MT SB212: Creating the Right to Compute Act and requiring a risk management policy for critical infrastructure facilities controlled by an artificial intellige…

In one paragraph

Montana's SB 212 (Chapter 150, 2025), the Right to Compute Act, requires government actions that restrict the private ownership or use of computational resources for lawful purposes to be limited to those demonstrably necessary and narrowly tailored to fulfill a compelling government interest. When critical infrastructure facilities are controlled in whole or in part by a critical AI system, the deployer must develop a reasonable risk management policy that considers the NIST AI Risk Management Framework, an ISO/IEC AI standard or another recognized framework. The act requires no shutdown capability. Signed and effective April 16, 2025.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

Companies deploying critical AI systems that control Montana critical infrastructure facilities must adopt a reasonable AI risk management policy (NIST, ISO/IEC or similar; a federally required plan counts). The act sets no penalty and requires no shutdown capability.

Key provisions

1. 1Sections 1-7, the Right to Compute Act, are codified as a new part of Title 2, chapter 10, MCA
2. 2Government actions (any state or local law, ordinance, regulation, rule, policy, condition, test, permit or administrative practice) that restrict the ability to privately own or use computational resources for lawful purposes must be limited to those demonstrably necessary and narrowly tailored to fulfill a compelling government interest
3. 3Compelling government interests include ensuring AI-controlled critical infrastructure facilities develop a risk management policy, addressing conduct that deceives or defrauds the public, protecting individuals, especially minors, from harm by a person who distributes deepfakes and other harmful synthetic content with actual knowledge of the nature of that material, and preventing or abating common law nuisances created by physical datacenter infrastructure
4. 4When critical infrastructure facilities are controlled in whole or in part by a critical AI system, the deployer must, after deploying it, develop a reasonable risk management policy that considers the latest NIST AI Risk Management Framework, the "ISO/IEC 4200" AI standard (as the act cites it) or another nationally or internationally recognized AI risk management framework; a plan prepared under federal requirements complies
5. 5Critical AI: an AI system designed and deployed to make, or that is a substantial factor in making, a consequential decision; exclusions include systems for narrow procedural or preparatory tasks, common software such as cybersecurity, anti-fraud, spam filtering and search engines, and natural-language tools subject to an acceptable use policy that prohibits generating unlawful content
6. 6Critical infrastructure facility has the meaning in MCA 82-1-601; the act does not alter intellectual property rights or preempt federal law
7. 7Signed by the Governor April 16, 2025 (Chapter 150); effective on passage and approval, April 16, 2025

Latest legislative action

Apr 16, 2025. Signed by Governor (Chapter 150)

Sponsors

Roll call votes (showing 3 of 6)