89R21355 BCH-F
By: Capriglione H.B. No. 149
Substitute the following for H.B. No. 149:
By: Bhojani C.S.H.B. No. 149
A BILL TO BE ENTITLED
AN ACT
relating to regulation of the use of artificial intelligence
systems in this state; providing civil penalties.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. This Act may be cited as the Texas Responsible
Artificial Intelligence Governance Act.
SECTION 2. Section 503.001, Business & Commerce Code, is
amended by amending Subsections (a) and (e) and adding Subsections
(b-1) and (f) to read as follows:
(a) In this section:
(1) "Artificial intelligence system" has the meaning
assigned by Section 551.001.
(2) "Biometric [, "biometric] identifier" means a
retina or iris scan, fingerprint, voiceprint, or record of hand or
face geometry.
(b-1) For purposes of Subsection (b), an individual has not
been informed of and has not provided consent for the capture or
storage of a biometric identifier of an individual for a commercial
purpose based solely on the existence of an image or other media
containing one or more biometric identifiers of the individual on
the Internet or other publicly available source.
(e) This section does not apply to:
(1) voiceprint data retained by a financial
institution or an affiliate of a financial institution, as those
terms are defined by 15 U.S.C. Section 6809; or
(2) the training, processing, or storage of biometric
identifiers involved in artificial intelligence systems, unless
the training, processing, or storage is performed for the purpose
of uniquely identifying a specific individual.
(f) If a biometric identifier captured for the purpose of
training an artificial intelligence system is subsequently used for
a commercial purpose, the person possessing the biometric
identifier is subject to:
(1) this section's provisions for the possession and
destruction of a biometric identifier; and
(2) the penalties associated with a violation of this
section.
SECTION 3. Section 541.104(a), Business & Commerce Code, is
amended to read as follows:
(a) A processor shall adhere to the instructions of a
controller and shall assist the controller in meeting or complying
with the controller's duties or requirements under this chapter,
including:
(1) assisting the controller in responding to consumer
rights requests submitted under Section 541.051 by using
appropriate technical and organizational measures, as reasonably
practicable, taking into account the nature of processing and the
information available to the processor;
(2) assisting the controller with regard to complying
with requirements [the requirement] relating to the security of
processing personal data, and if applicable, the data collected,
stored, and processed by an artificial intelligence system, as that
term is defined by Section 551.001, and to the notification of a
breach of security of the processor's system under Chapter 521,
taking into account the nature of processing and the information
available to the processor; and
(3) providing necessary information to enable the
controller to conduct and document data protection assessments
under Section 541.105.
SECTION 4. Title 11, Business & Commerce Code, is amended by
adding Subtitle D to read as follows:
SUBTITLE D. ARTIFICIAL INTELLIGENCE PROTECTION
CHAPTER 551. GENERAL PROVISIONS
Sec. 551.001. DEFINITIONS. In this subtitle:
(1) "Artificial intelligence system" means machine
learning and related technology that uses data to train statistical
models for the purpose of enabling computer systems to perform
tasks normally associated with human intelligence or perception,
such as computer vision, speech or natural language processing, and
content generation.
(2) "Consumer" means an individual who is a resident
of this state acting only in an individual or household context.
The term does not include an individual acting in a commercial or
employment context.
(3) "Council" means the Texas Artificial Intelligence
Council established under Chapter 554.
Sec. 551.002. APPLICABILITY OF SUBTITLE. This subtitle
applies only to a person who:
(1) promotes, advertises, or conducts business in this
state;
(2) produces a product or service used by residents of
this state; or
(3) develops or deploys an artificial intelligence
system in this state.
Sec. 551.003. CONSTRUCTION AND APPLICATION OF SUBTITLE.
This subtitle shall be broadly construed and applied to promote its
underlying purposes, which are to:
(1) facilitate and advance the responsible
development and use of artificial intelligence systems;
(2) protect individuals and groups of individuals from
known and reasonably foreseeable risks associated with artificial
intelligence systems;
(3) provide transparency regarding risks in the
development, deployment, and use of artificial intelligence
systems; and
(4) provide reasonable notice regarding the use or
contemplated use of artificial intelligence systems by state
agencies.
CHAPTER 552. ARTIFICIAL INTELLIGENCE PROTECTION
SUBCHAPTER A. GENERAL PROVISIONS
Sec. 552.001. DEFINITIONS. In this chapter:
(1) "Deployer" means a person who deploys an
artificial intelligence system for use in this state.
(2) "Developer" means a person who develops an
artificial intelligence system that is offered, sold, leased,
given, or otherwise provided in this state.
Sec. 552.002. CONSTRUCTION OF CHAPTER. This chapter may
not be construed to:
(1) impose a requirement on a person that adversely
affects the rights or freedoms of any person, including the right of
free speech; or
(2) authorize any department or agency other than the
Department of Insurance to regulate or oversee the business of
insurance.
Sec. 552.003. LOCAL PREEMPTION. This chapter supersedes
and preempts any ordinance, resolution, rule, or other regulation
adopted by a political subdivision regarding the use of artificial
intelligence systems.
SUBCHAPTER B. DUTIES AND PROHIBITIONS ON USE OF ARTIFICIAL
INTELLIGENCE
Sec. 552.051. DISCLOSURE TO CONSUMERS. (a) In this
section, "health care services" means services related to human
health or to the diagnosis, prevention, or treatment of a human
disease or impairment provided by an individual licensed,
registered, or certified under applicable state or federal law to
provide those services.
(b) A governmental agency that makes available an
artificial intelligence system intended to interact with consumers
shall disclose to each consumer, before or at the time of
interaction, that the consumer is interacting with an artificial
intelligence system.
(c) A person is required to make the disclosure under
Subsection (b) regardless of whether it would be obvious to a
reasonable consumer that the consumer is interacting with an
artificial intelligence system.
(d) A disclosure under Subsection (b):
(1) must be clear and conspicuous;
(2) must be written in plain language; and
(3) may not use a dark pattern, as that term is defined
by Section 541.001.
(e) A disclosure under Subsection (b) may be provided:
(1) by using a hyperlink to direct a consumer to a
separate Internet web page; or
(2) for an artificial intelligence system related to
health care services, as part of any waivers or forms signed by a
patient at the start of service.
Sec. 552.052. MANIPULATION OF HUMAN BEHAVIOR. A person may
not develop or deploy an artificial intelligence system in a manner
that intentionally aims to incite or encourage a person to:
(1) commit physical self-harm, including suicide;
(2) harm another person; or
(3) engage in criminal activity.
Sec. 552.053. SOCIAL SCORING. A governmental entity may
not use or deploy an artificial intelligence system that evaluates
or classifies a natural person or group of natural persons based on
social behavior or personal characteristics, whether known,
inferred, or predicted, with the intent to calculate or assign a
social score or similar categorical estimation or valuation of the
person or group of persons that results or may result in:
(1) detrimental or unfavorable treatment of a person
or group of persons in a social context unrelated to the context in
which the behavior or characteristics were observed or noted;
(2) detrimental or unfavorable treatment of a person
or group of persons that is unjustified or disproportionate to the
nature or gravity of the observed or noted behavior or
characteristics; or
(3) the infringement of any right guaranteed under the
United States Constitution, the Texas Constitution, or state or
federal law.
Sec. 552.054. CAPTURE OF BIOMETRIC DATA. (a) In this
section, "biometric data" means data generated by automatic
measurements of an individual's biological characteristics. The
term includes a fingerprint, voiceprint, eye retina or iris, or
other unique biological pattern or characteristic that is used to
identify a specific individual. The term does not include a
physical or digital photograph or data generated from a physical or
digital photograph, a video or audio recording or data generated
from a video or audio recording, or information collected, used, or
stored for health care treatment, payment, or operations under the
Health Insurance Portability and Accountability Act of 1996 (42
U.S.C. Section 1320d et seq.).
(b) A governmental entity may not develop or deploy an
artificial intelligence system for the purpose of uniquely
identifying a specific individual using biometric data or the
targeted or untargeted gathering of images or other media from the
Internet or any other publicly available source without the
individual's consent, if the gathering would infringe on any right
of the individual under the United States Constitution, the Texas
Constitution, or state or federal law.
(c) A violation of Section 503.001 is a violation of this
section.
Sec. 552.055. POLITICAL VIEWPOINT DISCRIMINATION. (a) A
person may not develop or deploy an artificial intelligence system
with the intent for the artificial intelligence system to:
(1) limit an individual's ability to express beliefs
or opinions or receive the expression of another individual's
beliefs or opinions based solely on the individual's political
beliefs, opinions, or affiliations; or
(2) otherwise infringe on an individual's freedom of
association or ability to freely express the individual's beliefs
or opinions.
(b) A person may not use an artificial intelligence system
on an interactive computer service, as defined by Section 323.001,
to intentionally:
(1) block, ban, remove, deplatform, demonetize,
debank, de-boost, restrict, or otherwise limit an individual;
(2) engage in behavior described by Subsection (a); or
(3) modify or manipulate content posted by an
individual for the purpose of censoring the individual's political
speech.
(c) Subsection (b) applies regardless of whether the
interactive computer service is automated or overseen by an
individual.
(d) This section does not apply to speech that:
(1) is illegal under state or federal law;
(2) constitutes a credible threat of violence or
incitement to imminent lawless action;
(3) contains material that is obscene, as defined by
Section 43.21, Penal Code;
(4) contains a deep fake video produced or distributed
in violation of Section 21.165, Penal Code;
(5) violates intellectual property rights; or
(6) violates a developer's or deployer's publicly
available terms of service.
(e) This section shall be construed in a manner consistent
with applicable federal law, including 47 U.S.C. Section 230 and
the United States Constitution.
Sec. 552.056. UNLAWFUL DISCRIMINATION. (a) In this
section:
(1) "Insurance entity" means:
(A) an entity described by Section 82.002(a),
Insurance Code;
(B) a fraternal benefit society regulated under
Chapter 885, Insurance Code; or
(C) the developer of an artificial intelligence
system used by an entity described by Paragraph (A) or (B).
(2) "Protected class" means a group or class of
persons with a characteristic, quality, belief, or status protected
from discrimination by state or federal civil rights laws, and
includes race, color, national origin, sex, age, religion, or
disability.
(b) A person may not develop or deploy an artificial
intelligence system with the intent to unlawfully discriminate
against a protected class in violation of state or federal law.
(c) For purposes of this section, a disparate impact is not
sufficient by itself to demonstrate an intent to discriminate.
(d) This section does not apply to an insurance entity for
purposes of providing insurance services if the entity is subject
to applicable statutes regulating unfair discrimination, unfair
methods of competition, or unfair or deceptive acts or practices
related to the business of insurance.
Sec. 552.057. CERTAIN SEXUALLY EXPLICIT VIDEOS, IMAGES, AND
CHILD PORNOGRAPHY. (a) A person may not develop or distribute an
artificial intelligence system with the sole intent of producing,
assisting or aiding in producing, or distributing:
(1) visual material in violation of Section 43.26,
Penal Code; or
(2) deep fake videos or images in violation of Section
21.165, Penal Code.
(b) A court determining the sole intent of a person under
this section shall consider marketing materials or terms of use
associated with the artificial intelligence system.
SUBCHAPTER C. ENFORCEMENT
Sec. 552.101. ENFORCEMENT AUTHORITY. (a) The attorney
general has exclusive authority to enforce this chapter, except to
the extent provided by Section 552.106.
(b) This chapter does not provide a basis for, and is not
subject to, a private right of action for a violation of this
chapter or any other law.
Sec. 552.102. INFORMATION AND COMPLAINTS. The attorney
general shall create and maintain an online mechanism on the
attorney general's Internet website through which a consumer may
submit a complaint under this chapter to the attorney general.
Sec. 552.103. INVESTIGATIVE AUTHORITY. (a) If the
attorney general receives a complaint through the online mechanism
under Section 552.102 alleging a violation of this chapter, the
attorney general may issue a civil investigative demand to
determine if a violation has occurred. The attorney general shall
issue demands in accordance with and under the procedures
established under Section 15.10.
(b) The attorney general may request from the person
reported through the online mechanism, pursuant to a civil
investigative demand issued under Subsection (a):
(1) a description of the purpose, intended use,
deployment context, and associated benefits of the artificial
intelligence system with which the person is affiliated;
(2) a description of the type of data used to program
or train the artificial intelligence system;
(3) a description of the categories of data processed
as inputs for the artificial intelligence system;
(4) a description of the outputs produced by the
artificial intelligence system;
(5) any metrics the person uses to evaluate the
performance of the artificial intelligence system;
(6) any known limitations of the artificial
intelligence system;
(7) a description of the post-deployment monitoring
and user safeguards the person uses for the artificial intelligence
system, including, if the person is a deployer, the oversight, use,
and learning process established by the person to address issues
arising from the system's deployment; or
(8) any other relevant documentation reasonably
necessary for the attorney general to conduct an investigation
under this section.
Sec. 552.104. NOTICE OF VIOLATION; OPPORTUNITY TO CURE.
(a) If the attorney general determines that a person has violated
or is violating this chapter, the attorney general shall notify the
person in writing of the determination, identifying the specific
provisions of this chapter the attorney general alleges have been
or are being violated.
(b) The attorney general may not bring an action against the
person:
(1) before the 60th day after the date the attorney
general provides the notice under Subsection (a); or
(2) if, before the 60th day after the date the attorney
general provides the notice under Subsection (a), the person:
(A) cures the identified violation; and
(B) provides the attorney general with a written
statement that the person has:
(i) cured the alleged violation;
(ii) notified the council and, if
technically feasible, the consumer who submitted the complaint
under Section 552.102 that the violation has been addressed;
(iii) provided supporting documentation to
show the manner in which the person cured the violation; and
(iv) made any necessary changes to internal
policies to reasonably prevent further violation of this chapter.
Sec. 552.105. CIVIL PENALTY; INJUNCTION. (a) A person who
violates this chapter and does not cure the violation under Section
552.104 is liable to this state for a civil penalty in an amount of:
(1) for each violation the court determines to be
curable or a breach of a statement submitted to the attorney general
under Section 552.104(b)(2), not less than $10,000 and not more
than $12,000;
(2) for each violation the court determines to be
uncurable, not less than $80,000 and not more than $200,000; and
(3) for a continued violation, not less than $2,000
and not more than $40,000 for each day the violation continues.
(b) The attorney general may bring an action in the name of
this state to:
(1) collect a civil penalty under this section;
(2) seek injunctive relief against further violation
of this chapter; and
(3) recover attorney's fees and reasonable court costs
or other investigative expenses.
(c) There is a rebuttable presumption that a person used
reasonable care as required under this chapter.
(d) A defendant in an action under this section may seek an
expedited hearing or other process, including a request for
declaratory judgment, if the person believes in good faith that the
person has not violated this chapter.
(e) A defendant in an action under this section may not be
found liable if:
(1) another person uses the artificial intelligence
system affiliated with the defendant in a manner prohibited by this
chapter; or
(2) the defendant discovers a violation of this
chapter through:
(A) feedback from a developer, deployer, or other
person who believes a violation has occurred;
(B) testing, including adversarial testing or
red-team testing;
(C) following guidelines set by applicable state
agencies; or
(D) if the defendant substantially complies with
the most recent version of the "Artificial Intelligence Risk
Management Framework: Generative Artificial Intelligence Profile"
published by the National Institute of Standards and Technology or
another nationally or internationally recognized risk management
framework for artificial intelligence systems, an internal review
process.
(f) The attorney general may not bring an action to collect
a civil penalty under this section against a person for an
artificial intelligence system that has not been deployed.
Sec. 552.106. ENFORCEMENT ACTIONS BY STATE AGENCIES. (a) A
state agency may impose sanctions against a person licensed,
registered, or certified by that agency for a violation of
Subchapter B if:
(1) the person has been found in violation of this
chapter under Section 552.105; and
(2) the attorney general has recommended additional
enforcement by the applicable agency.
(b) Sanctions under this section may include:
(1) suspension, probation, or revocation of a license,
registration, certificate, or other authorization to engage in an
activity; and
(2) a monetary penalty not to exceed $100,000.
CHAPTER 553. ARTIFICIAL INTELLIGENCE REGULATORY SANDBOX PROGRAM
SUBCHAPTER A. GENERAL PROVISIONS
Sec. 553.001. DEFINITIONS. In this chapter:
(1) "Applicable agency" means a department of this
state established by law to regulate certain types of business
activity in this state and the people engaging in that business,
including the issuance of licenses and registrations, that the
department determines would regulate a program participant if the
person were not operating under this chapter.
(2) "Department" means the Texas Department of
Information Resources.
(3) "Program" means the regulatory sandbox program
established under this chapter that allows a person, without being
licensed or registered under the laws of this state, to test an
artificial intelligence system for a limited time and on a limited
basis.
(4) "Program participant" means a person whose
application to participate in the program is approved and who may
test an artificial intelligence system under this chapter.
SUBCHAPTER B. SANDBOX PROGRAM FRAMEWORK
Sec. 553.051. ESTABLISHMENT OF SANDBOX PROGRAM. (a) The
department, in consultation with the council, shall create a
regulatory sandbox program that enables a person to obtain legal
protection and limited access to the market in this state to test
innovative artificial intelligence systems without obtaining a
license, registration, or other regulatory authorization.
(b) The program is designed to:
(1) promote the safe and innovative use of artificial
intelligence systems across various sectors including healthcare,
finance, education, and public services;
(2) encourage responsible deployment of artificial
intelligence systems while balancing the need for consumer
protection, privacy, and public safety;
(3) provide clear guidelines for a person who develops
an artificial intelligence system to test systems while certain
laws and regulations are waived or suspended; and
(4) allow a person to engage in research, training,
testing, or other pre-deployment activities to develop an
artificial intelligence system.
(c) The attorney general may not file or pursue charges
against a program participant for violation of a law or regulation
waived under this chapter that occurs during the testing period.
(d) A state agency may not file or pursue punitive action
against a program participant, including the imposition of a fine
or the suspension or revocation of a license, registration, or
other authorization, for violation of a law or regulation waived
under this chapter that occurs during the testing period.
(e) Notwithstanding Subsections (c) and (d), the
requirements of Subchapter B, Chapter 552, may not be waived, and
the attorney general or a state agency may file or pursue charges or
action against a program participant who violates that subchapter.
Sec. 553.052. APPLICATION FOR PROGRAM PARTICIPATION. (a)
A person must obtain approval from the department before testing an
artificial intelligence system under the program.
(b) The department by rule shall prescribe the application
form. The form must require the applicant to:
(1) provide a detailed description of the artificial
intelligence system the applicant desires to test in the program,
and its intended use;
(2) include a benefit assessment that addresses
potential impacts on consumers, privacy, and public safety;
(3) describe the applicant's plan for mitigating any
adverse consequences that may occur during the test; and
(4) provide proof of compliance with any applicable
federal artificial intelligence laws and regulations.
Sec. 553.053. DURATION AND SCOPE OF PARTICIPATION. (a) A
program participant approved by the department may test and deploy
an artificial intelligence system under the program for a period of
not more than 36 months.
(b) The department may extend a test under this chapter if
the department finds good cause for the test to continue.
SUBCHAPTER C. OVERSIGHT AND COMPLIANCE
Sec. 553.101. COORDINATION WITH APPLICABLE AGENCY. (a)
The department shall coordinate with all applicable agencies to
oversee the operation of a program participant.
(b) The council or an applicable agency may recommend to the
department that a program participant be removed from the program
if the applicable agency finds that the program participant's
artificial intelligence system:
(1) poses an undue risk to public safety or welfare;
(2) violates any federal law or regulation; or
(3) violates any state law or regulation not waived
under the program.
Sec. 553.102. PERIODIC REPORT BY PROGRAM PARTICIPANT. (a)
A program participant shall provide a quarterly report to the
department.
(b) The report shall include:
(1) metrics for the artificial intelligence system's
performance;
(2) updates on how the artificial intelligence system
mitigates any risks associated with its operation; and
(3) feedback from consumers and affected stakeholders
that are using an artificial intelligence system tested under this
chapter.
(c) The department shall maintain confidentiality regarding
the intellectual property, trade secrets, and other sensitive
information it obtains through the program.
Sec. 553.103. ANNUAL REPORT BY DEPARTMENT. (a) The
department shall submit an annual report to the legislature.
(b) The report shall include:
(1) the number of program participants testing an
artificial intelligence system in the program;
(2) the overall performance and impact of artificial
intelligence systems tested in the program; and
(3) recommendations on changes to laws or regulations
for future legislative consideration.
CHAPTER 554. TEXAS ARTIFICIAL INTELLIGENCE COUNCIL
SUBCHAPTER A. CREATION AND ORGANIZATION OF COUNCIL
Sec. 554.001. CREATION OF COUNCIL. (a) The Texas
Artificial Intelligence Council is created to:
(1) ensure artificial intelligence systems in this
state are ethical and developed in the public's best interest;
(2) ensure artificial intelligence systems in this
state do not harm public safety or undermine individual freedoms by
finding issues and making recommendations to the legislature
regarding the Penal Code and Chapter 82, Civil Practice and
Remedies Code;
(3) identify existing laws and regulations that impede
innovation in the development of artificial intelligence systems
and recommend appropriate reforms;
(4) analyze opportunities to improve the efficiency
and effectiveness of state government operations through the use of
artificial intelligence systems;
(5) make recommendations to applicable state agencies
regarding the use of artificial intelligence systems to improve the
agencies' efficiency and effectiveness;
(6) investigate and evaluate potential instances of
regulatory capture, including undue influence by technology
companies or disproportionate burdens on smaller innovators caused
by the use of artificial intelligence systems;
(7) investigate and evaluate the influence of
technology companies on other companies and determine the existence
or use of tools or processes designed to censor competitors or users
through the use of artificial intelligence systems;
(8) offer guidance and recommendations to the
legislature on the ethical and legal use of artificial intelligence
systems;
(9) conduct and publish the results of a study on the
current regulatory environment for artificial intelligence
systems;
(10) monitor the regulatory sandbox program under
Chapter 553 in coordination with the Texas Department of
Information Resources; and
(11) make recommendations for improvements to the
regulatory sandbox program under Chapter 553.
(b) The council is administratively attached to the Texas
Department of Information Resources, and the department shall
provide administrative support to the council as provided by this
section.
(c) The Texas Department of Information Resources and the
council shall enter into a memorandum of understanding detailing:
(1) the administrative support the council requires
from the department to fulfill the council's purposes;
(2) the reimbursement of administrative expenses to
the department; and
(3) any other provisions necessary to ensure the
efficient operation of the council.
Sec. 554.002. COUNCIL MEMBERSHIP. (a) The council is
composed of 10 members as follows:
(1) four members of the public appointed by the
governor;
(2) two members of the public appointed by the
lieutenant governor;
(3) two members of the public appointed by the speaker
of the house of representatives;
(4) one senator appointed by the lieutenant governor
as a nonvoting member; and
(5) one member of the house of representatives
appointed by the speaker of the house of representatives as a
nonvoting member.
(b) Voting members of the council serve staggered four-year
terms, with the terms of four members expiring every two years.
(c) The governor shall appoint a chair from among the
members, and the council shall elect a vice chair from its
membership.
(d) The council may establish an advisory board composed of
individuals from the public who possess expertise directly related
to the council's functions, including technical, ethical,
regulatory, and other relevant areas.
Sec. 554.003. QUALIFICATIONS. Members of the council must
be Texas residents and have knowledge or expertise in one or more of
the following areas:
(1) artificial intelligence systems;
(2) data privacy and security;
(3) ethics in technology or law;
(4) public policy and regulation;
(5) risk management related to artificial
intelligence systems;
(6) improving the efficiency and effectiveness of
governmental operations; or
(7) anticompetitive practices and market fairness.
Sec. 554.004. STAFF AND ADMINISTRATION. The council may
hire an executive director and other personnel as necessary to
perform its duties.
SUBCHAPTER B. POWERS AND DUTIES OF COUNCIL
Sec. 554.101. ISSUANCE OF REPORTS. (a) The council may
issue reports to the legislature regarding the use of artificial
intelligence systems in this state.
(b) The council may issue reports on:
(1) the compliance of artificial intelligence systems
in this state with the laws of this state;
(2) the ethical implications of deploying artificial
intelligence systems in this state;
(3) data privacy and security concerns related to
artificial intelligence systems in this state; or
(4) potential liability or legal risks associated with
the use of artificial intelligence systems in this state.
Sec. 554.102. TRAINING AND EDUCATIONAL OUTREACH. The
council shall conduct training programs for state agencies and
local governments on the use of artificial intelligence systems.
Sec. 554.103. LIMITATION OF AUTHORITY. The council may
not:
(1) adopt rules or promulgate guidance that is binding
for any entity;
(2) interfere with or override the operation of a
state agency; or
(3) perform a duty or exercise a power not granted by
this chapter.
SECTION 5. Section 325.011, Government Code, is amended to
read as follows:
Sec. 325.011. CRITERIA FOR REVIEW. The commission and its
staff shall consider the following criteria in determining whether
a public need exists for the continuation of a state agency or its
advisory committees or for the performance of the functions of the
agency or its advisory committees:
(1) the efficiency and effectiveness with which the
agency or the advisory committee operates;
(2)(A) an identification of the mission, goals, and
objectives intended for the agency or advisory committee and of the
problem or need that the agency or advisory committee was intended
to address; and
(B) the extent to which the mission, goals, and
objectives have been achieved and the problem or need has been
addressed;
(3)(A) an identification of any activities of the
agency in addition to those granted by statute and of the authority
for those activities; and
(B) the extent to which those activities are
needed;
(4) an assessment of authority of the agency relating
to fees, inspections, enforcement, and penalties;
(5) whether less restrictive or alternative methods of
performing any function that the agency performs could adequately
protect or provide service to the public;
(6) the extent to which the jurisdiction of the agency
and the programs administered by the agency overlap or duplicate
those of other agencies, the extent to which the agency coordinates
with those agencies, and the extent to which the programs
administered by the agency can be consolidated with the programs of
other state agencies;
(7) the promptness and effectiveness with which the
agency addresses complaints concerning entities or other persons
affected by the agency, including an assessment of the agency's
administrative hearings process;
(8) an assessment of the agency's rulemaking process
and the extent to which the agency has encouraged participation by
the public in making its rules and decisions and the extent to which
the public participation has resulted in rules that benefit the
public;
(9) the extent to which the agency has complied with:
(A) federal and state laws and applicable rules
regarding equality of employment opportunity and the rights and
privacy of individuals; and
(B) state law and applicable rules of any state
agency regarding purchasing guidelines and programs for
historically underutilized businesses;
(10) the extent to which the agency issues and
enforces rules relating to potential conflicts of interest of its
employees;
(11) the extent to which the agency complies with
Chapters 551 and 552 and follows records management practices that
enable the agency to respond efficiently to requests for public
information;
(12) the effect of federal intervention or loss of
federal funds if the agency is abolished;
(13) the extent to which the purpose and effectiveness
of reporting requirements imposed on the agency justifies the
continuation of the requirement; [and]
(14) an assessment of the agency's cybersecurity
practices using confidential information available from the
Department of Information Resources or any other appropriate state
agency; and
(15) an assessment of the agency's use of artificial
intelligence systems, as that term is defined by Section 551.001,
Business & Commerce Code, in its operations and its oversight of the
use of artificial intelligence systems by persons under the
agency's jurisdiction, and any related impact on the agency's
ability to achieve its mission, goals, and objectives, made using
information available from the Department of Information
Resources, the attorney general, or any other appropriate state
agency.
SECTION 6. Section 2054.068(b), Government Code, is amended
to read as follows:
(b) The department shall collect from each state agency
information on the status and condition of the agency's information
technology infrastructure, including information regarding:
(1) the agency's information security program;
(2) an inventory of the agency's servers, mainframes,
cloud services, and other information technology equipment;
(3) identification of vendors that operate and manage
the agency's information technology infrastructure; [and]
(4) any additional related information requested by
the department; and
(5) an evaluation of the use or considered use of
artificial intelligence systems, as defined by Section 551.001,
Business & Commerce Code, by each state agency.
SECTION 7. Section 2054.0965(b), Government Code, is
amended to read as follows:
(b) Except as otherwise modified by rules adopted by the
department, the review must include:
(1) an inventory of the agency's major information
systems, as defined by Section 2054.008, and other operational or
logistical components related to deployment of information
resources as prescribed by the department;
(2) an inventory of the agency's major databases,
artificial intelligence systems, as defined by Section 551.001,
Business & Commerce Code, and applications;
(3) a description of the agency's existing and planned
telecommunications network configuration;
(4) an analysis of how information systems,
components, databases, applications, and other information
resources have been deployed by the agency in support of:
(A) applicable achievement goals established
under Section 2056.006 and the state strategic plan adopted under
Section 2056.009;
(B) the state strategic plan for information
resources; and
(C) the agency's business objectives, mission,
and goals;
(5) agency information necessary to support the state
goals for interoperability and reuse; and
(6) confirmation by the agency of compliance with
state statutes, rules, and standards relating to information
resources.
SECTION 8. Not later than September 1, 2026, the attorney
general shall post on the attorney general's Internet website the
information and online mechanism required by Section 552.102,
Business & Commerce Code, as added by this Act.
SECTION 9. This Act takes effect January 1, 2026.