Oregon AI Legislation in 2026

The Oregon Picture

My read of Oregon is that it is, by design, not a comprehensive-AI-statute state. There is no Oregon analog to Colorado's risk-based AI Act, and Oregon has not adopted an omnibus framework governing high-risk automated decision systems. Instead, the operative posture is that existing law already reaches AI. The December 2024 Attorney General guidance is the clearest articulation of this philosophy: the Unlawful Trade Practices Act and the Oregon Consumer Privacy Act apply to AI conduct without any AI-specific carve-out, and the complexity of a model is not a defense. For any business deploying AI in Oregon, that guidance is the single most important document to internalize, because it tells you how the state's chief enforcer intends to read your conduct under laws that already carry penalties and consumer rights.

Where Oregon has legislated specifically, it has done so narrowly and around concrete harms rather than abstract risk categories. SB 1571 in 2024 targets election integrity through synthetic-media disclosure backed by a civil penalty, notably without criminal exposure. HB 2299 in 2025 addresses AI-generated intimate imagery through the criminal code and a victim civil remedy. SB 1546 in 2026 addresses companion chatbots and youth safety, and it is the most consequential of the three for commercial AI developers because it pairs concrete operational duties with a private right of action and per-violation statutory damages. That private enforcement mechanism is what makes SB 1546 materially different from disclosure-only regimes, and it is the provision I would flag first to any product or legal team.

Parallel to the legislative track sits a governance track aimed at the state's own house. Executive Order 23-26 created the AI Advisory Council, which produced a finalized AI Action Plan structured around governance, privacy and security, and workforce. HB 4153 in 2024 added a definitional task force to standardize AI terminology for future bills. Neither imposes obligations on private companies, but both signal where Oregon is heading and how it will frame future legislation, so I treat them as leading indicators rather than compliance requirements.

For builders and businesses, my practical guidance is fourfold. First, treat the Attorney General guidance as enforceable interpretation: do not misrepresent AI capabilities, do not pass AI off as human, and audit AI-driven pricing, reviews, and marketing for trade-practices exposure. Second, fix your data-for-training consent posture now under the Consumer Privacy Act, including affirmative opt-in for sensitive data and a working withdrawal mechanism, and do not rely on retroactive policy edits. Third, if you run campaign-adjacent communications, build synthetic-media disclosures into your workflow under SB 1571. Fourth, and most urgently for consumer AI products, begin SB 1546 implementation ahead of the January 1, 2027 effective date, because the private right of action means plaintiffs, not just regulators, can enforce it.