State of Ohio Administrative Policy on AI

• Authority: Ohio
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2023-12-04

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Compromise of privacy
• AI system security vulnerabilities
• False or misleading information
• Overreliance and unsafe use
• Governance failure
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Disinformation, surveillance, and influence at scale
• Fraud, scams, and targeted manipulation
• Loss of human agency and autonomy
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8-10 subdomains, with strong focus on privacy compromise (2.1), AI system security vulnerabilities (2.2), false information (3.1), overreliance and unsafe use (5.1), governance failure (6.5), and AI system robustness (7.3). Coverage is concentrated in security, privacy, misinformation prevention, and AI safety domains, with particular emphasis on data governance and human oversight mechanisms.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This is an internal government policy that governs AI use within Ohio state government operations. The primary sector governed is Public Administration excluding National Security, as the policy applies to all state agencies, boards, and commissions under the Governor's authority. The policy does not regulate external private sector entities or other economic sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding administrative policy issued under statutory authority (ORC 125.18) that applies to all state agencies under the Governor's authority, with mandatory language throughout and enforcement through the AI Council's oversight and auditing functions.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Ohio Department of Administrative Services (DAS); State of Ohio
• Summary: The policy is issued by the Ohio Department of Administrative Services under statutory authority ORC 125.18, as indicated in the authority section and throughout the document where DAS is assigned responsibility for establishing governance structures.

Target

• Entity Types: AI_Deployer, AI_User
• Entities: All state agencies, boards, and commissions under the authority of the Governor; State employees, contractors, and temporary personnel
• Summary: The policy explicitly applies to all state agencies under the Governor's authority and regulates their use and deployment of AI solutions, as well as the workforce using AI tools.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: AI Council; Ohio Department of Administrative Services (DAS); Chief Data Officer (CDO) Council; Agency directors
• Summary: The AI Council is established to govern and oversee AI use, with DAS providing overall policy authority. The CDO Council establishes data governance requirements, and Agency directors approve AI use.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: AI Council; Chief Data Officer (CDO) Council; Data Steward, Data Owner, and Data Custodian roles
• Summary: The AI Council is responsible for auditing AI solutions and monitoring compliance. The CDO Council oversees data governance, and designated data roles maintain quality and integrity of AI data models.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all AI lifecycle stages from planning through ongoing monitoring. It provides detailed requirements for Plan and Design (use case identification, approval processes), Data Collection and Processing (data quality, validation, governance), Model Building (testing, training data requirements), Verification and Validation (testing protocols, bias detection), Deployment (pilot programs, procurement requirements), and Operation and Monitoring (ongoing output validation, incident handling).

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Generative AI

Technical Scope Summary

The document explicitly mentions AI Models, AI systems, and Generative AI extensively throughout. It does not mention frontier AI, general purpose AI, task-specific AI, foundation models, predictive AI, or specific compute thresholds. There is implicit coverage of open-weight/open-source considerations through procurement requirements for third-party services.