AI Laws in Oregon (OR)

Oregon's regulatory posture on AI is silence rather than permission: oregon enacted sb 1571 (2024) requiring disclosure of ai-generated synthetic media in campaign communications (up to $10,000 per instance) and issued an ai task force report and ag guidance, but no comprehensive ai statute. Oregon Consumer Privacy Act (2024) with a profiling opt-out; UDAP coverage via ORS 646.608 provides the residual framework. Operators across sectors in Oregon watch federal signals first.

Oregon's non-legislation on AI means the Oregon Attorney General office has discretion to apply Oregon Consumer Privacy Act (2024) with a profiling opt-out to AI-driven consumer harms as they arise.

The federal and neighboring-state framework that governs your AI operations. Cross-Sector operators in Oregon operate under a federal-dominant framework anchored by FTC Section 5 (15 USC 45) and NIST AI RMF 1.0, with adjacent authorities Gramm-Leach-Bliley Act (GLBA) / NIST Cybersecurity Framework (15 U.S.C. § 6801-6809; NIST CSF 2.0); General Data Protection Regulation (GDPR) (for EU users) (EU Regulation 2016/679); Section 508 / ADA Title III (Digital Accessibility) (29 U.S.C. § 794(d); 42 U.S.C. § 12181). FTC Operation AI Comply (Sep 2024) targeted five companies across sectors. The practical risk they have to price in is cross-sector FTC Section 5 exposure and state UDAP liability, and the bellwether signal to monitor is NIST AI RMF 1.0 (Jan 2023) is cited as the federal baseline across 30+ agency guidance documents. No regional statute applies yet. Oregon enacted SB 1571 (2024) requiring disclosure of AI-generated synthetic media in campaign communications (up to $10,000 per instance) and issued an AI Task Force report and AG guidance, but no comprehensive AI statute. Use this as a starting point; sector pages on this site go deeper into industry-specific obligations.

Federal law still governs Cross-Sector AI in Oregon primarily through FTC Section 5 (15 USC 45) and NIST AI RMF 1.0. Adjacent federal authorities include Gramm-Leach-Bliley Act (GLBA) / NIST Cybersecurity Framework (15 U.S.C. § 6801-6809; NIST CSF 2.0); General Data Protection Regulation (GDPR) (for EU users) (EU Regulation 2016/679); Section 508 / ADA Title III (Digital Accessibility) (29 U.S.C. § 794(d); 42 U.S.C. § 12181). Gramm-Leach-Bliley Act (GLBA) / NIST Cybersecurity Framework (enforced by Federal Trade Commission; NIST) applies to saas platforms handling personal/financial data via ai must implement nist csf security standards: identify, protect, detect, respond, recover. Penalty exposure: ftc civil penalties up to $100,000/violation; private litigation for data breaches. FTC Operation AI Comply (Sep 2024) targeted five companies across sectors.

Oregon's immediate neighbors also lack AI-specific statutes, so operators defer primarily to federal frameworks until regional precedent emerges.

The enforcement surface for Cross-Sector centres on FTC, CFPB, State Attorneys General, and the statute operators most often under-document is General Data Protection Regulation (GDPR) (for EU users) (EU Regulation 2016/679) — a gap that surfaces in cross-sector FTC Section 5 exposure disputes. Build an evidence binder covering AI inventory, risk-tier register, incident-response runbook, and board-level AI risk report. Treat NIST AI RMF 1.0 (Jan 2023) is cited as the federal baseline across 30+ agency guidance documents as your leading indicator and escalate when the signal shifts.

With 11-50 employees you can justify a half-time compliance lead and part-time external counsel on retainer. Small-stage Cross-Sector operators should deploy a named compliance lead, formal AI inventory, quarterly bias spot-checks, and a documented escalation path, with semi-annual internal audit with annual external review and ownership resting with a designated AI compliance lead reporting to the CEO. small-business budgets ($50K-$250K) justify a compliance lead plus a GRC tool such as Credo AI, Fairly, or Holistic AI. For Cross-Sector specifically, the sharpest exposure to manage is cross-sector FTC Section 5 exposure and state UDAP liability. Given Oregon's concentration in technology and semiconductors, forestry, and healthcare, automated hiring tools and synthetic media in political advertising deserve priority in your AI inventory.

Verified 2026-07-04. See https://olis.oregonlegislature.gov/liz/2024R1/Measures/Overview/SB1571 for the Oregon Attorney General public record on Oregon AI policy.