-10-205
- Trigger
- high_risk_systems
What this law does
The Right to Compute Act declares that the rights to acquire, possess, and protect property and the freedom of expression under the Montana Constitution embody a fundamental right to own and make use of computational resources, including artificial intelligence systems, and that a government action restricting that use must be limited to what is demonstrably necessary and narrowly tailored to a compelling government interest.
The Act's one affirmative duty on a private actor falls on a deployer, an individual, company, or other organization that utilizes an artificial intelligence system. That duty applies when the deployer's system is a critical artificial intelligence system, one designed and deployed to make or be a substantial factor in making a consequential decision, and that system controls a critical infrastructure facility in whole or in part.
That deployer must develop, after deploying the system, a risk management policy that considers the National Institute of Standards and Technology's AI risk management framework, the ISO/IEC 4200 artificial intelligence standard, or another nationally or internationally recognized framework, and a plan already prepared to meet a federal requirement satisfies this duty. The Act preserves existing intellectual property remedies. It states that nothing in it preempts federal law.
It took effect on passage and approval under its own effective-date clause; the Governor approved the Act on , the day it also took effect.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or runs an essential service.
Back to the example · Lint your app
Page updated .