WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
(A)(1) "Compelling governmental interestCompelling governmental interest"Compelling governmental interest" means a governmental interest of the highest order that cannot be achieved without burdening the lawful use of computational resources, including all of the following: (a) Ensuring the continued and reliable operation of critical infrastructure facilities; (b) Addressing deceptive practices and fraud; (c) Protecting minors and vulnerable populations from harmful content generated by artificial intelligence systems, such as images or video or audio recordings that replicate the likeness of an individual, commonly known as "deepfakes," that are generated or published without the individual's consent; (d) Preventing and remediating public nuisances associated with physical data center infrastructure.R.C. § 9.89(A)(1)" means a governmental interest of the highest order that cannot be achieved without burdening the lawful use of computational resourcesComputational resource"Computational resource" means any system, software, network, device, or infrastructure capable of processing, storing, transmitting, manipulating, or disseminating data or information, including hardware, software, algorithms, cryptography, artificial intelligence systems, machine learning systems, quantum computing tools, and any similar technologies.R.C. § 9.89(A)(2), including all of the following: (a) Ensuring the continued and reliable operation of critical infrastructure facilities; (b) Addressing deceptive practices and fraud; (c) Protecting minors and vulnerable populations from harmful content generated by artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" means any system that utilizes machine learning or similar technologies to infer from inputs how to produce outputs that affect or influence physical or virtual environments, including content generation, decisions, recommendations, or predictions.R.C. § 9.89(A)(3), such as images or video or audio recordings that replicate the likeness of an individual, commonly known as "deepfakes," that are generated or published without the individual's consent; (d) Preventing and remediating public nuisances associated with physical data center infrastructure.
(A)(2) "Computational resourceComputational resource"Computational resource" means any system, software, network, device, or infrastructure capable of processing, storing, transmitting, manipulating, or disseminating data or information, including hardware, software, algorithms, cryptography, artificial intelligence systems, machine learning systems, quantum computing tools, and any similar technologies.R.C. § 9.89(A)(2)" means any system, software, network, device, or infrastructure capable of processing, storing, transmitting, manipulating, or disseminating data or information, including hardware, software, algorithms, cryptography, artificial intelligence systemsArtificial intelligence system"Artificial intelligence system" means any system that utilizes machine learning or similar technologies to infer from inputs how to produce outputs that affect or influence physical or virtual environments, including content generation, decisions, recommendations, or predictions.R.C. § 9.89(A)(3), machine learning systems, quantum computing tools, and any similar technologies.
(A)(3) "Artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any system that utilizes machine learning or similar technologies to infer from inputs how to produce outputs that affect or influence physical or virtual environments, including content generation, decisions, recommendations, or predictions.R.C. § 9.89(A)(3)" means any system that utilizes machine learning or similar technologies to infer from inputs how to produce outputs that affect or influence physical or virtual environments, including content generation, decisions, recommendations, or predictions.
(A)(4) "Critical infrastructure facilityCritical infrastructure facility"Critical infrastructure facility" has the same meaning as in section 2911.21 of the Revised Code.R.C. § 9.89(A)(4)" has the same meaning as in section 2911.21 of the Revised Code.
(A)(5) "State agencyState agency"State agency" means every organized body, office, or agency established by the laws of the state for the exercise of any function of state government. "State agency" does not include the general assembly.R.C. § 9.89(A)(5)" means every organized body, office, or agency established by the laws of the state for the exercise of any function of state government. "State agencyState agency"State agency" means every organized body, office, or agency established by the laws of the state for the exercise of any function of state government. "State agency" does not include the general assembly.R.C. § 9.89(A)(5)" does not include the general assembly.
(A)(6) "Political subdivisionPolitical subdivision"Political subdivision" means any body corporate and politic that is responsible for governmental activities only in a geographic area smaller than the state.R.C. § 9.89(A)(6)" means any body corporate and politic that is responsible for governmental activities only in a geographic area smaller than the state.
Subsection (A) establishes the bill's definitional foundation. Computational resource is defined extremely broadly to encompass any system, software, network, device, or infrastructure capable of processing data, expressly including AI systems, machine learning systems, cryptography, and quantum computing tools. Artificial intelligence system covers any system using machine learning or similar technologies to infer outputs from inputs. Compelling governmental interest is defined as a closed list of four enumerated interests — critical infrastructure reliability, fraud, protecting minors and vulnerable populations from deepfakes, and data center nuisances — setting the ceiling for permissible government regulation under subsection (B).
(B) 1 No political subdivisionPolitical subdivision"Political subdivision" means any body corporate and politic that is responsible for governmental activities only in a geographic area smaller than the state.R.C. § 9.89(A)(6) or state agencyState agency"State agency" means every organized body, office, or agency established by the laws of the state for the exercise of any function of state government. "State agency" does not include the general assembly.R.C. § 9.89(A)(5) shall enact, adopted, enforce, or maintain any law, rule, regulation, permit requirement, or other administrative practice that restricts or prohibits any person's lawful use, development, deployment, or possession of a computational resourceComputational resource"Computational resource" means any system, software, network, device, or infrastructure capable of processing, storing, transmitting, manipulating, or disseminating data or information, including hardware, software, algorithms, cryptography, artificial intelligence systems, machine learning systems, quantum computing tools, and any similar technologies.R.C. § 9.89(A)(2) unless the restriction is narrowly tailored to achieve a compelling governmental interestCompelling governmental interest"Compelling governmental interest" means a governmental interest of the highest order that cannot be achieved without burdening the lawful use of computational resources, including all of the following: (a) Ensuring the continued and reliable operation of critical infrastructure facilities; (b) Addressing deceptive practices and fraud; (c) Protecting minors and vulnerable populations from harmful content generated by artificial intelligence systems, such as images or video or audio recordings that replicate the likeness of an individual, commonly known as "deepfakes," that are generated or published without the individual's consent; (d) Preventing and remediating public nuisances associated with physical data center infrastructure.R.C. § 9.89(A)(1).
Subsection (B) is the core preemption provision. It bars Ohio political subdivisions and state agencies from enacting, adopting, enforcing, or maintaining any law, rule, regulation, permit requirement, or other administrative practice that restricts or prohibits any person's lawful use, development, deployment, or possession of a computational resource — unless the restriction is narrowly tailored to achieve a compelling governmental interest as enumerated in subsection (A)(1). This effectively subjects all sub-state AI regulation to a strict scrutiny standard, with an exhaustive list of qualifying interests.
Note that the General Assembly is expressly excluded from the definition of state agency, meaning the legislature itself is not bound by this restriction — only executive-branch agencies and local governments are constrained.
(C)(1) 2 Any person or other entity that implements or operates an artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any system that utilizes machine learning or similar technologies to infer from inputs how to produce outputs that affect or influence physical or virtual environments, including content generation, decisions, recommendations, or predictions.R.C. § 9.89(A)(3) that in whole or in part controls a critical infrastructure facilityCritical infrastructure facility"Critical infrastructure facility" has the same meaning as in section 2911.21 of the Revised Code.R.C. § 9.89(A)(4) shall, before or within a reasonable period after the deployment of the system, implement a risk management policy that conforms to all of the following: (a) The latest version of the artificial intelligence risk management framework developed by the national institute of standards and technology under the United States department of commerce; (b) The international organization for standardization and international electrotechnical commission 4200 standard or any other nationally or internationally recognized artificial intelligence risk management standard or framework not referred to in this section; (c) All applicable federal regulations.
(C)(2) 2 The requirement to implement a risk management policy under division (C)(1) of this section does not apply if the artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any system that utilizes machine learning or similar technologies to infer from inputs how to produce outputs that affect or influence physical or virtual environments, including content generation, decisions, recommendations, or predictions.R.C. § 9.89(A)(3) is capable of completing only nonexecutive tasks of a procedural or preparatory nature or implementing only those decisions previously made by a human decision maker, or if the artificial intelligence systemArtificial intelligence system"Artificial intelligence system" means any system that utilizes machine learning or similar technologies to infer from inputs how to produce outputs that affect or influence physical or virtual environments, including content generation, decisions, recommendations, or predictions.R.C. § 9.89(A)(3) is exclusively an antivirus, antimalware, or cybersecurity tool.
Subsection (C) imposes the bill's only affirmative private-party obligation: any person or entity operating an AI system that in whole or in part controls a critical infrastructure facility must implement a risk management policy before or within a reasonable period after deployment. The policy must conform to three standards simultaneously — the NIST AI Risk Management Framework, the ISO/IEC 42001 standard (or another recognized AI risk management standard), and all applicable federal regulations.
Subsection (C)(2) provides a significant carve-out: the risk management requirement does not apply if the AI system performs only nonexecutive tasks of a procedural or preparatory nature, implements only decisions previously made by a human, or is exclusively an antivirus, antimalware, or cybersecurity tool. The bill does not specify who enforces this requirement or what happens upon noncompliance.
(D) This section shall not be construed to abridge, alter, diminish, or conflict with any legal rights and remedies related to intellectual property, including patent, trademark, copyright, and trade secret protections.
Subsection (D) is a savings clause preserving all existing intellectual property rights and remedies — patent, trademark, copyright, and trade secret — from being abridged, altered, diminished, or conflicted by this section. This creates no new compliance obligation.