critical infrastructure; foreign adversaries; prohibition, the official text

PREFILED    JAN 06 2026

REFERENCE TITLE: critical infrastructure; foreign adversaries; prohibition

State of Arizona

House of Representatives

Fifty-seventh Legislature

Second Regular Session

2026

HB 2134

Introduced by

Representative
Kupper

AN
ACT

amending title 18, chapter 1, article 1,
Arizona Revised Statutes, by adding section 18-105; amending title 44,
Arizona Revised Statutes, by adding chapter 42; relating to critical infrastructure.

(TEXT OF BILL BEGINS ON NEXT PAGE)

Be it enacted by the Legislature of the State of Arizona:

Section 1. Title 18, chapter 1, article 1, Arizona
Revised Statutes, is amended by adding section 18-105, to read:

START_STATUTE18-105. Software; critical infrastructure; critical communications
infrastructure; annual prohibited technologies list; definitions

A. Any software that is used for
critical infrastructure in this state may not be produced by a Chinese company.

B. On or before January 1 of each
year, if a critical communications infrastructure provider is a participant in
the secure and trusted communications networks reimbursement program pursuant
to 47 United States Code section 1601, the critical communications
infrastructure provider shall certify to the corporation commission any
instance of prohibited critical communications infrastructure equipment use,
along with the geographic coordinates of the areas served by the prohibited
equipment. If the critical communications infrastructure provider is
certified by the corporation commission, the critical communications
infrastructure provider shall submit a status report to the corporation
commission at the same time that any report is sent to the federal government
in compliance with the secure and trusted communications networks reimbursement
program pursuant to this subsection. Each quarter, the corporation
commission shall produce a map of this state that details the geographic areas
serviced by critical communications infrastructure and that includes areas
where equipment that is manufactured by a Chinese company is located.

C. Any critical
communications infrastructure provider that removes,
discontinues or replaces any equipment that is prohibited by this section is
not required to obtain an additional permit from any state agency or political
subdivision of this state for the removal, discontinuance or replacement of the
prohibited equipment.

D. A governmental entity or a critical infrastructure
service provider in this state may not enter into or renew a contract with a Chinese company if the contract provides the Chinese company with
direct or indirect access to the critical infrastructure.

E. On or
before March 31, 2027 and each year thereafter, each
governmental entity and critical infrastructure service provider in this state
shall certify to the corporation commission that the provider has not
attached to the critical infrastructure or connected to any operating system
that is used by the critical infrastructure service provider any additional
technology that is prohibited by the corporation commission and that was not in
use in this state before the effective date of this section.

F. On
or before December 31, 2026 and each year thereafter, the corporation
commission shall publish a list of all technologies that are prohibited pursuant
to this section from being attached to critical infrastructure or connected to
the operating system that is used by the critical infrastructure and shall post
the list on the corporation commission's website.  The
list must include, at a minimum, any wi-fi router and modem system, any
camera-based school bus infraction detection system, speed detection
system, traffic infraction detector system and other camera system, battery
technology or smart meter technology, solar inverters and any product that
contains cellular internet-of-things modules that are produced by a
Chinese company.

G. Except as
provided in subsection H of this section, if monies are
appropriated and distributed to facilitate the removal, each governmental
entity and critical infrastructure service provider in this state shall remove
any technology that the corporation commission includes on the prohibited
technologies list pursuant to subsection F of this
section.

H. A
governmental entity or critical infrastructure service provider in this state may
continue to purchase and use any prohibited technology pursuant to this section
if all of the following apply:

1. There are no other reasonable
providers of the prohibited technology.

2. The purchase or use of the
prohibited technology is preapproved by the corporation commission.

3. Not purchasing or using the
prohibited technology would pose a greater threat to this state than the threat
associated with the prohibited technology.

I. For the
purposes of this section:

1. "Chinese company":

(a) Means any
company, other than a United States person or United States subsidiary as
defined in 15 Code of Federal Regulations section 772.1, that is any of the following:

(i) Domiciled,
incorporated, issued or listed in the People's Republic of China.

(ii) Headquartered
in the People's Republic of China.

(iii) Has its
principal place of business in the People's Republic of China.

(iv) Controlled
by the government of the People's Republic of China, the Chinese Communist
Party or the Chinese military, or any instrumentality thereof, including the
State-owned Assets Supervision and Administration Commission of the State
Council or the National Social Security Fund.

(v) Majority-owned
by an entity controlled by the government of the People's Republic of China,
the Chinese Communist Party or the Chinese military, or any instrumentality
thereof, including the State-owned Assets Supervision and Administration
Commission of the State Council or the National Social Security Fund.

(b) Does not include a
parent, subsidiary or affiliate company of an entity prescribed in SUBDIVISION
(a) of this paragraph if the parent, subsidiary or
affiliate company does not meet the criteria listed in SUBDIVISION (a) of this paragraph and does not recognize more than fifty percent of
the parent's, subsidiary's or affiliate company's total annual global revenue
from China and Hong Kong combined.

2. "Critical
communications infrastructure" means all physical broadband
infrastructure and equipment that supports the transmission of information and
that allows the user to engage in communications, including service provided
directly to the public.

3. "Critical
infrastructure" means infrastructure that is owned or operated by this
state, a political subdivision of this state or a publicly regulated utility
and that is any of the following:

(a) A gas and
oil production, storage or delivery system.

(b) A water
supply refinement, storage or delivery system.

(c) An
electrical power delivery system.

(d) A
telecommunications network.

(e) A
transportation system and service.

(f) A personal
data storage system, including cybersecurity.

(g) An
emergency service.

4. "Domiciled" means
located in a country where either the company is registered, the company's
affairs are primarily completed or the majority of the company's ownership
shares are held.

5. "School bus infraction
detection system" means an automated system installed on a school bus that
consists of cameras, sensors and software designed to detect, record and
document traffic violations, INCLUDING illegally passing the bus when its stop
arm is extended and warning lights are activated, to enhance student safety and
enforce compliance with traffic laws.

Sec. 2. Title 44, Arizona Revised Statutes, is
amended by adding chapter 42, to read:

CHAPTER 42

CRITICAL
INFRASTRUCTURE

ARTICLE
1. PROHIBITED AGREEMENTS

START_STATUTE44-8051. Definition of critical infrastructure

In this chapter, unless the context otherwise
requires, "critical infrastructure" means
infrastructure that is owned or operated by this state, a political subdivision
of this state or a publicly regulated utility and that is any of the following:

1. A gas and oil production, storage
or delivery system.

2. A water supply refinement, storage
or delivery system.

3. An electrical power delivery
system.

4. A telecommunications network.

5. A transportation system and
service.

6. A personal data storage system,
including cybersecurity.

7. An emergency service.

START_STATUTE44-8052. Critical infrastructure; prohibited agreements and contracts;
exceptions; secure and dedicated communications channel

A. Except as provided in subsection B
of this section, a governmental entity or a publicly regulated utility in this
state may not enter into an agreement or contract involving critical
infrastructure in this state with the people's republic of China if under the
agreement or contract the people's republic of China, directly or remotely,
would be able to access or control critical infrastructure in this state.

B. A governmental entity or a
publicly regulated utility in this state may enter into an agreement or
contract involving critical infrastructure in this state with the people's
republic of China if any of the following applies:

1. No other reasonable option exists
for addressing a need that is relevant to critical infrastructure in this
state.

2. The agreement or contract is
preapproved by the corporation commission.

3. Not entering into the agreement or
contract would pose a greater threat to this state than the threat associated
with entering into the agreement or contract.

C. The corporation commission shall
establish a secure and dedicated communications channel for critical
infrastructure providers and military installations across this state to
connect with the corporation commission and the office of the governor in the
event of an emergency that damages critical communications infrastructure.  For
the purposes of this subsection, "critical communications
infrastructure" has the same meaning prescribed in section 18-105.

Sec. 3. Short title

This act may be cited as the
"Arizona Critical Infrastructure Protection Act".