TX
Texas House Bill HB149

Texas 2025 - 89th Regular

Texas House Bill HB149 Compare Versions

OldNewDifferences
1-89R21355 BCH-F
21 By: Capriglione H.B. No. 149
3- Substitute the following for H.B. No. 149:
4- By: Bhojani C.S.H.B. No. 149
5-
6-
72
83
94 A BILL TO BE ENTITLED
105 AN ACT
11- relating to regulation of the use of artificial intelligence
6+ relating to the regulation of the use of artificial intelligence
127 systems in this state; providing civil penalties.
138 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
149 SECTION 1. This Act may be cited as the Texas Responsible
15- Artificial Intelligence Governance Act.
16- SECTION 2. Section 503.001, Business & Commerce Code, is
17- amended by amending Subsections (a) and (e) and adding Subsections
18- (b-1) and (f) to read as follows:
19- (a) In this section:
20- (1) "Artificial intelligence system" has the meaning
21- assigned by Section 551.001.
22- (2) "Biometric [, "biometric] identifier" means a
23- retina or iris scan, fingerprint, voiceprint, or record of hand or
24- face geometry.
25- (b-1) For purposes of Subsection (b), an individual has not
26- been informed of and has not provided consent for the capture or
27- storage of a biometric identifier of an individual for a commercial
28- purpose based solely on the existence of an image or other media
29- containing one or more biometric identifiers of the individual on
30- the Internet or other publicly available source.
31- (e) This section does not apply to:
32- (1) voiceprint data retained by a financial
33- institution or an affiliate of a financial institution, as those
34- terms are defined by 15 U.S.C. Section 6809; or
35- (2) the training, processing, or storage of biometric
36- identifiers involved in artificial intelligence systems, unless
37- the training, processing, or storage is performed for the purpose
38- of uniquely identifying a specific individual.
39- (f) If a biometric identifier captured for the purpose of
40- training an artificial intelligence system is subsequently used for
41- a commercial purpose, the person possessing the biometric
42- identifier is subject to:
43- (1) this section's provisions for the possession and
44- destruction of a biometric identifier; and
45- (2) the penalties associated with a violation of this
46- section.
47- SECTION 3. Section 541.104(a), Business & Commerce Code, is
48- amended to read as follows:
49- (a) A processor shall adhere to the instructions of a
50- controller and shall assist the controller in meeting or complying
51- with the controller's duties or requirements under this chapter,
52- including:
53- (1) assisting the controller in responding to consumer
54- rights requests submitted under Section 541.051 by using
55- appropriate technical and organizational measures, as reasonably
56- practicable, taking into account the nature of processing and the
57- information available to the processor;
58- (2) assisting the controller with regard to complying
59- with requirements [the requirement] relating to the security of
60- processing personal data, and if applicable, the data collected,
61- stored, and processed by an artificial intelligence system, as that
62- term is defined by Section 551.001, and to the notification of a
63- breach of security of the processor's system under Chapter 521,
64- taking into account the nature of processing and the information
65- available to the processor; and
66- (3) providing necessary information to enable the
67- controller to conduct and document data protection assessments
68- under Section 541.105.
69- SECTION 4. Title 11, Business & Commerce Code, is amended by
10+ Artificial Intelligence Governance Act
11+ SECTION 2. Title 11, Business & Commerce Code, is amended by
7012 adding Subtitle D to read as follows:
7113 SUBTITLE D. ARTIFICIAL INTELLIGENCE PROTECTION
72- CHAPTER 551. GENERAL PROVISIONS
73- Sec. 551.001. DEFINITIONS. In this subtitle:
74- (1) "Artificial intelligence system" means machine
75- learning and related technology that uses data to train statistical
76- models for the purpose of enabling computer systems to perform
77- tasks normally associated with human intelligence or perception,
78- such as computer vision, speech or natural language processing, and
79- content generation.
80- (2) "Consumer" means an individual who is a resident
14+ CHAPTER 551. ARTIFICIAL INTELLIGENCE PROTECTION
15+ SUBCHAPTER A. GENERAL PROVISIONS
16+ Sec. 551.001. DEFINITIONS. In this chapter:
17+ (1) "Artificial intelligence system" means the use of
18+ machine learning and related technologies that use data to train
19+ statistical models for the purpose of enabling computer systems to
20+ perform tasks normally associated with human intelligence or
21+ perception, such as computer vision, speech or natural language
22+ processing, and content generation.
23+ (2) "Biometric identifier" means a retina or iris
24+ scan, fingerprint, voiceprint, or record of hand or face geometry.
25+ (3) "Council" means the Artificial Intelligence
26+ Council established under Chapter 553.
27+ (4) "Consumer" means an individual who is a resident
8128 of this state acting only in an individual or household context.
8229 The term does not include an individual acting in a commercial or
8330 employment context.
84- (3) "Council" means the Texas Artificial Intelligence
85- Council established under Chapter 554.
86- Sec. 551.002. APPLICABILITY OF SUBTITLE. This subtitle
87- applies only to a person who:
88- (1) promotes, advertises, or conducts business in this
89- state;
90- (2) produces a product or service used by residents of
91- this state; or
92- (3) develops or deploys an artificial intelligence
93- system in this state.
94- Sec. 551.003. CONSTRUCTION AND APPLICATION OF SUBTITLE.
95- This subtitle shall be broadly construed and applied to promote its
96- underlying purposes, which are to:
97- (1) facilitate and advance the responsible
31+ (5) "Deploy" means to put into effect or
32+ commercialize.
33+ (6) "Deployer" means a person doing business in this
34+ state that deploys an artificial intelligence system.
35+ (7) "Developer" means a person doing business in this
36+ state that develops an artificial intelligence system.
37+ (8) "Distributor" means a person, other than the
38+ Developer or Deployer, that makes an artificial intelligence system
39+ available in the market for a commercial purpose.
40+ (9) "Health care service or treatment" means a health
41+ care treatment, service, or procedure designed to maintain, treat,
42+ diagnose, prevent, alleviate, cure, or heal a patient's physical or
43+ mental condition, illness, injury, or disease, including
44+ preventative care.
45+ (10) "Interactive computer service" has the meaning
46+ assigned by Section 323.001, Business and Commerce Code.
47+ (11) "Personal data" has the meaning assigned to it by
48+ Section 541.001, Business and Commerce Code.
49+ (12) "Personal data" has the meaning assigned to it by
50+ Section 541.001, Business and Commerce Code.
51+ (13) "Political viewpoint discrimination" means the
52+ intentional limitation of a person's ability to express or receive
53+ the expression of another person based solely on the person's
54+ political beliefs, opinions, or affiliation.
55+ (14) "Sensitive personal attribute" means race,
56+ political opinions, religious or philosophical beliefs, ethnic
57+ orientation, mental health diagnosis, or sex. The term does not
58+ include conduct that would be classified as an offense under
59+ Chapter 21, Penal Code.
60+ Sec. 551.002. APPLICABILITY OF CHAPTER. This chapter
61+ applies to a person that:
62+ (1) conducts business, promotes, or advertises in this
63+ state or produces a product or service consumed by residents of this
64+ state; or
65+ (2) engages in the development, distribution, or
66+ deployment of an artificial intelligence system in this state; and
67+ Sec. 551.003. SANDBOX PROGRAM EXCEPTION. Excluding
68+ violations of Subchapter B, this chapter does not apply to the
69+ development of an artificial intelligence system that is used
70+ exclusively for research, training, testing, or other
71+ pre-deployment activities performed by active participants of the
72+ sandbox program in compliance with Chapter 552.
73+ Sec. 551.004. DISCLOSURE OF AN ARTIFICIAL INTELLIGENCE
74+ SYSTEM TO CONSUMERS. (a) A government agency that makes available
75+ an artificial intelligence system that is intended to interact with
76+ consumers shall disclose to each consumer, before or at the time of
77+ interaction:
78+ (1) that the consumer is interacting with an
79+ artificial intelligence system;
80+ (b) Disclosure is required under subsection (a) of this
81+ section regardless of whether it would be obvious to a reasonable
82+ person that the person is interacting with an artificial
83+ intelligence system.
84+ (c) All disclosures under subsection (a) shall be clear and
85+ conspicuous and written in plain language, and avoid the use of a
86+ dark pattern as defined by 541.001, Business & Commerce Code.
87+ (d) All disclosures under subsection (a) may be linked to a
88+ separate webpage of the developer or deployer.
89+ (e) Any requirement in this section that may conflict with
90+ state or federal law may be exempt.
91+ (f) Any disclosure in a Health care service or treatment may
92+ be prescribed to a consumer through entry waiver forms.
93+ SUBCHAPTER B. PROHIBITED USES
94+ Sec. 551.051. MANIPULATION OF HUMAN BEHAVIOR TO INCITE HARM
95+ OR CRIMINALITY. An artificial intelligence system shall not be
96+ intentionally developed or deployed to incite or encourage a person
97+ to:
98+ (1) commit physical self-harm, including suicide;
99+ (2) harm another person; or
100+ (3) engage in criminal activity.
101+ Sec. 551.052. MANIPULATION OF HUMAN BEHAVIOR TO CIRCUMVENT
102+ INFORMED DECISION-MAKING. An artificial intelligence system shall
103+ not intentionally use Deceptive Trade Practices, as defined by
104+ Chapter 17 of the Texas Business and Commerce Code
105+ Sec.551.053. SOCIAL SCORING. (a) The use by a government
106+ entity of AI systems for the evaluation or classification of
107+ natural persons or groups of persons over a certain period of time
108+ based on their social behavior or known, inferred or predicted
109+ personal or personality characteristics, with the social score
110+ leading to all of the following shall be prohibited:
111+ (i) detrimental or unfavorable treatment of certain
112+ natural persons or groups of persons in social contexts that are
113+ unrelated to the contexts in which the data was originally
114+ generated or collected;
115+ (ii) detrimental or unfavorable treatment of certain
116+ natural persons or groups of persons that is unjustified or
117+ disproportionate to their social behavior or its gravity; and
118+ (iii) infringement, constraining, or otherwise
119+ chilling of any right guaranteed under the United States
120+ Constitution, the Texas Constitution, federal law, or Texas law.
121+ (b) This section applies to government entities using
122+ artificial intelligence systems to constrain civil liberties, not
123+ any artificial intelligence system developed or deployed for
124+ commercial purposes.
125+ Sec. 551.054. CAPTURE OF BIOMETRIC IDENTIFIERS USING
126+ ARTIFICIAL INTELLIGENCE. (a) A government entity in this state
127+ shall not develop or deploy an artificial intelligence system
128+ developed with biometric identifiers of individuals and the
129+ targeted or untargeted gathering of images or other media from the
130+ internet or any other publicly available source shall not be
131+ deployed for the purpose of uniquely identifying a specific
132+ individual, if it would infringe, constrain, or otherwise chill any
133+ right guaranteed under the United States Constitution, the Texas
134+ Constitution, federal law, or Texas law.
135+ (b) An individual is not considered to be informed nor to
136+ have provided consent for such purpose pursuant to Section 503.001,
137+ Business and Commerce Code, based solely upon the existence on the
138+ internet, or other publicly available source, of an image or other
139+ media containing one or more biometric identifiers.
140+ (c) This section applies to systems designed for government
141+ entities to constrain civil liberties, not any artificial
142+ intelligence system developed or deployed for commercial purposes
143+ or any other government entity purpose.
144+ Sec. 551.056. POLITICAL VIEWPOINT DISCRIMINATION. (a) An
145+ artificial intelligence system shall not be developed or deployed
146+ in a manner that intentionally results in political viewpoint
147+ discrimination or otherwise intentionally infringes upon a
148+ person's freedom of association or ability to freely express the
149+ person's beliefs or opinions.
150+ (b) An interactive computer service may not, through the use
151+ of an artificial intelligence system:
152+ (1) block, ban, remove, de-platform, demonetize,
153+ debank, de-boost, restrict, or otherwise discriminate against a
154+ user based on the user's political speech; or
155+ (2) modify or manipulate a user's content or posting
156+ for the purpose of censoring the user's political speech.
157+ (c) The prohibitions in subsection (b) apply regardless of
158+ whether the actions of the interactive computer service are
159+ automated or conducted with human oversight.
160+ (d) This section does not apply to speech that:
161+ (1) is illegal under federal or state law;
162+ (2) constitutes a credible threat of violence or
163+ incitement to imminent lawless action;
164+ (3) contains obscene material as defined by Section
165+ 43.21, Penal Code;
166+ (4) Contains unlawful deep fake video or image in
167+ violation of Section 21.165, Penal Code; or
168+ (5) violates intellectual property rights under
169+ applicable law.
170+ (e) This section shall be construed to be consistent with
171+ applicable federal law, including 47 U.S.C. Section 230, and the
172+ United States Constitution.
173+ Sec. 551.058. UNLAWFUL DISCRIMINATION. An artificial
174+ intelligence system shall not be developed or deployed with the
175+ intent to unlawfully discriminate against a protected class in
176+ violation of the laws of this state or federal law. Disparate impact
177+ alone is not sufficient to show intent to discriminate.
178+ Sec. 551.061. CERTAIN SEXUALLY EXPLICIT VIDEOS, IMAGES, AND
179+ CHILD PORNOGRAPHY. An artificial intelligence system shall not be
180+ developed or deployed with the sole intent of producing, assisting
181+ or aiding in producing, or distributing unlawful visual material in
182+ violation of Section 43.26, Penal Code or an unlawful deep fake
183+ video or image in violation of Section 21.165, Penal Code. Factors
184+ to be considered in evaluating the primary purpose or function of an
185+ artificial intelligence system shall include marketing materials
186+ and terms of use associated with the system.
187+ SUBCHAPTER C. ENFORCEMENT AND CONSUMER PROTECTIONS
188+ Sec. 551.101. CONSTRUCTION AND APPLICATION. (a) This
189+ chapter shall be broadly construed and applied to promote its
190+ underlying purposes, which are:
191+ (1) to facilitate and advance the responsible
98192 development and use of artificial intelligence systems;
99- (2) protect individuals and groups of individuals from
100- known and reasonably foreseeable risks associated with artificial
101- intelligence systems;
102- (3) provide transparency regarding risks in the
103- development, deployment, and use of artificial intelligence
193+ (2) to protect individuals and groups of individuals
194+ from known, and unknown but reasonably foreseeable, risks
195+ associated with artificial intelligence;
196+ (3) to provide transparency regarding those risks in
197+ the development, deployment, or use of artificial intelligence
104198 systems; and
105- (4) provide reasonable notice regarding the use or
106- contemplated use of artificial intelligence systems by state
107- agencies.
108- CHAPTER 552. ARTIFICIAL INTELLIGENCE PROTECTION
109- SUBCHAPTER A. GENERAL PROVISIONS
110- Sec. 552.001. DEFINITIONS. In this chapter:
111- (1) "Deployer" means a person who deploys an
112- artificial intelligence system for use in this state.
113- (2) "Developer" means a person who develops an
114- artificial intelligence system that is offered, sold, leased,
115- given, or otherwise provided in this state.
116- Sec. 552.002. CONSTRUCTION OF CHAPTER. This chapter may
117- not be construed to:
118- (1) impose a requirement on a person that adversely
119- affects the rights or freedoms of any person, including the right of
120- free speech; or
121- (2) authorize any department or agency other than the
122- Department of Insurance to regulate or oversee the business of
123- insurance.
124- Sec. 552.003. LOCAL PREEMPTION. This chapter supersedes
199+ (4) to provide reasonable notice regarding the use of
200+ artificial intelligence systems by state agencies.
201+ Sec. 551.102. ENFORCEMENT AUTHORITY. The attorney general
202+ has authority to enforce this chapter. Excluding, researching,
203+ training, testing, or the conducting of other pre-deployment or
204+ post-deployment activities by active participants of the sandbox
205+ program, in compliance with Chapter 552, does not subject a
206+ developer or deployer to penalties or actions.
207+ Sec. 551.103. INTERNET WEBSITE AND COMPLAINT MECHANISM.
208+ The attorney general shall post on the attorney general's Internet
209+ website an online mechanism through which a consumer may submit a
210+ complaint under this chapter to the attorney general.
211+ Sec. 551.104. INVESTIGATIVE AUTHORITY. (a) If the
212+ attorney general receives a complaint alleging a violation of this
213+ chapter through the online mechanism established under Section
214+ 551.103, the attorney general may issue a civil investigative
215+ demand. The attorney general shall issue such demands in
216+ accordance with and under the procedures established under Section
217+ 15.10.
218+ (b) The attorney general may request from the associated
219+ party, pursuant to a civil investigative demand issued under
220+ Subsection (a), any one of the following;
221+ (1) A High Level Statement disclosing the purpose,
222+ intended use cases, and deployment context of, and benefits
223+ afforded by, the artificial intelligence system;
224+ (2) a High Level description of the categories of data
225+ the artificial intelligence system processes as inputs and the
226+ outputs the artificial intelligence system produces;
227+ (3) any metrics used to evaluate the performance and
228+ known limitations of the artificial intelligence system;
229+ (4) a High Level description of the post-deployment
230+ monitoring and user safeguards provided concerning the artificial
231+ intelligence system, including the oversight, use, and learning
232+ process established by the deployer to address issues arising from
233+ the deployment of the artificial intelligence system;
234+ (5) a high-level summary of the type of data used to
235+ program or train the artificial intelligence system; or
236+ (6) Any other relevant documentation reasonably
237+ necessary for the attorney general to conduct an investigation and
238+ determine liability or fault of the offender.
239+ (c) The attorney general may not institute an action for a
240+ civil penalty against a developer or deployer for artificial
241+ intelligence systems that remain isolated from customer
242+ interaction in a pre-deployment environment.
243+ Sec. 551.105. NOTICE OF VIOLATION OF CHAPTER; OPPORTUNITY
244+ TO CURE. (a) Before bringing an action under Section 551.106, the
245+ attorney general shall notify a developer, distributor, or deployer
246+ in writing, not later than the 60th day before bringing the action,
247+ identifying the specific provisions of this chapter the attorney
248+ general alleges have been or are being violated. The attorney
249+ general may not bring an action against the developer or deployer
250+ if:
251+ (1) within the 60-day period, the developer or
252+ deployer cures the identified violation; and
253+ (2) the developer or deployer provides the attorney
254+ general a written statement that the developer or deployer:
255+ (A) cured the alleged violation;
256+ (B) notified the consumer, if technically
257+ feasible, and the council that the developer or deployer's
258+ violation was addressed, if the consumer's contact information has
259+ been made available to the developer or deployer and the attorney
260+ general;
261+ (C) provided supportive documentation to show
262+ how the violation was cured; and
263+ (D) made changes to internal policies, if
264+ necessary, to reasonably ensure that no such further violations are
265+ likely to occur.
266+ (b) In any action brought forward by the attorney general or
267+ any violation of this chapter, it shall be an affirmative defense
268+ that the developer, deployer, or other person:
269+ (1) discovers and cures an identified violation under
270+ Subchapter B through:
271+ (A) feedback that the developer, deployer, or
272+ other person encourages deployers or users to provide to such
273+ developer, deployer, or other person;
274+ (B) testing, such as adversarial testing or
275+ red-teaming;
276+ (C) an internal review process; and is otherwise
277+ in compliance with the latest version of the Artificial
278+ Intelligence Risk Management Framework published by the National
279+ Institute of Standards and Technology, ISO/IEC 42001, or another
280+ nationally or internationally recognized risk management framework
281+ for artificial intelligence systems; or
282+ (D) following guidelines set by state agencies as
283+ appropriate.
284+ Sec. 551.106. CIVIL PENALTY; INJUNCTION. (a) The attorney
285+ general may bring an action in the name of this state to restrain or
286+ enjoin the person from violating this chapter and seek injunctive
287+ relief.
288+ (b) The attorney general may recover reasonable attorney's
289+ fees and other reasonable expenses incurred in investigating and
290+ bringing an action under this section.
291+ (c) The attorney general may assess and collect an
292+ administrative fine against a developer or deployer who fails to
293+ timely cure a violation or who breaches a written statement
294+ provided to the attorney general, of not less than $10,000 and not
295+ more than $12,000 per uncured violation.
296+ (d) The attorney general may assess and collect an
297+ administrative fine against a developer or deployer who fails to
298+ timely cure a violation that is determined to be uncurable, of not
299+ less than $80,000 and not more than $200,000 per violation after
300+ conviction of such violation.
301+ (e) A developer or deployer who was found in violation of
302+ and continues to operate with the provisions of this chapter shall
303+ be assessed an administrative fine of not less than $2,000 and not
304+ more than $40,000 per day.
305+ (f) There is a rebuttable presumption that a developer,
306+ distributor, or deployer used reasonable care as required under
307+ this chapter if the developer, distributor, or deployer complied
308+ with their duties in preventing violations under Subchapter B.
309+ (g) A developer, distributor, or deployer may seek an
310+ expedited hearing or other process, including a request for
311+ declaratory judgment, if the developer, distributor, or deployer
312+ believes its actions have not violated this chapter.
313+ Sec. 551.107. ENFORCEMENT ACTIONS BY STATE AGENCIES. (a) A
314+ state agency may sanction an individual licensed, registered, or
315+ certified by that agency for violations of Subchapter B, including:
316+ (1) the suspension, probation, or revocation of a
317+ license, registration, certificate, or other form of permission to
318+ engage in an activity; and
319+ (2) monetary penalties up to $100,000.
320+ (b) a state agency may not sanction an individual that is
321+ licensed, registered, or certified by that agency for violations of
322+ Subchapter B until individuals or entities have been sentenced for
323+ violations of this chapter, and received recommendations from the
324+ attorney general for subsequent enforcement.
325+ Sec. 551.108. CONSUMER RIGHTS AND REMEDIES. A consumer may
326+ appeal decision made by an artificial intelligence system which has
327+ an adverse impact on their health, welfare, safety, or fundamental
328+ rights, and shall have the right to obtain from the deployer clear
329+ and meaningful explanations of the role of the artificial
330+ intelligence system in the decision-making procedure and the main
331+ elements of the decision taken.
332+ SUBCHAPTER D. CONSTRUCTION OF CHAPTER; LOCAL PREEMPTION
333+ Sec. 551.151. CONSTRUCTION OF CHAPTER. This chapter may
334+ not be construed as imposing a requirement on a developer, a
335+ deployer, or other person that adversely affects the rights or
336+ freedoms of any person, including the right of free speech.
337+ Sec. 551.152. LOCAL PREEMPTION. This chapter supersedes
125338 and preempts any ordinance, resolution, rule, or other regulation
126339 adopted by a political subdivision regarding the use of artificial
127340 intelligence systems.
128- SUBCHAPTER B. DUTIES AND PROHIBITIONS ON USE OF ARTIFICIAL
129- INTELLIGENCE
130- Sec. 552.051. DISCLOSURE TO CONSUMERS. (a) In this
131- section, "health care services" means services related to human
132- health or to the diagnosis, prevention, or treatment of a human
133- disease or impairment provided by an individual licensed,
134- registered, or certified under applicable state or federal law to
135- provide those services.
136- (b) A governmental agency that makes available an
137- artificial intelligence system intended to interact with consumers
138- shall disclose to each consumer, before or at the time of
139- interaction, that the consumer is interacting with an artificial
140- intelligence system.
141- (c) A person is required to make the disclosure under
142- Subsection (b) regardless of whether it would be obvious to a
143- reasonable consumer that the consumer is interacting with an
341+ CHAPTER 552. ARTIFICIAL INTELLIGENCE REGULATORY SANDBOX PROGRAM
342+ SUBCHAPTER A. GENERAL PROVISIONS
343+ Sec. 552.001. DEFINITIONS. In this chapter:
344+ (1) "Applicable agency" means a state agency
345+ responsible for regulating a specific sector impacted by an
144346 artificial intelligence system.
145- (d) A disclosure under Subsection (b):
146- (1) must be clear and conspicuous;
147- (2) must be written in plain language; and
148- (3) may not use a dark pattern, as that term is defined
149- by Section 541.001.
150- (e) A disclosure under Subsection (b) may be provided:
151- (1) by using a hyperlink to direct a consumer to a
152- separate Internet web page; or
153- (2) for an artificial intelligence system related to
154- health care services, as part of any waivers or forms signed by a
155- patient at the start of service.
156- Sec. 552.052. MANIPULATION OF HUMAN BEHAVIOR. A person may
157- not develop or deploy an artificial intelligence system in a manner
158- that intentionally aims to incite or encourage a person to:
159- (1) commit physical self-harm, including suicide;
160- (2) harm another person; or
161- (3) engage in criminal activity.
162- Sec. 552.053. SOCIAL SCORING. A governmental entity may
163- not use or deploy an artificial intelligence system that evaluates
164- or classifies a natural person or group of natural persons based on
165- social behavior or personal characteristics, whether known,
166- inferred, or predicted, with the intent to calculate or assign a
167- social score or similar categorical estimation or valuation of the
168- person or group of persons that results or may result in:
169- (1) detrimental or unfavorable treatment of a person
170- or group of persons in a social context unrelated to the context in
171- which the behavior or characteristics were observed or noted;
172- (2) detrimental or unfavorable treatment of a person
173- or group of persons that is unjustified or disproportionate to the
174- nature or gravity of the observed or noted behavior or
175- characteristics; or
176- (3) the infringement of any right guaranteed under the
177- United States Constitution, the Texas Constitution, or state or
178- federal law.
179- Sec. 552.054. CAPTURE OF BIOMETRIC DATA. (a) In this
180- section, "biometric data" means data generated by automatic
181- measurements of an individual's biological characteristics. The
182- term includes a fingerprint, voiceprint, eye retina or iris, or
183- other unique biological pattern or characteristic that is used to
184- identify a specific individual. The term does not include a
185- physical or digital photograph or data generated from a physical or
186- digital photograph, a video or audio recording or data generated
187- from a video or audio recording, or information collected, used, or
188- stored for health care treatment, payment, or operations under the
189- Health Insurance Portability and Accountability Act of 1996 (42
190- U.S.C. Section 1320d et seq.).
191- (b) A governmental entity may not develop or deploy an
192- artificial intelligence system for the purpose of uniquely
193- identifying a specific individual using biometric data or the
194- targeted or untargeted gathering of images or other media from the
195- Internet or any other publicly available source without the
196- individual's consent, if the gathering would infringe on any right
197- of the individual under the United States Constitution, the Texas
198- Constitution, or state or federal law.
199- (c) A violation of Section 503.001 is a violation of this
200- section.
201- Sec. 552.055. POLITICAL VIEWPOINT DISCRIMINATION. (a) A
202- person may not develop or deploy an artificial intelligence system
203- with the intent for the artificial intelligence system to:
204- (1) limit an individual's ability to express beliefs
205- or opinions or receive the expression of another individual's
206- beliefs or opinions based solely on the individual's political
207- beliefs, opinions, or affiliations; or
208- (2) otherwise infringe on an individual's freedom of
209- association or ability to freely express the individual's beliefs
210- or opinions.
211- (b) A person may not use an artificial intelligence system
212- on an interactive computer service, as defined by Section 323.001,
213- to intentionally:
214- (1) block, ban, remove, deplatform, demonetize,
215- debank, de-boost, restrict, or otherwise limit an individual;
216- (2) engage in behavior described by Subsection (a); or
217- (3) modify or manipulate content posted by an
218- individual for the purpose of censoring the individual's political
219- speech.
220- (c) Subsection (b) applies regardless of whether the
221- interactive computer service is automated or overseen by an
222- individual.
223- (d) This section does not apply to speech that:
224- (1) is illegal under state or federal law;
225- (2) constitutes a credible threat of violence or
226- incitement to imminent lawless action;
227- (3) contains material that is obscene, as defined by
228- Section 43.21, Penal Code;
229- (4) contains a deep fake video produced or distributed
230- in violation of Section 21.165, Penal Code;
231- (5) violates intellectual property rights; or
232- (6) violates a developer's or deployer's publicly
233- available terms of service.
234- (e) This section shall be construed in a manner consistent
235- with applicable federal law, including 47 U.S.C. Section 230 and
236- the United States Constitution.
237- Sec. 552.056. UNLAWFUL DISCRIMINATION. (a) In this
238- section:
239- (1) "Insurance entity" means:
240- (A) an entity described by Section 82.002(a),
241- Insurance Code;
242- (B) a fraternal benefit society regulated under
243- Chapter 885, Insurance Code; or
244- (C) the developer of an artificial intelligence
245- system used by an entity described by Paragraph (A) or (B).
246- (2) "Protected class" means a group or class of
247- persons with a characteristic, quality, belief, or status protected
248- from discrimination by state or federal civil rights laws, and
249- includes race, color, national origin, sex, age, religion, or
250- disability.
251- (b) A person may not develop or deploy an artificial
252- intelligence system with the intent to unlawfully discriminate
253- against a protected class in violation of state or federal law.
254- (c) For purposes of this section, a disparate impact is not
255- sufficient by itself to demonstrate an intent to discriminate.
256- (d) This section does not apply to an insurance entity for
257- purposes of providing insurance services if the entity is subject
258- to applicable statutes regulating unfair discrimination, unfair
259- methods of competition, or unfair or deceptive acts or practices
260- related to the business of insurance.
261- Sec. 552.057. CERTAIN SEXUALLY EXPLICIT VIDEOS, IMAGES, AND
262- CHILD PORNOGRAPHY. (a) A person may not develop or distribute an
263- artificial intelligence system with the sole intent of producing,
264- assisting or aiding in producing, or distributing:
265- (1) visual material in violation of Section 43.26,
266- Penal Code; or
267- (2) deep fake videos or images in violation of Section
268- 21.165, Penal Code.
269- (b) A court determining the sole intent of a person under
270- this section shall consider marketing materials or terms of use
271- associated with the artificial intelligence system.
272- SUBCHAPTER C. ENFORCEMENT
273- Sec. 552.101. ENFORCEMENT AUTHORITY. (a) The attorney
274- general has exclusive authority to enforce this chapter, except to
275- the extent provided by Section 552.106.
276- (b) This chapter does not provide a basis for, and is not
277- subject to, a private right of action for a violation of this
278- chapter or any other law.
279- Sec. 552.102. INFORMATION AND COMPLAINTS. The attorney
280- general shall create and maintain an online mechanism on the
281- attorney general's Internet website through which a consumer may
282- submit a complaint under this chapter to the attorney general.
283- Sec. 552.103. INVESTIGATIVE AUTHORITY. (a) If the
284- attorney general receives a complaint through the online mechanism
285- under Section 552.102 alleging a violation of this chapter, the
286- attorney general may issue a civil investigative demand to
287- determine if a violation has occurred. The attorney general shall
288- issue demands in accordance with and under the procedures
289- established under Section 15.10.
290- (b) The attorney general may request from the person
291- reported through the online mechanism, pursuant to a civil
292- investigative demand issued under Subsection (a):
293- (1) a description of the purpose, intended use,
294- deployment context, and associated benefits of the artificial
295- intelligence system with which the person is affiliated;
296- (2) a description of the type of data used to program
297- or train the artificial intelligence system;
298- (3) a description of the categories of data processed
299- as inputs for the artificial intelligence system;
300- (4) a description of the outputs produced by the
301- artificial intelligence system;
302- (5) any metrics the person uses to evaluate the
303- performance of the artificial intelligence system;
304- (6) any known limitations of the artificial
305- intelligence system;
306- (7) a description of the post-deployment monitoring
307- and user safeguards the person uses for the artificial intelligence
308- system, including, if the person is a deployer, the oversight, use,
309- and learning process established by the person to address issues
310- arising from the system's deployment; or
311- (8) any other relevant documentation reasonably
312- necessary for the attorney general to conduct an investigation
313- under this section.
314- Sec. 552.104. NOTICE OF VIOLATION; OPPORTUNITY TO CURE.
315- (a) If the attorney general determines that a person has violated
316- or is violating this chapter, the attorney general shall notify the
317- person in writing of the determination, identifying the specific
318- provisions of this chapter the attorney general alleges have been
319- or are being violated.
320- (b) The attorney general may not bring an action against the
321- person:
322- (1) before the 60th day after the date the attorney
323- general provides the notice under Subsection (a); or
324- (2) if, before the 60th day after the date the attorney
325- general provides the notice under Subsection (a), the person:
326- (A) cures the identified violation; and
327- (B) provides the attorney general with a written
328- statement that the person has:
329- (i) cured the alleged violation;
330- (ii) notified the council and, if
331- technically feasible, the consumer who submitted the complaint
332- under Section 552.102 that the violation has been addressed;
333- (iii) provided supporting documentation to
334- show the manner in which the person cured the violation; and
335- (iv) made any necessary changes to internal
336- policies to reasonably prevent further violation of this chapter.
337- Sec. 552.105. CIVIL PENALTY; INJUNCTION. (a) A person who
338- violates this chapter and does not cure the violation under Section
339- 552.104 is liable to this state for a civil penalty in an amount of:
340- (1) for each violation the court determines to be
341- curable or a breach of a statement submitted to the attorney general
342- under Section 552.104(b)(2), not less than $10,000 and not more
343- than $12,000;
344- (2) for each violation the court determines to be
345- uncurable, not less than $80,000 and not more than $200,000; and
346- (3) for a continued violation, not less than $2,000
347- and not more than $40,000 for each day the violation continues.
348- (b) The attorney general may bring an action in the name of
349- this state to:
350- (1) collect a civil penalty under this section;
351- (2) seek injunctive relief against further violation
352- of this chapter; and
353- (3) recover attorney's fees and reasonable court costs
354- or other investigative expenses.
355- (c) There is a rebuttable presumption that a person used
356- reasonable care as required under this chapter.
357- (d) A defendant in an action under this section may seek an
358- expedited hearing or other process, including a request for
359- declaratory judgment, if the person believes in good faith that the
360- person has not violated this chapter.
361- (e) A defendant in an action under this section may not be
362- found liable if:
363- (1) another person uses the artificial intelligence
364- system affiliated with the defendant in a manner prohibited by this
365- chapter; or
366- (2) the defendant discovers a violation of this
367- chapter through:
368- (A) feedback from a developer, deployer, or other
369- person who believes a violation has occurred;
370- (B) testing, including adversarial testing or
371- red-team testing;
372- (C) following guidelines set by applicable state
373- agencies; or
374- (D) if the defendant substantially complies with
375- the most recent version of the "Artificial Intelligence Risk
376- Management Framework: Generative Artificial Intelligence Profile"
377- published by the National Institute of Standards and Technology or
378- another nationally or internationally recognized risk management
379- framework for artificial intelligence systems, an internal review
380- process.
381- (f) The attorney general may not bring an action to collect
382- a civil penalty under this section against a person for an
383- artificial intelligence system that has not been deployed.
384- Sec. 552.106. ENFORCEMENT ACTIONS BY STATE AGENCIES. (a) A
385- state agency may impose sanctions against a person licensed,
386- registered, or certified by that agency for a violation of
387- Subchapter B if:
388- (1) the person has been found in violation of this
389- chapter under Section 552.105; and
390- (2) the attorney general has recommended additional
391- enforcement by the applicable agency.
392- (b) Sanctions under this section may include:
393- (1) suspension, probation, or revocation of a license,
394- registration, certificate, or other authorization to engage in an
395- activity; and
396- (2) a monetary penalty not to exceed $100,000.
397- CHAPTER 553. ARTIFICIAL INTELLIGENCE REGULATORY SANDBOX PROGRAM
398- SUBCHAPTER A. GENERAL PROVISIONS
399- Sec. 553.001. DEFINITIONS. In this chapter:
400- (1) "Applicable agency" means a department of this
401- state established by law to regulate certain types of business
402- activity in this state and the people engaging in that business,
403- including the issuance of licenses and registrations, that the
404- department determines would regulate a program participant if the
405- person were not operating under this chapter.
406- (2) "Department" means the Texas Department of
407- Information Resources.
408- (3) "Program" means the regulatory sandbox program
409- established under this chapter that allows a person, without being
410- licensed or registered under the laws of this state, to test an
411- artificial intelligence system for a limited time and on a limited
412- basis.
413- (4) "Program participant" means a person whose
414- application to participate in the program is approved and who may
415- test an artificial intelligence system under this chapter.
347+ (2) "Consumer" means a person who engages in
348+ transactions involving an artificial intelligence system or is
349+ directly affected by the use of such a system.
350+ (3) "Council" means the Artificial Intelligence
351+ Council established by Chapter 553.
352+ (4) "Department" means the Texas Department of
353+ Information Resources
354+ (5) "Program participant" means a person or business
355+ entity approved to participate in the sandbox program.
356+ (6) "Sandbox program" means the regulatory framework
357+ established under this chapter that allows temporary testing of
358+ artificial intelligence systems in a controlled, limited manner
359+ without full regulatory compliance.
416360 SUBCHAPTER B. SANDBOX PROGRAM FRAMEWORK
417- Sec. 553.051. ESTABLISHMENT OF SANDBOX PROGRAM. (a) The
418- department, in consultation with the council, shall create a
419- regulatory sandbox program that enables a person to obtain legal
420- protection and limited access to the market in this state to test
421- innovative artificial intelligence systems without obtaining a
422- license, registration, or other regulatory authorization.
423- (b) The program is designed to:
361+ Sec. 552.051. ESTABLISHMENT OF SANDBOX PROGRAM. (a) The
362+ department, in coordination with the council, shall administer the
363+ Artificial Intelligence Regulatory Sandbox Program to facilitate
364+ the development, testing, and deployment of innovative artificial
365+ intelligence systems in Texas.
366+ (b) The sandbox program is designed to:
424367 (1) promote the safe and innovative use of artificial
425- intelligence systems across various sectors including healthcare,
426- finance, education, and public services;
427- (2) encourage responsible deployment of artificial
428- intelligence systems while balancing the need for consumer
429- protection, privacy, and public safety;
430- (3) provide clear guidelines for a person who develops
431- an artificial intelligence system to test systems while certain
432- laws and regulations are waived or suspended; and
433- (4) allow a person to engage in research, training,
434- testing, or other pre-deployment activities to develop an
435- artificial intelligence system.
436- (c) The attorney general may not file or pursue charges
437- against a program participant for violation of a law or regulation
438- waived under this chapter that occurs during the testing period.
439- (d) A state agency may not file or pursue punitive action
440- against a program participant, including the imposition of a fine
441- or the suspension or revocation of a license, registration, or
442- other authorization, for violation of a law or regulation waived
443- under this chapter that occurs during the testing period.
444- (e) Notwithstanding Subsections (c) and (d), the
445- requirements of Subchapter B, Chapter 552, may not be waived, and
446- the attorney general or a state agency may file or pursue charges or
447- action against a program participant who violates that subchapter.
448- Sec. 553.052. APPLICATION FOR PROGRAM PARTICIPATION. (a)
449- A person must obtain approval from the department before testing an
450- artificial intelligence system under the program.
451- (b) The department by rule shall prescribe the application
452- form. The form must require the applicant to:
453- (1) provide a detailed description of the artificial
454- intelligence system the applicant desires to test in the program,
455- and its intended use;
456- (2) include a benefit assessment that addresses
457- potential impacts on consumers, privacy, and public safety;
458- (3) describe the applicant's plan for mitigating any
459- adverse consequences that may occur during the test; and
460- (4) provide proof of compliance with any applicable
461- federal artificial intelligence laws and regulations.
462- Sec. 553.053. DURATION AND SCOPE OF PARTICIPATION. (a) A
463- program participant approved by the department may test and deploy
464- an artificial intelligence system under the program for a period of
465- not more than 36 months.
466- (b) The department may extend a test under this chapter if
467- the department finds good cause for the test to continue.
368+ intelligence across various sectors including healthcare, finance,
369+ education, and public services;
370+ (2) encourage the responsible deployment of
371+ artificial intelligence systems while balancing the need for
372+ consumer protection, privacy, and public safety; and
373+ (3) provide clear guidelines for artificial
374+ intelligence developers to test systems while temporarily exempt
375+ from certain regulatory requirements.
376+ Sec. 552.052. APPLICATION PROCESS. (a) A person or
377+ business entity seeking to participate in the sandbox program must
378+ submit an application to the council.
379+ (b) The application must include:
380+ (1) a detailed description of the artificial
381+ intelligence system and its intended use;
382+ (2) a benefit assessment that addresses potential
383+ impacts on consumers, privacy, or public safety;
384+ (3) a plan for mitigating any adverse consequences
385+ during the testing phase; and
386+ (4) proof of compliance with federal artificial
387+ intelligence laws and regulations, where applicable.
388+ Sec. 552.053. DURATION AND SCOPE OF PARTICIPATION. A
389+ participant may test and deploy an artificial intelligence system
390+ under the sandbox program for a period of up to 36 months, unless
391+ extended by the department for good cause.
468392 SUBCHAPTER C. OVERSIGHT AND COMPLIANCE
469- Sec. 553.101. COORDINATION WITH APPLICABLE AGENCY. (a)
470- The department shall coordinate with all applicable agencies to
471- oversee the operation of a program participant.
472- (b) The council or an applicable agency may recommend to the
473- department that a program participant be removed from the program
474- if the applicable agency finds that the program participant's
475- artificial intelligence system:
476- (1) poses an undue risk to public safety or welfare;
477- (2) violates any federal law or regulation; or
478- (3) violates any state law or regulation not waived
479- under the program.
480- Sec. 553.102. PERIODIC REPORT BY PROGRAM PARTICIPANT. (a)
481- A program participant shall provide a quarterly report to the
482- department.
483- (b) The report shall include:
484- (1) metrics for the artificial intelligence system's
485- performance;
486- (2) updates on how the artificial intelligence system
487- mitigates any risks associated with its operation; and
393+ Sec. 552.101. AGENCY COORDINATION. (a) The department
394+ shall coordinate with all relevant state regulatory agencies to
395+ oversee the operations of the sandbox participants.
396+ (b) The council or a relevant agency may recommend to the
397+ department that a participant's sandbox privileges be revoked if
398+ the artificial intelligence system:
399+ (1) poses undue risk to public safety or welfare;
400+ (2) violates any federal or state laws that the
401+ sandbox program cannot override.
402+ Sec. 552.102. REPORTING REQUIREMENTS. (a) Each sandbox
403+ participant must submit quarterly reports to the department, which
404+ shall include:
405+ (1) system performance metrics;
406+ (2) updates on how the system mitigates any risks
407+ associated with its operation; and
488408 (3) feedback from consumers and affected stakeholders
489- that are using an artificial intelligence system tested under this
490- chapter.
491- (c) The department shall maintain confidentiality regarding
492- the intellectual property, trade secrets, and other sensitive
493- information it obtains through the program.
494- Sec. 553.103. ANNUAL REPORT BY DEPARTMENT. (a) The
495- department shall submit an annual report to the legislature.
496- (b) The report shall include:
497- (1) the number of program participants testing an
498- artificial intelligence system in the program;
409+ that are using a product that has been deployed from this section.
410+ (b) The department must submit an annual report to the
411+ legislature detailing:
412+ (1) the number of participants in the sandbox program;
499413 (2) the overall performance and impact of artificial
500- intelligence systems tested in the program; and
501- (3) recommendations on changes to laws or regulations
502- for future legislative consideration.
503- CHAPTER 554. TEXAS ARTIFICIAL INTELLIGENCE COUNCIL
414+ intelligence systems tested within the program; and
415+ (3) recommendations for future legislative or
416+ regulatory reforms.
417+ (c) The council shall maintain the confidentiality of the
418+ intellectual property, trade secrets, and other sensitive
419+ information of the sandbox.
420+ CHAPTER 553. TEXAS ARTIFICIAL INTELLIGENCE COUNCIL
504421 SUBCHAPTER A. CREATION AND ORGANIZATION OF COUNCIL
505- Sec. 554.001. CREATION OF COUNCIL. (a) The Texas
506- Artificial Intelligence Council is created to:
507- (1) ensure artificial intelligence systems in this
508- state are ethical and developed in the public's best interest;
509- (2) ensure artificial intelligence systems in this
510- state do not harm public safety or undermine individual freedoms by
511- finding issues and making recommendations to the legislature
512- regarding the Penal Code and Chapter 82, Civil Practice and
513- Remedies Code;
514- (3) identify existing laws and regulations that impede
515- innovation in the development of artificial intelligence systems
516- and recommend appropriate reforms;
517- (4) analyze opportunities to improve the efficiency
422+ Sec. 553.001. CREATION OF COUNCIL. (a) The Artificial
423+ Intelligence Council is administratively attached to the Texas
424+ Department of Information Resources, and the office shall provide
425+ administrative support to the council as provided by this section.
426+ (b) The office and the council shall enter into a memorandum
427+ of understanding detailing:
428+ (1) the administrative support the council requires
429+ from the office to fulfill the purposes of this chapter;
430+ (2) the reimbursement of administrative expenses to
431+ the office; and
432+ (3) any other provisions available by law to ensure
433+ the efficient operation of the council as attached to the office.
434+ (c) The purpose of the council is to:
435+ (1) ensure artificial intelligence systems are
436+ ethical and in the public's best interest and do not harm public
437+ safety or undermine individual freedoms by finding gaps in the
438+ Penal Code and Chapter 82, Civil Practice and Remedies Code and
439+ making recommendations to the Legislature.
440+ (2) identify existing laws and regulations that impede
441+ innovation in artificial intelligence development and recommend
442+ appropriate reforms;
443+ (3) analyze opportunities to improve the efficiency
518444 and effectiveness of state government operations through the use of
519- artificial intelligence systems;
520- (5) make recommendations to applicable state agencies
521- regarding the use of artificial intelligence systems to improve the
522- agencies' efficiency and effectiveness;
523- (6) investigate and evaluate potential instances of
445+ artificial intelligence systems and make recommendations to
446+ applicable state agencies regarding the use of artificial
447+ intelligence to improve the efficiency and effectiveness of agency
448+ operations;
449+ (4) investigate and evaluate potential instances of
524450 regulatory capture, including undue influence by technology
525- companies or disproportionate burdens on smaller innovators caused
526- by the use of artificial intelligence systems;
527- (7) investigate and evaluate the influence of
451+ companies or disproportionate burdens on smaller innovators
452+ through the use of artificial intelligence systems;
453+ (5) investigate and evaluate the influence of
528454 technology companies on other companies and determine the existence
529455 or use of tools or processes designed to censor competitors or users
530456 through the use of artificial intelligence systems;
531- (8) offer guidance and recommendations to the
532- legislature on the ethical and legal use of artificial intelligence
533- systems;
534- (9) conduct and publish the results of a study on the
535- current regulatory environment for artificial intelligence
536- systems;
537- (10) monitor the regulatory sandbox program under
538- Chapter 553 in coordination with the Texas Department of
539- Information Resources; and
540- (11) make recommendations for improvements to the
541- regulatory sandbox program under Chapter 553.
542- (b) The council is administratively attached to the Texas
543- Department of Information Resources, and the department shall
544- provide administrative support to the council as provided by this
545- section.
546- (c) The Texas Department of Information Resources and the
547- council shall enter into a memorandum of understanding detailing:
548- (1) the administrative support the council requires
549- from the department to fulfill the council's purposes;
550- (2) the reimbursement of administrative expenses to
551- the department; and
552- (3) any other provisions necessary to ensure the
553- efficient operation of the council.
554- Sec. 554.002. COUNCIL MEMBERSHIP. (a) The council is
457+ (6) offer guidance and recommendations to the state
458+ legislature on the ethical and legal use of artificial
459+ intelligence;
460+ (7) conduct and publish a study of the current
461+ artificial intelligence regulatory environment; and
462+ (8) in coordination with the Department of Information
463+ Resources, monitor the Artificial Intelligence Regulatory Sandbox
464+ Program established under Chapter 552 and make recommendations for
465+ improvements to the program.
466+ Sec. 553.002. COUNCIL MEMBERSHIP. (a) The council is
555467 composed of 10 members as follows:
556468 (1) four members of the public appointed by the
557469 governor;
558470 (2) two members of the public appointed by the
559471 lieutenant governor;
560472 (3) two members of the public appointed by the speaker
561473 of the house of representatives;
562474 (4) one senator appointed by the lieutenant governor
563475 as a nonvoting member; and
564476 (5) one member of the house of representatives
565477 appointed by the speaker of the house of representatives as a
566478 nonvoting member.
567479 (b) Voting members of the council serve staggered four-year
568480 terms, with the terms of four members expiring every two years.
569481 (c) The governor shall appoint a chair from among the
570482 members, and the council shall elect a vice chair from its
571483 membership.
572484 (d) The council may establish an advisory board composed of
573485 individuals from the public who possess expertise directly related
574486 to the council's functions, including technical, ethical,
575487 regulatory, and other relevant areas.
576- Sec. 554.003. QUALIFICATIONS. Members of the council must
577- be Texas residents and have knowledge or expertise in one or more of
578- the following areas:
579- (1) artificial intelligence systems;
488+ Sec. 553.003. QUALIFICATIONS. (a) Members of the council
489+ must be Texas residents and have knowledge or expertise in one or
490+ more of the following areas:
491+ (1) artificial intelligence technologies;
580492 (2) data privacy and security;
581493 (3) ethics in technology or law;
582494 (4) public policy and regulation;
583495 (5) risk management related to artificial
584496 intelligence systems;
585- (6) improving the efficiency and effectiveness of
586- governmental operations; or
587- (7) anticompetitive practices and market fairness.
588- Sec. 554.004. STAFF AND ADMINISTRATION. The council may
589- hire an executive director and other personnel as necessary to
590- perform its duties.
591- SUBCHAPTER B. POWERS AND DUTIES OF COUNCIL
592- Sec. 554.101. ISSUANCE OF REPORTS. (a) The council may
593- issue reports to the legislature regarding the use of artificial
594- intelligence systems in this state.
595- (b) The council may issue reports on:
497+ (6) expertise in improving the efficiency and
498+ effectiveness of government operations; or
499+ (7) expertise in anti-competitive practices and
500+ market fairness.
501+ Sec. 553.004. STAFF AND ADMINISTRATION. (a) The council
502+ may employ an executive director and other personnel as necessary
503+ to perform its duties.
504+ (b) The council, its administration, and its staff must not
505+ account for more than 4% of the budget of the department of
506+ information resources.
507+ SUBCHAPTER B. POWERS AND DUTIES OF THE COUNCIL
508+ Sec. 553.101. ISSUANCE OF ADVISORY REPORTS. (a) The
509+ council may issue reports to the state legislature regarding the
510+ use of artificial intelligence systems in the state.
511+ (b) The council may issue reports on state use of artificial
512+ intelligence systems regarding:
596513 (1) the compliance of artificial intelligence systems
597- in this state with the laws of this state;
598- (2) the ethical implications of deploying artificial
599- intelligence systems in this state;
514+ with Texas law;
515+ (2) the ethical implications of artificial
516+ intelligence deployments in the state;
600517 (3) data privacy and security concerns related to
601- artificial intelligence systems in this state; or
518+ artificial intelligence systems; or
602519 (4) potential liability or legal risks associated with
603- the use of artificial intelligence systems in this state.
604- Sec. 554.102. TRAINING AND EDUCATIONAL OUTREACH. The
520+ the use of AI.
521+ Sec. 553.102. TRAINING AND EDUCATIONAL OUTREACH. The
605522 council shall conduct training programs for state agencies and
606523 local governments on the use of artificial intelligence systems.
607- Sec. 554.103. LIMITATION OF AUTHORITY. The council may
524+ Sec. 553.103. LIMITATION OF AUTHORITY. (a) The council may
608525 not:
609- (1) adopt rules or promulgate guidance that is binding
610- for any entity;
611- (2) interfere with or override the operation of a
612- state agency; or
613- (3) perform a duty or exercise a power not granted by
614- this chapter.
526+ (1) Promulgate rules, regulations, binding guidance, or
527+ anything construed as regulations or guidance on any entity or
528+ agency; or
529+ (2) Interfere with or override state agency operations.
530+ (b) The council's duties are limited to providing evaluations,
531+ SECTION 3. Section 503.001, Business & Commerce Code is
532+ amended by adding Subsection (c-3) to read as follows:
533+ (c-3) This section does not apply to the training,
534+ processing, or storage of biometric identifiers involved in
535+ artificial intelligence systems, as defined by Section 551.001,
536+ unless performed for the purpose of uniquely identifying a specific
537+ individual. If a biometric identifier captured for the purpose of
538+ training an artificial intelligence system is subsequently used for
539+ a commercial purpose, the person possessing the biometric
540+ identifier is subject to this section's provisions for the
541+ possession and destruction of a biometric identifier and the
542+ associated penalties.
543+ SECTION 4. Sec.541.104(a), Business & Commerce Code is
544+ amended to read as follows:
545+ Sec. 541.104. DUTIES OF PROCESSOR. (a) A processor shall
546+ adhere to the instructions of a controller and shall assist the
547+ controller in meeting or complying with the controller's duties or
548+ requirements under this chapter, including:
549+ (1) assisting the controller in responding to consumer
550+ rights requests submitted under Section 541.051 by using
551+ appropriate technical and organizational measures, as reasonably
552+ practicable, taking into account the nature of processing and the
553+ information available to the processor;
554+ (2) assisting the controller with regard to complying
555+ with the [requirement]requirements relating to the security of
556+ processing personal data, and if applicable, the data collected,
557+ stored, and processed by artificial intelligence systems and to the
558+ notification of a breach of security of the processor's system
559+ under Chapter 521, taking into account the nature of processing and
560+ the information available to the processor; and
561+ (3) providing necessary information to enable the
562+ controller to conduct and document data protection assessments
563+ under Section 541.105.
615564 SECTION 5. Section 325.011, Government Code, is amended to
616565 read as follows:
617566 Sec. 325.011. CRITERIA FOR REVIEW. The commission and its
618567 staff shall consider the following criteria in determining whether
619568 a public need exists for the continuation of a state agency or its
620569 advisory committees or for the performance of the functions of the
621570 agency or its advisory committees:
622571 (1) the efficiency and effectiveness with which the
623572 agency or the advisory committee operates;
624573 (2)(A) an identification of the mission, goals, and
625574 objectives intended for the agency or advisory committee and of the
626575 problem or need that the agency or advisory committee was intended
627576 to address; and
628577 (B) the extent to which the mission, goals, and
629578 objectives have been achieved and the problem or need has been
630579 addressed;
631580 (3)(A) an identification of any activities of the
632581 agency in addition to those granted by statute and of the authority
633582 for those activities; and
634583 (B) the extent to which those activities are
635584 needed;
636585 (4) an assessment of authority of the agency relating
637586 to fees, inspections, enforcement, and penalties;
638587 (5) whether less restrictive or alternative methods of
639588 performing any function that the agency performs could adequately
640589 protect or provide service to the public;
641590 (6) the extent to which the jurisdiction of the agency
642591 and the programs administered by the agency overlap or duplicate
643592 those of other agencies, the extent to which the agency coordinates
644593 with those agencies, and the extent to which the programs
645594 administered by the agency can be consolidated with the programs of
646595 other state agencies;
647596 (7) the promptness and effectiveness with which the
648597 agency addresses complaints concerning entities or other persons
649598 affected by the agency, including an assessment of the agency's
650599 administrative hearings process;
651600 (8) an assessment of the agency's rulemaking process
652601 and the extent to which the agency has encouraged participation by
653602 the public in making its rules and decisions and the extent to which
654603 the public participation has resulted in rules that benefit the
655604 public;
656605 (9) the extent to which the agency has complied with:
657606 (A) federal and state laws and applicable rules
658607 regarding equality of employment opportunity and the rights and
659608 privacy of individuals; and
660609 (B) state law and applicable rules of any state
661610 agency regarding purchasing guidelines and programs for
662611 historically underutilized businesses;
663612 (10) the extent to which the agency issues and
664613 enforces rules relating to potential conflicts of interest of its
665614 employees;
666615 (11) the extent to which the agency complies with
667616 Chapters 551 and 552 and follows records management practices that
668617 enable the agency to respond efficiently to requests for public
669618 information;
670619 (12) the effect of federal intervention or loss of
671620 federal funds if the agency is abolished;
672621 (13) the extent to which the purpose and effectiveness
673622 of reporting requirements imposed on the agency justifies the
674623 continuation of the requirement; [and]
675624 (14) an assessment of the agency's cybersecurity
676625 practices using confidential information available from the
677626 Department of Information Resources or any other appropriate state
678627 agency; and
679- (15) an assessment of the agency's use of artificial
680- intelligence systems, as that term is defined by Section 551.001,
681- Business & Commerce Code, in its operations and its oversight of the
682- use of artificial intelligence systems by persons under the
683- agency's jurisdiction, and any related impact on the agency's
684- ability to achieve its mission, goals, and objectives, made using
685- information available from the Department of Information
686- Resources, the attorney general, or any other appropriate state
687- agency.
628+ (15) an assessment, using information available from
629+ the Department of Information Resources, the Attorney General, or
630+ any other appropriate state agency, of the agency's use of
631+ artificial intelligence systems in its operations and its oversight
632+ of the use of artificial intelligence systems by entities or
633+ persons under the agency's jurisdiction, and any related impact on
634+ the agency's ability to achieve its mission, goals, and objectives.
688635 SECTION 6. Section 2054.068(b), Government Code, is amended
689636 to read as follows:
690637 (b) The department shall collect from each state agency
691638 information on the status and condition of the agency's information
692639 technology infrastructure, including information regarding:
693640 (1) the agency's information security program;
694641 (2) an inventory of the agency's servers, mainframes,
695642 cloud services, and other information technology equipment;
696643 (3) identification of vendors that operate and manage
697644 the agency's information technology infrastructure; [and]
698645 (4) any additional related information requested by
699646 the department; and
700- (5) an evaluation of the use or considered use of
701- artificial intelligence systems, as defined by Section 551.001,
702- Business & Commerce Code, by each state agency.
647+ (5) an evaluation of the use, or considered use, of
648+ artificial intelligence systems by each state agency.
703649 SECTION 7. Section 2054.0965(b), Government Code, is
704650 amended to read as follows:
651+ Sec. 2054.0965. INFORMATION RESOURCES DEPLOYMENT REVIEW.
705652 (b) Except as otherwise modified by rules adopted by the
706653 department, the review must include:
707654 (1) an inventory of the agency's major information
708655 systems, as defined by Section 2054.008, and other operational or
709656 logistical components related to deployment of information
710657 resources as prescribed by the department;
711658 (2) an inventory of the agency's major databases,
712- artificial intelligence systems, as defined by Section 551.001,
713- Business & Commerce Code, and applications;
659+ artificial intelligence systems, and applications;
714660 (3) a description of the agency's existing and planned
715661 telecommunications network configuration;
716662 (4) an analysis of how information systems,
717663 components, databases, applications, and other information
718664 resources have been deployed by the agency in support of:
719665 (A) applicable achievement goals established
720666 under Section 2056.006 and the state strategic plan adopted under
721667 Section 2056.009;
722668 (B) the state strategic plan for information
723669 resources; and
724670 (C) the agency's business objectives, mission,
725671 and goals;
726672 (5) agency information necessary to support the state
727673 goals for interoperability and reuse; and
728674 (6) confirmation by the agency of compliance with
729675 state statutes, rules, and standards relating to information
730676 resources.
731677 SECTION 8. Not later than September 1, 2026, the attorney
732678 general shall post on the attorney general's Internet website the
733- information and online mechanism required by Section 552.102,
734- Business & Commerce Code, as added by this Act.
679+ online mechanism required by Section 551.041, Business & Commerce
680+ Code, as added by this Act.
735681 SECTION 9. This Act takes effect January 1, 2026.