Responsible Artificial Intelligence Usage statewide policy for executive department agencies (policy 107-004-190)

The Responsible Artificial Intelligence Usage policy, number 107-004-190, is a statewide policy issued by Enterprise Information Services (State CIO) with an effective date of June 16, 2026. The policy applies to state agencies as defined in ORS 174.112, which includes any board, commission, department, office or other entity within the Oregon executive department, and excludes the Secretary of State and the State Treasurer.

The policy applies to generative and agentic AI systems used to conduct the business of the state, including both standalone systems and components embedded in other software. Systems that are explicitly architected and use only data analytics, statistical modeling or machine learning fall outside the policy.

Any use of AI meeting the applicability standards must comply with the AI Risk Management Framework that Enterprise Information Services establishes to give state agencies detailed standards, requirements and guidance for using generative or agentic AI. The framework is to align with the National Institute of Standards and Technology (NIST) AI Risk Management Framework and to define the use cases considered higher-risk.

Enterprise Information Services specifies standards for generative AI model and system card disclosure, use of data for model training, user disclosure, user feedback, human in the loop documentation, baseline testing and monitoring, and additional requirements for higher-risk uses. Each agency is to create and keep updated an AI Adoption Plan for its agency.

The State CIO or the State CIO's designee oversees the creation and maintenance of a statewide registry of all AI-using applications in use or development by state agencies, including details on their uses. Agencies are accountable for AI usage by employees for work-related purposes, and work usage by state employees of unapproved AI systems is prohibited.

All AI development, training and hosting is limited to approved, secure environments, including Enterprise Information Services Data Center Services facilities or other platforms with approved certifications. An agency developing a custom AI-powered software system, including in Azure Foundry and Copilot Studio, must do so in a sandbox or development environment approved by Enterprise Information Services.

A customer of Data Center Services is prohibited from installing, deploying or operating AI models within Enterprise Information Services Data Center Services facilities without prior written approval from Enterprise Information Services. Enterprise Information Services publishes an annual report on AI use in state government based on the State AI Registry.

Enterprise Information Services also maintains a publicly accessible website that gives access to those annual reports and to Oregon AI transparency disclosure information for all higher-risk systems. The policy states that disclosure of AI usage and an opportunity to provide user feedback on AI-generated results are required. Enterprise Information Services is established in the Oregon Department of Administrative Services and managed by the State Chief Information Officer.

The State Chief Information Officer adopts rules, policies and standards for budgeting, planning, acquiring, installing, operating and overseeing telecommunications and information technology for the executive department, under ORS 276A.203 (4)(a)(C). State agencies shall cooperate with the State Chief Information Officer in preparing and complying with rules, policies and standards that the State Chief Information Officer adopts, under ORS 276A.206 (2)(a).

The State Chief Information Officer assesses state agencies each biennium to evaluate compliance with the State Chief Information Officer's rules, policies and standards, under ORS 276A.203 (4)(a)(G).