Arizona would bar Chinese-made software and certain equipment from critical infrastructure

Software used for critical infrastructure could not be produced by a Chinese company, and governments and utilities could not sign or renew contracts that give a Chinese company access. Critical infrastructure means systems owned or run by the state, a local government, or a regulated utility, such as oil and gas, water, electric power, telecommunications, transportation, personal data storage, and emergency services. A Chinese company is a non-U.S. company based in, run from, or controlled or majority-owned by entities tied to the People's Republic of China. Governments and regulated utilities also could not make agreements with the People's Republic of China itself that let it access or control critical infrastructure. Such agreements are allowed if there is no other reasonable option, the Corporation Commission approves, or refusing would pose a greater threat to the state.

The Corporation Commission would publish a yearly list of equipment that cannot be attached to critical infrastructure, and governments and providers would have to remove listed equipment. The list must include, at a minimum, Wi-Fi routers and modems, camera systems such as school bus, speed, and traffic infraction detectors, battery and smart meter technology, solar inverters, and products with cellular internet-of-things modules made by a Chinese company. Removal is required only if money is appropriated and distributed to help pay for it. A government or provider may keep buying and using listed equipment if there is no other reasonable provider, the commission preapproves it, and not using it would pose a greater threat than using it. The first list is due on or before December 31, 2026, and each year after that.

Providers and governments would have to certify each year to the Corporation Commission about prohibited equipment, and the commission would run a risk-based oversight program. This applies to governmental entities, critical infrastructure service providers, and critical communications providers that take part in the federal secure and trusted communications networks reimbursement program. Participating communications providers must certify any use of prohibited equipment and the areas it serves, and send the commission the same status reports they send the federal government. Self-certifications must be sworn statements under penalty of perjury, backed by random audits and targeted audits after credible complaints or intelligence. Providers get safe harbor protection if they reasonably rely on manufacturer certifications and there is no willful misrepresentation. A provider that removes or replaces prohibited equipment does not need an additional state or local permit. Communications providers certify by January 1 each year. Governments and service providers certify by March 31, 2027, and each year after that.

The Department of Emergency and Military Affairs would set up a secure, dedicated communications channel for emergencies. The channel would connect critical infrastructure providers and military installations to the department and the Governor's office when an emergency damages critical communications infrastructure.