AI and Oregon Businesses: Understanding the Legal Landscape

Introduction in the AI Regulation in Oregon

As we all know, the regulation of artificial intelligence (AI) is still very much a work in progress. That means the guidance we’re seeing today is far from set in stone. This article will likely need to be updated, especially in light of new laws that may emerge from the 2025 Oregon legislative session, along with potential changes at the federal level.

So if you’re an Oregon business that’s just beginning to explore AI or already deep into incorporating it into your plans, consider this guidance a starting point. I sincerely hope it proves useful as you navigate this evolving terrain.

In December 2024, Oregon Attorney General Ellen Rosenblum issued comprehensive guidance on how existing state laws apply to businesses using artificial intelligence (AI) technologies. While Oregon has not enacted specific AI legislation, the guidance emphasizes that several current laws have significant implications for AI implementation and use.

The document begins by acknowledging the transformative potential of AI for Oregon’s economy. It highlights how AI can streamline repetitive tasks, deliver personalized services, and make data-driven decisions across various sectors. For instance, healthcare systems might use AI for diagnostic recommendations, while small businesses could leverage it for resume screening. This positive outlook underscores the state’s recognition of AI’s capacity to enhance efficiency and innovation in Oregon businesses.

However, the guidance also addresses the inherent risks associated with AI adoption. It points out concerns related to consumer privacy, the potential for discrimination, and issues of accountability. The document notes that AI systems often rely on vast amounts of personal data, raising concerns about data breaches and unauthorized use of consumer information. Additionally, it highlights the challenge of AI transparency, noting that even companies developing AI tools may struggle to explain how their systems arrive at specific decisions, potentially leaving consumers without clear recourse for challenging unfair or erroneous outcomes.

The Oregon Attorney General’s guidance on AI highlights several existing laws that apply to the development and use of artificial intelligence in the state. These laws provide a regulatory framework for AI without the need for specific AI legislation.

The key laws mentioned in the document are:

Unlawful Trade Practices Act (UTPA)

The UTPA is a comprehensive consumer protection law that prohibits deceptive and unfair business practices in Oregon. In the context of AI, the UTPA applies in the following ways:

• It prohibits misrepresentations in consumer transactions, including those involving AI products or services.
• Companies developing, selling, or deploying AI technology must ensure their tools provide accurate information to consumers.
• Misrepresentations may be actionable even when not made directly to the consumer, potentially creating liability for AI developers or deployers to downstream consumers.

Examples of potential UTPA violations related to AI include:

• Failing to disclose known material defects in AI products
• Misrepresenting AI system capabilities or falsely presenting AI as human
• Using AI to generate fake product reviews or celebrity endorsements
• Employing AI for deceptive pricing schemes, such as false “limited time” offers
• Using AI to set unconscionably excessive prices during emergencies
• Deploying AI-generated voices in misleading robocalls

Oregon Consumer Privacy Act (OCPA)

The OCPA is designed to protect consumers’ personal data and applies to AI systems in several ways:

• It requires clear disclosure of personal data use in AI training.
• Explicit consent is necessary for using sensitive personal data in AI models.
• Consumers must be allowed to opt out of AI-driven profiling for significant decisions (e.g., housing, education, lending).
• Data Protection Assessments are required for high-risk AI activities.
• The Act prohibits retroactive changes to privacy notices to legitimize data use in AI.

Oregon Consumer Information Protection Act (OCIPA)

This Act adds another layer of requirements for AI developers and users who handle personal information:

• It mandates appropriate safeguards for personal data used in AI systems.
• Companies must notify consumers and the Attorney General in the event of security breaches.
• Violations of OCIPA are enforceable under the UTPA.

Oregon Equality Act

The Equality Act addresses potential discrimination in AI applications:

• It warns against AI systems producing biased outcomes based on protected characteristics such as race, colour, religion, sex, sexual orientation, gender identity, national origin, marital status, age, or disability.

• This is particularly relevant for automated decision-making systems in housing, lending, and other crucial sectors where historical biases in training data could lead to discriminatory outcomes.

Conclusion

In conclusion, while Oregon does not have specific AI legislation, the Attorney General’s guidance emphasizes that existing laws provide a comprehensive framework for regulating AI technologies. The document highlights three key laws that apply to AI activities:

1. The Unlawful Trade Practices Act (UTPA), which prohibits deceptive practices in AI applications
2. The Oregon Consumer Privacy Act (OCPA), which governs the use of personal data in AI systems
3. The Oregon Equality Act, which addresses potential discrimination in AI-driven decisions

Businesses implementing AI solutions should be aware that these laws fully apply to their AI activities. The guidance serves as a crucial reminder that AI is not unregulated in Oregon, and companies must ensure their AI practices comply with consumer protection, data privacy, and anti-discrimination standards. By understanding and adhering to these existing legal frameworks, businesses can responsibly develop and deploy AI technologies while protecting consumer rights and maintaining ethical standards.

Source: https://www.doj.state.or.us/media-home/news-media-releases/ag-rosenblum-issues-guidance-on-ai-for-oregon-businesses/