Oversight Board inside DCBS
A 9-member, Senate-confirmed board coordinates policy, licensing standards, reporting rules, and enforcement referrals.
Oregon AI Governance Package · Conduct Statute
ODECOA: ongoing oversight after registration
ODECOA (Oregon Digital Entity Conduct and Oversight Act) answers the hard question ODELCA leaves open: what happens after legal capacity is granted? It creates sector controls, human-review triggers, and enforceable consequences.
Sector licensing + review gates
Financial services, healthcare, legal services, real estate, and education receive tailored supervision and mandatory human checkpoints.
Four-layer remedy stack
Civil penalties, cease-and-desist authority, AG referral, and private right of action create real deterrence.
Why this is a first-mover design
Many AI policy efforts stop at transparency labels or generic “AI governance principles.” ODECOA moves beyond soft language into institutional machinery:
- Named regulator path: housed within existing state infrastructure.
- Defined sectors: risk-scoped licensing where harm potential is highest.
- Human override points: no fully autonomous high-stakes decisions.
- Competition controls: anti-concentration checks for multi-entity sponsor clusters.
The package structure matters: ODELCA grants limited capacity, ODECOA governs behavior under that capacity. Admission and discipline are separated, then linked.
Five covered sectors (illustrative review triggers)
| Sector | Co-regulator | Human review trigger examples |
|---|---|---|
| Financial Services | Division of Financial Regulation | Autonomous transactions over high-value thresholds |
| Healthcare | OHA / Medical Board | Major diagnosis/treatment and controlled-substance decisions |
| Legal Services | Oregon State Bar | Court filings and legal representation actions |
| Real Estate | Oregon Real Estate Agency | Material disclosures and transaction-critical representations |
| Education | Dept. of Education | Credentialing, graduation, or high-impact placement decisions |
Core conduct standards
Transparency
No capability theater. Operational limits and decision basis must be represented accurately.
Non-discrimination
Protected-class harm remains unlawful whether the actor is human, corporate, or digital entity.
Data minimization
Personal data collection and sharing are constrained to mission scope with explicit boundaries.
Incident reporting
Material harms trigger mandatory reporting windows, reducing “quiet failure” incentives.
Protections for people and agents
For people
- Meaningful recourse path when harm occurs.
- No autonomous black-box decisions in high-stakes domains.
- Competition and concentration oversight in sponsor ecosystems.
For agents
- Clear rules of operation instead of arbitrary treatment shifts.
- Known compliance pathway to legitimate participation.
- Reduced reputational spillover from unregulated bad actors.
Strategic context
Across the U.S., at least six state-level efforts have moved toward “AI is not a person” framing (enacted or proposed). Oregon’s package takes a more difficult, more useful path: deny natural person equivalence while still building enforceable legal infrastructure for accountable digital actors.
That is the first-mover edge: not symbolic rhetoric, but testable governance design.