Read the full stored bill text
HB2134 - 572R - H Ver
House Engrossed
critical
infrastructure; foreign adversaries; prohibition
State of Arizona
House of Representatives
Fifty-seventh Legislature
Second Regular Session
2026
HOUSE BILL 2134
AN
ACT
amending title 18, chapter 1, article 1,
Arizona Revised Statutes, by adding section 18-105; amending title 44,
Arizona Revised Statutes, by adding chapter 42; relating to critical
infrastructure.
(TEXT OF BILL BEGINS ON NEXT PAGE)
Be
it enacted by the Legislature of the State of Arizona:
Section 1. Title 18, chapter 1, article 1,
Arizona Revised Statutes, is amended by adding section 18-105, to read:
START_STATUTE
18-105.
Software; critical infrastructure; critical communications
infrastructure; annual prohibited equipment list; definitions
A. Any software that is used for
critical infrastructure in this state may not be produced by a Chinese company.
B. On or before January 1 of each
year, if a critical communications infrastructure provider is a participant in
the secure and trusted communications networks reimbursement program pursuant
to 47 United States Code section 1601, the critical communications
infrastructure provider shall certify to the corporation commission any
instance of prohibited critical communications infrastructure equipment use,
along with the geographic coordinates of the areas served by the prohibited
equipment. If the critical communications infrastructure provider is
certified by the corporation commission, the critical communications
infrastructure provider shall submit a status report to the corporation
commission at the same time that any report is sent to the federal government
in compliance with the secure and trusted communications networks reimbursement
program pursuant to this subsection.
C. Any critical
communications infrastructure
provider that removes,
discontinues or replaces any equipment that is prohibited by this section is
not required to obtain an additional permit from any state agency or political
subdivision of this state for the removal, discontinuance or replacement of the
prohibited equipment.
D. A governmental entity or a critical infrastructure
service provider in this state may not enter into or renew a contract with a
Chinese company if the contract provides the Chinese company with
direct or indirect access to the critical infrastructure.
E.
On or
before March 31, 2027 and each year thereafter,
each
governmental entity and critical infrastructure service provider in this state
shall certify to the corporation commission that the provider
has not
attached to the critical infrastructure or connected to any operating system
that is used by the critical infrastructure service provider any additional
equipment that is prohibited by the corporation commission and that was not in
use in this state before the effective date of this section.
F. On or before December 31, 2026 and
each year thereafter, the corporation commission shall publish a list of all
equipment that is prohibited pursuant to this section from being attached to
critical infrastructure or connected to the operating system that is used by
the critical infrastructure and shall post the list on the corporation
commission's website.
The list must include,
at a minimum, any wi-fi router and modem system, any camera-based
school bus infraction detection system, speed detection system, traffic
infraction detector system and other camera system, battery technology or smart
meter technology, solar inverters and any product that contains cellular
internet-of-things modules that are produced by a Chinese company.
G.
Except as
provided in subsection H
of this section, if monies are
appropriated and distributed to facilitate the removal, each governmental
entity and critical infrastructure service provider in this state shall remove
any equipment that the corporation commission includes on the prohibited
equipment list pursuant to subsection F
of this section.
H.
A
governmental entity or critical infrastructure service provider in this state
may continue to purchase and use any prohibited equipment pursuant to this
section if all of the following apply:
1. There are no other reasonable
providers of the prohibited equipment.
2. The purchase or use of the
prohibited equipment is preapproved by the corporation commission.
3. Not purchasing or using the
prohibited equipment would pose a greater threat to this state than the threat
associated with the prohibited equipment.
I. This section does not require the
corporation commission to inspect all critical INFRASTRUCTURE and equipment or
conduct continuous monitoring or universal physical inspections of critical
infrastructure and equipment in this state to comply with this section. �The
corporation commission shall implement a risk-based oversight program
that includes all of the following:
1. A requirement that each
governmental entity and critical infrastructure service provider HAS COMPLETED
THE self-certification THAT is required by subsection E of this section
in the form of a sworn statement under penalty of perjury.
2. A requirement for a randomized
audit that is conducted on a statistically significant sample of critical
infrastructure service providers and critical communications infrastructure
providers each year.
3. A targeted audit if the
CORPORATION commission receives credible intelligence, a complaint, a federal
advisory or an identified risk factor.
4. A provision that allows the
corporation commission to rely on determinations, advisories or prohibitions
that are issued by a federal agency that has jurisdiction over national
security or communications equipment and cybersecurity in this country.
5. A PROVISION for safe harbor
protections for critical infrastructure service providers and critical
communications infrastructure providers that reasonably rely on manufacturer
certifications and supply-chain disclosures if there is not evidence of
wilful misrepresentation.
J. For
the purposes of this section:
1. "Chinese
company":
(
a
) Means any
company, other than a United States person or United States subsidiary as
defined in 15 Code of Federal Regulations section 772.1, that is any of the
following:
(
i
) Domiciled,
incorporated, issued or listed in the People's Republic of China.
(
ii
) Headquartered
in the People's Republic of China.
(
iii
) Has its
principal place of business in the People's Republic of China.
(
iv
) Controlled
by the government of the People's Republic of China, the Chinese Communist
Party or the Chinese military, or any instrumentality thereof, including the
State-owned Assets Supervision and Administration Commission of the State Council
or the National Social Security Fund.
(
v
) Majority-owned
by an entity controlled by the government of the People's Republic of China,
the Chinese Communist Party or the Chinese military, or any instrumentality
thereof, including the State-owned Assets Supervision and Administration
Commission of the State Council or the National Social Security Fund.
(
b
) Does not include a
parent, subsidiary or affiliate company of an entity prescribed in SUBDIVISION
(
a
) of this paragraph if the parent, subsidiary or
affiliate company does not meet the criteria listed in SUBDIVISION (
a
) of this paragraph and does not recognize more than fifty percent of
the parent's, subsidiary's or affiliate company's total annual global revenue
from China and Hong Kong combined.
2. "
Critical
communications infrastructure
" means all physical broadband
infrastructure and equipment that supports the transmission of information and
that allows the user to engage in communications, including service provided
directly to the public.
3. "Critical
infrastructure" means infrastructure that is owned or operated by this
state, a political subdivision of this state or a publicly regulated utility
and that is any of the following:
(
a
) A gas and
oil production, storage or delivery system.
(
b
) A water
supply refinement, storage or delivery system.
(
c
) An
electrical power delivery system.
(
d
) A
telecommunications network.
(
e
) A
transportation system and service
, not including
PASSENGER vehicles
.
(
f
) A personal
data storage system, including cybersecurity.
(
g
) An
emergency service.
4. "Domiciled" means
located in a country where either the company is registered, the company's
affairs are primarily completed or the majority of the company's ownership
shares are held.
5. "School bus infraction
detection system" means an automated system installed on a school bus that
consists of cameras, sensors and software designed to detect, record and
document traffic violations, INCLUDING illegally passing the bus when its stop
arm is extended and warning lights are activated, to enhance student safety and
enforce compliance with traffic laws.
END_STATUTE
Sec. 2. Title 44, Arizona Revised Statutes, is
amended by adding chapter 42, to read:
CHAPTER 42
CRITICAL
INFRASTRUCTURE
ARTICLE
1. PROHIBITED AGREEMENTS
START_STATUTE
44-8051.
Definition of critical infrastructure
In this chapter, unless the context otherwise
requires,
"critical infrastructure" means
infrastructure that is owned or operated by this state, a political subdivision
of this state or a publicly regulated utility and that is any of the following:
1. A gas and oil production, storage
or delivery system.
2. A water supply refinement, storage
or delivery system.
3. An electrical power delivery
system.
4. A telecommunications network.
5. A transportation system and
service, not including PASSENGER vehicles.
6. A personal data storage system,
including cybersecurity.
7. An emergency service.
END_STATUTE
START_STATUTE
44-8052.
Critical infrastructure; prohibited agreements and contracts;
exceptions; secure and dedicated communications channel
A. Except as provided in subsection B
of this section, a governmental entity or a publicly regulated utility in this
state may not enter into an agreement or contract involving critical
infrastructure in this state with the people's republic of China if under the
agreement or contract the people's republic of China, directly or remotely,
would be able to access or control critical infrastructure in this state.
B. A governmental entity or a
publicly regulated utility in this state may enter into an agreement or
contract involving critical infrastructure in this state with the people's
republic of China if any of the following applies:
1. No other reasonable option exists
for addressing a need that is relevant to critical infrastructure in this
state.
2. The agreement or contract is
approved by the corporation commission.
3. Not entering into the agreement or
contract would pose a greater threat to this state than the threat associated
with entering into the agreement or contract.
C. The department of emergency and
military affairs shall establish a secure and dedicated communications channel
for critical infrastructure providers and military installations across this
state to connect with the department of emergency and military affairs and the
office of the governor in the event of an emergency that damages critical
communications infrastructure. For the purposes of this subsection,
"critical communications infrastructure" has the same meaning
prescribed in section 18-105.
END_STATUTE
Sec. 3.
Short title
This act may be cited as the
"Arizona Critical Infrastructure Protection Act".