TX
Texas Senate Bill SB1964

Texas 2025 - 89th Regular

Texas Senate Bill SB1964 Compare Versions

Only one version of the bill is available at this time.
OldNewDifferences
11 By: Parker S.B. No. 1964
22
33
44
55
66 A BILL TO BE ENTITLED
77 AN ACT
88 relating to the regulation and use of artificial intelligence
99 systems and the management of data by governmental entities.
1010 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
1111 SECTION 1. Section 2054.003, Government Code, is amended by
1212 adding Subdivisions (1-a), (2-b), (6-a), and (6-b) to read as
1313 follows:
1414 (1-a) "Artificial intelligence system" means a
1515 machine-based system that, for explicit or implicit objectives,
1616 infers, from the input it receives, how to generate outputs such as
1717 predictions, content, recommendations, or decisions that can
1818 influence physical or virtual environment. Different artificial
1919 intelligence systems vary in their levels of autonomy and
2020 adaptiveness after deployment.
2121 (2-b) "Controlling factor" means a factor that is:
2222 (i) the principal basis for making any
2323 decision that has a material legal or similarly significant effect
2424 on the provision, denial, or conditions of a person's access to a
2525 government service;
2626 (ii) capable of altering the outcome of a
2727 any decision that has a material legal or similarly significant
2828 effect on the provision, denial, or conditions of a person's access
2929 to a government service; and
3030 (iii) is generated by an artificial
3131 intelligence system.
3232 (6-a) "Heightened scrutiny artificial intelligence
3333 system" means an artificial intelligence system that is
3434 specifically intended to autonomously make, or be a substantial
3535 controlling factor in making, any decision that has a material
3636 legal or similarly significant effect on the provision, denial, or
3737 conditions of a person's access to a government service. The term
3838 does not include an artificial intelligence system intended to:
3939 (i) perform any narrow procedural task;
4040 (ii) improve the result of a previously
4141 completed human activity;
4242 (iii) perform a preparatory task to an
4343 assessment relevant to a any decision that has a material legal or
4444 similarly significant effect on the provision, denial, or
4545 conditions of a person's access to a government service; or
4646 (iv) detect decision-making patterns or
4747 deviations from previous decision-making patterns
4848 (6-b) "Principal basis" means the use of an output of a
4949 heightened scrutiny artificial intelligence system to make a
5050 decision without:
5151 (A) human review, oversight, involvement, or
5252 intervention; or
5353 (B) meaningful consideration by a human.
5454 SECTION 2. Section 2054.068(b), Government Code, is amended
5555 to read as follows:
5656 (b) The department shall collect from each state agency
5757 information on the status and condition of the agency's information
5858 technology infrastructure, including information regarding:
5959 (1) the agency's information security program;
6060 (2) an inventory of the agency's servers, mainframes,
6161 cloud services, artificial intelligence systems, including
6262 heightened scrutiny artificial intelligence systems, and other
6363 information technology equipment;
6464 (3) identification of vendors that operate and manage
6565 the agency's information technology infrastructure; and
6666 (4) any additional related information requested by
6767 the department.
6868 SECTION 3. Section 2054.0965, Government Code, is amended
6969 by amending Subsection (b) and adding Subsection (c) to read as
7070 follows:
7171 (b) Except as otherwise modified by rules adopted by the
7272 department, the review must include:
7373 (1) an inventory of the agency's major information
7474 systems, as defined by Section 2054.008, and other operational or
7575 logistical components related to deployment of information
7676 resources as prescribed by the department;
7777 (2) an inventory of the agency's major databases and
7878 applications;
7979 (3) a description of the agency's existing and planned
8080 telecommunications network configuration;
8181 (4) an analysis of how information systems,
8282 components, databases, applications, and other information
8383 resources have been deployed by the agency in support of:
8484 (A) applicable achievement goals established
8585 under Section 2056.006 and the state strategic plan adopted under
8686 Section 2056.009;
8787 (B) the state strategic plan for information
8888 resources; and
8989 (C) the agency's business objectives, mission,
9090 and goals;
9191 (5) agency information necessary to support the state
9292 goals for interoperability and reuse; [and]
9393 (6) an inventory and identification of the artificial
9494 intelligence systems and heightened scrutiny artificial
9595 intelligence systems deployed by the agency, including an
9696 evaluation of the purpose of and risk mitigation measures for each
9797 system and an analysis of how each system supports the agency's
9898 strategic plan under Subchapter E; and
9999 (7) confirmation by the agency of compliance with
100100 state statutes, rules, and standards relating to information
101101 resources and artificial intelligence systems, including the
102102 artificial intelligence system code of ethics developed under
103103 Section 2054.702, and minimum standards developed under Section
104104 2054.703.
105105 (c) Local governments shall complete a review of the
106106 deployment and use of a heightened scrutiny artificial
107107 intelligence system and provide the review to the department, in a
108108 manner described by the department.
109109 SECTION 4. Section 2054.137, Government Code, is amended by
110110 adding Subsection (a-1) and amending Subsection (c) to read as
111111 follows:
112112 (a-1) A state agency with 150 or fewer full-time employees
113113 may:
114114 (1) designate a full-time employee of the agency to
115115 serve as a data management officer; or
116116 (2) enter into an agreement with another state agency
117117 or agencies to jointly employ a data management officer if approved
118118 by the department.
119119 (c) In accordance with department guidelines, the data
120120 management officer for a state agency shall annually post on the
121121 Texas Open Data Portal established by the department under Section
122122 2054.070 at least three high-value data sets as defined by Section
123123 2054.1265. The high-value data sets may not include information
124124 that is confidential or protected from disclosure under state or
125125 federal law.
126126 SECTION 5. Chapter 2054, Government Code, is amended by
127127 adding Subchapter S to read as follows:
128128 SUBCHAPTER S. ARTIFICIAL INTELLIGENCE
129129 Sec. 2054.701. DEFINITION. In this subchapter, "unlawful
130130 harm" means any condition in which the use of an artificial
131131 intelligence system results in any decision that has a material
132132 legal or similarly significant effect on an individual who is a
133133 member of a state or federally protected class's denial, or
134134 conditions of a government service in violation of law. The term
135135 does not include a developer's or deployer's offer, license, or use
136136 of a heightened scrutiny artificial intelligence system for the
137137 sole purpose of testing the system before deployment to identify,
138138 mitigate, or otherwise ensure compliance with state and federal
139139 law.
140140 Sec. 2054.702. ARTIFICIAL INTELLIGENCE SYSTEM CODE OF
141141 ETHICS. (a) The department by rule shall establish an artificial
142142 intelligence system code of ethics for use by state agencies and
143143 local governments that procure, develop, deploy, or use a
144144 heightened scrutiny artificial intelligence system.
145145 (b) At a minimum, the artificial intelligence system code of
146146 ethics must include the following principles for state agencies to
147147 guide the adoption of heightened scrutiny artificial intelligence
148148 systems and that align with the National Institute of Standards and
149149 Technology's Artificial Intelligence Risk Management Framework on:
150150 (1) Human oversight and control;
151151 (2) Fairness and Accuracy;
152152 (3) Transparency;
153153 (4) Consumer disclosures;
154154 (5) Data privacy and security;
155155 (6) Accountability and liability;
156156 (7) Continuous evaluation and improvement;
157157 (8) Public redress.
158158 Sec. 2054.703. MINIMUM STANDARDS FOR HEIGHTENED SCRUTINY
159159 ARTIFICIAL INTELLIGENCE SYSTEMS. (a) The department by rule shall
160160 develop minimum risk management and governance standards for the
161161 development, procurement, deployment, and use of heightened
162162 scrutiny artificial intelligence systems by a state agency or
163163 local government.
164164 (b) The minimum standards must be consistent with the
165165 Artificial Intelligence Risk Management Framework (AI RMF 1.0)
166166 published by the National Institute of Standards and Technology and
167167 must:
168168 (1) establish accountability measures, such as
169169 required reports describing the use of, limitations of, and
170170 safeguards for the heightened scrutiny artificial intelligence
171171 system;
172172 (2) require the assessment and documentation of the
173173 heightened scrutiny artificial intelligence system's known
174174 security risks, performance metrics, and transparency measures:
175175 (A) before deploying the system;
176176 and
177177 (C) at the time any material change is made to:
178178 (i) the system;
179179 (ii) the state or local data used by the
180180 system; or
181181 (iii) the intended use of the system;
182182 (3) provide resources to local governments to advise
183183 on the management of heightened scrutiny artificial intelligence
184184 system procurement and deployment, data protection measures, and
185185 employee training; and
186186 (4) establish guidelines for:
187187 (A) risk management frameworks, acceptable use
188188 policies, and training employees; and
189189 (B) mitigating the risk of unlawful harm by
190190 contractually requiring third party vendors to implement risk
191191 management system frameworks when deploying heightened scrutiny
192192 artificial intelligence systems on behalf of state agencies or
193193 local governments.
194194 (c) State agencies and local governments shall both adopt
195195 the code of ethics developed under Section 2054.702 and the
196196 standards developed under Subsection (b).
197197 Sec. 2054.704. EDUCATIONAL OUTREACH PROGRAM. (a) The
198198 department shall develop educational materials on artificial
199199 intelligence systems to promote the responsible use of the systems
200200 and awareness of the risks and benefits of system use, explain
201201 consumer rights in relation to the systems, and describe risk
202202 mitigation techniques.
203203 (b) The department shall develop training materials for
204204 state and local government employees and the general public. The
205205 training materials must be made available on the department's
206206 public Internet website.
207207 (c) The department shall host statewide forums and training
208208 sessions on artificial intelligence systems best practices for
209209 state and local government employees.
210210 (d) The department may:
211211 (1) use money appropriated to the department to
212212 produce materials required by this section; and
213213 (2) contract with a vendor to produce those materials.
214214 Sec. 2054.705. PUBLIC SECTOR ARTIFICIAL INTELLIGENCE
215215 SYSTEMS ADVISORY BOARD. (a) A public sector artificial
216216 intelligence systems advisory board is established to assist state
217217 agencies in the development, deployment, and use of artificial
218218 intelligence systems.
219219 (b) The advisory board shall obtain and disseminate
220220 information on artificial intelligence systems, including use
221221 cases, policies, and guidelines, facilitate shared resources
222222 between state agencies, and consult with the department on
223223 artificial intelligence systems issues.
224224 (c) The department shall provide administrative support for
225225 the advisory board.
226226 (d) The advisory board is composed of eight members as
227227 follows:
228228 (1) six members representing state agencies,
229229 including one member representing an agency with fewer than 150
230230 employees, appointed by the governor; and
231231 (2) two public members, appointed by the governor or
232232 the governor's designee, with technology expertise.
233233 (e) Advisory board members serve two-year terms. Advisory
234234 board members may be reappointed.
235235 (f) Advisory board members are not entitled to compensation
236236 or reimbursement of expenses for service on the advisory board.
237237 (g) The advisory board shall direct state agencies to:
238238 (1) Identify opportunities to implement AI solutions
239239 that reduce administrative burdens;
240240 (2) Recommend the elimination of regulations that
241241 unnecessarily restrict AI innovation; and
242242 (3) Identify opportunities to streamline procurement
243243 processes to enable AI adoption.
244244 Sec. 2054.706. ARTIFICIAL INTELLIGENCE SYSTEM SANDBOX
245245 PROGRAM. (a) In this section:
246246 (1) "Eligible entity" means an eligible customer under
247247 Section 2054.0525.
248248 (2) "Program" means the program established by this
249249 section that is designed to allow temporary testing of an
250250 artificial intelligence system in a controlled, limited manner
251251 without requiring full compliance with otherwise applicable
252252 regulations.
253253 (3) "Vendor" means a person registered with the
254254 department as a contractor to provide commodity items under Section
255255 2157.068.
256256 (b) The department shall establish and administer a program
257257 to support eligible entities in contracting with vendors to engage
258258 in research, development, training, testing, and other
259259 pre-deployment activities related to artificial intelligence
260260 systems to effectively, efficiently, and securely assist the entity
261261 in accomplishing its public purposes.
262262 (c) The department shall create an application process for
263263 vendors to apply to participate in the program. The application
264264 process must include:
265265 (1) a detailed description of the artificial
266266 intelligence system proposed for participation in the program and
267267 the system's intended use;
268268 (2) a risk-assessment of the system that addresses
269269 potential impacts on the public; and
270270 (3) a plan for mitigating any adverse consequences
271271 discovered during the system's testing phase.
272272 (d) A vendor participating in the program shall, with
273273 oversight by the department, provide eligible entities with secure
274274 access to an artificial intelligence system used in the program.
275275 (e) The department shall provide to vendors and eligible
276276 entities participating in the program detailed guidelines
277277 regarding the exemption from compliance with otherwise applicable
278278 regulations provided by the program.
279279 (f) The eligible entities and vendors shall submit
280280 quarterly reports to the department that include:
281281 (1) performance measures for the artificial
282282 intelligence system;
283283 (2) risk mitigation strategies implemented during
284284 system testing;
285285 (3) feedback on program effectiveness and efficiency;
286286 and
287287 (4) any additional information the department
288288 requests.
289289 (g) Not later than November 30 of each even-numbered year,
290290 the department shall produce an annual report and submit the report
291291 to the legislature summarizing:
292292 (1) the number of eligible entities and vendors
293293 participating in the program and the program outcomes; and
294294 (2) recommendations for legislative or other action.
295295 (h) Notwithstanding Section 2054.383, the department may
296296 operate the program as a statewide technology center under
297297 Subchapter L.
298298 Sec. 2054.707. DISCLOSURE REQUIREMENTS. (a) A state
299299 agency that procures, develops, deploys, or uses an artificial
300300 intelligence system shall provide clear disclosure of the system to
301301 the public as provided by the artificial intelligence system code
302302 of ethics established under Section 2054.702.
303303 (b) A vendor contracting with a state agency to deploy or
304304 operate an artificial intelligence system must also provide the
305305 disclosure required under Subsection (a).
306306 Sec. 2054.708. IMPACT ASSESSMENTS. (a) A state agency that
307307 deploys or uses an artificial intelligence system or a vendor that
308308 contracts with a state agency for the deployment or use of a system
309309 shall conduct a semiannual system assessment that outlines:
310310 (1) risks of unlawful harm;
311311 (2) system limitations; and
312312 (3) information governance practices;
313313 (b) The state agency or vendor shall submit make available a
314314 copy of the assessment to the department upon request.
315315 (c) The impact assessments created under this section are
316316 confidential and not subject to disclosure under Chapter 552. The
317317 state agency or department may redact or withhold the information
318318 as confidential under Chapter 552 without requesting a decision
319319 from the attorney general under Subchapter G, Chapter 552.
320320 (d) The Department shall take all necessary steps to ensure
321321 the confidentiality of Submitted Information, including but not
322322 limited to, restricting access to submitted information to
323323 authorized personnel only and implementing physical, electronic,
324324 and procedural safeguards to protect submitted information.
325325 Sec. 2054.710. ENFORCEMENT. (a) If a state agency or
326326 vendor is made aware that a violation of this subchapter has
327327 occurred, the agency or vendor shall report the violation to the
328328 department, if applicable, and the attorney general.
329329 (b) The attorney general shall:
330330 (1) review a report submitted under this section or a
331331 complaint reported through the webpage established under Section
332332 2054.711; and
333333 (2) determine whether to bring an action to enjoin a
334334 violation of this subchapter.
335335 (c) If the attorney general determines that a vendor
336336 violated this subchapter, the attorney general shall provide the
337337 vendor with a written notice of the violation. The vendor shall have
338338 30 days from the date of the notice to cure the violation.
339339 (d) If the vendor fails to cure the violation within the
340340 30-day period specific in subsection (c), the state agency may void
341341 the contract without further obligation to the vendor. The state
342342 agency shall provide the vendor with a 30-day notice of its intent
343343 to void the contract, during which time the vendor may address any
344344 remaining issues to the satisfaction of the state agency.
345345 (e) If the vendor does not satisfactorily address the issues
346346 within the 30-day notice period specified in subsection (d), the
347347 state agency may void the contract without further obligation to
348348 the vendor.
349349 (d) If the department determines that a vendor has had more
350350 than one contract voided under Subsection (c), the department shall
351351 refer the matter to the comptroller. Using procedures prescribed
352352 by Section 2155.077, the comptroller may bar the vendor from
353353 participating in a state agency contract.
354354 Sec. 2054.711. ARTIFICIAL INTELLIGENCE SYSTEM COMPLAINT
355355 WEBPAGE. (a) The attorney general shall, in collaboration with the
356356 department, establish a webpage on the attorney general's Internet
357357 website that allows a person to report a complaint relating to
358358 artificial intelligence systems, including:
359359 (1) instances of an artificial intelligence system
360360 allegedly unlawfully infringing on the person's constitutional
361361 rights or financial livelihood; or
362362 (2) the use of an artificial intelligence system that
363363 allegedly results in unlawful harm.
364364 (b) A complaint submitted on the webpage created under
365365 Subsection (a) must be distributed to the department.
366366 (c) A person who submits a complaint on the webpage created
367367 under Subsection (a) may request from the department an explanation
368368 as provided by Section 2054.702(b)(1)(D).
369369 (d) The attorney general shall post on the attorney
370370 general's Internet website information that:
371371 (1) educates persons regarding the risks and benefits
372372 of artificial intelligence systems; and
373373 (2) explains a person's rights in relation to
374374 artificial intelligence systems.
375375 (e) Not later than November 30 of each even-numbered year,
376376 the attorney general shall submit to the legislature a report
377377 summarizing the complaints received under this section, the
378378 resolutions of the complaints, and any enforcement actions taken.
379379 Sec. 2054.712. STANDARDIZED NOTICE. (a) Each state agency
380380 and local government that deploys or uses an artificial
381381 intelligence system that the public directly accesses or that is a
382382 controlling factor in a any decision that has a material legal or
383383 similarly significant effect on the provision, denial, or
384384 conditions of a person's access to a government service shall
385385 include a standardized notice on all related applications, Internet
386386 websites, and public computer systems.
387387 (b) The department shall develop a form that agencies must
388388 use for the notice required under Subsection (a). The form must
389389 include:
390390 (1) general information about the system;
391391 (2) information about the data sources the system
392392 uses; and
393393 (3) measures taken to maintain compliance with
394394 information privacy laws and ethics standards.
395395 Sec. 2054.713. RULES. The department shall adopt rules to
396396 implement this subchapter.
397397 SECTION 6. (a) As soon as practicable after the effective
398398 date of this Act, the Department of Information Resources shall:
399399 (1) adopt rules necessary to implement Subchapter S,
400400 Chapter 2054, Government Code, as added by this Act; and
401401 (2) develop the outreach program and form required by
402402 Sections 2054.704 and 2054.712, Government Code, as added by this
403403 Act.
404404 (b) As soon as practicable after the effective date of this
405405 Act, the office of the attorney general shall establish the webpage
406406 as required by Section 2054.711, Government Code, as added by this
407407 Act.
408408 SECTION 7. This Act takes effect September 1, 2025.