By: Parker S.B. No. 1964               A BILL TO BE ENTITLED   AN ACT   relating to the regulation and use of artificial intelligence   systems and the management of data by governmental entities.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  Section 2054.003, Government Code, is amended by   adding Subdivisions (1-a), (2-b), (6-a), and (6-b) to read as   follows:                (1-a)  "Artificial intelligence system" means a   machine-based system that, for explicit or implicit objectives,   infers, from the input it receives, how to generate outputs such as   predictions, content, recommendations, or decisions that can   influence physical or virtual environment. Different artificial   intelligence systems vary in their levels of autonomy and   adaptiveness after deployment.                (2-b) "Controlling factor" means a factor that is:                             (i)  the principal basis for making any   decision that has a material legal or similarly significant effect   on the provision, denial, or conditions of a person's access to a   government service;                             (ii)  capable of altering the outcome of a   any decision that has a material legal or similarly significant   effect on the provision, denial, or conditions of a person's access   to a government service; and                             (iii)  is generated by an artificial   intelligence system.                (6-a)  "Heightened scrutiny artificial intelligence   system" means an artificial intelligence system that is   specifically intended to autonomously make, or be a substantial   controlling factor in making, any decision that has a material   legal or similarly significant effect on the provision, denial, or   conditions of a person's access to a government service. The term   does not include an artificial intelligence system intended to:                            (i)  perform any narrow procedural task;                            (ii)  improve the result of a previously   completed human activity;                            (iii)  perform a preparatory task to an   assessment relevant to a any decision that has a material legal or   similarly significant effect on the provision, denial, or   conditions of a person's access to a government service; or                            (iv)  detect decision-making patterns or   deviations from previous decision-making patterns          (6-b) "Principal basis" means the use of an output of a   heightened scrutiny artificial intelligence system to make a   decision without:                       (A)  human review, oversight, involvement, or   intervention; or                       (B)  meaningful consideration by a human.          SECTION 2.  Section 2054.068(b), Government Code, is amended   to read as follows:          (b)  The department shall collect from each state agency   information on the status and condition of the agency's information   technology infrastructure, including information regarding:                (1)  the agency's information security program;                (2)  an inventory of the agency's servers, mainframes,   cloud services, artificial intelligence systems, including   heightened scrutiny artificial intelligence systems, and other   information technology equipment;                (3)  identification of vendors that operate and manage   the agency's information technology infrastructure; and                (4)  any additional related information requested by   the department.          SECTION 3.  Section 2054.0965, Government Code, is amended   by amending Subsection (b) and adding Subsection (c) to read as   follows:          (b)  Except as otherwise modified by rules adopted by the   department, the review must include:                (1)  an inventory of the agency's major information   systems, as defined by Section 2054.008, and other operational or   logistical components related to deployment of information   resources as prescribed by the department;                (2)  an inventory of the agency's major databases and   applications;                (3)  a description of the agency's existing and planned   telecommunications network configuration;                (4)  an analysis of how information systems,   components, databases, applications, and other information   resources have been deployed by the agency in support of:                      (A)  applicable achievement goals established   under Section 2056.006 and the state strategic plan adopted under   Section 2056.009;                      (B)  the state strategic plan for information   resources; and                      (C)  the agency's business objectives, mission,   and goals;                (5)  agency information necessary to support the state   goals for interoperability and reuse; [and]                (6)  an inventory and identification of the artificial   intelligence systems and heightened scrutiny artificial   intelligence systems deployed by the agency, including an   evaluation of the purpose of and risk mitigation measures for each   system and an analysis of how each system supports the agency's   strategic plan under Subchapter E; and                (7)  confirmation by the agency of compliance with   state statutes, rules, and standards relating to information   resources and artificial intelligence systems, including the   artificial intelligence system code of ethics developed under   Section 2054.702, and minimum standards developed under Section   2054.703.          (c)  Local governments shall complete a review of the   deployment and use of a heightened scrutiny artificial   intelligence system and provide the review to the department, in a   manner described by the department.          SECTION 4.  Section 2054.137, Government Code, is amended by   adding Subsection (a-1) and amending Subsection (c) to read as   follows:          (a-1)  A state agency with 150 or fewer full-time employees   may:                (1)  designate a full-time employee of the agency to   serve as a data management officer; or                (2)  enter into an agreement with another state agency   or agencies to jointly employ a data management officer if approved   by the department.          (c)  In accordance with department guidelines, the data   management officer for a state agency shall annually post on the   Texas Open Data Portal established by the department under Section   2054.070 at least three high-value data sets as defined by Section   2054.1265. The high-value data sets may not include information   that is confidential or protected from disclosure under state or   federal law.          SECTION 5.  Chapter 2054, Government Code, is amended by   adding Subchapter S to read as follows:   SUBCHAPTER S. ARTIFICIAL INTELLIGENCE          Sec. 2054.701.  DEFINITION. In this subchapter, "unlawful   harm" means any condition in which the use of an artificial   intelligence system results in any decision that has a material   legal or similarly significant effect on an individual who is a   member of a state or federally protected class's denial, or   conditions of a government service in violation of law. The term   does not include a developer's or deployer's offer, license, or use   of a heightened scrutiny artificial intelligence system for the   sole purpose of testing the system before deployment to identify,   mitigate, or otherwise ensure compliance with state and federal   law.          Sec. 2054.702.  ARTIFICIAL INTELLIGENCE SYSTEM CODE OF   ETHICS. (a) The department by rule shall establish an artificial   intelligence system code of ethics for use by state agencies and   local governments that procure, develop, deploy, or use a   heightened scrutiny artificial intelligence system.          (b)  At a minimum, the artificial intelligence system code of   ethics must include the following principles for state agencies to   guide the adoption of heightened scrutiny artificial intelligence   systems and that align with the National Institute of Standards and   Technology's Artificial Intelligence Risk Management Framework on:                (1)  Human oversight and control;                (2)  Fairness and Accuracy;                (3)  Transparency;                (4)  Consumer disclosures;                (5)  Data privacy and security;                (6)  Accountability and liability;                (7)  Continuous evaluation and improvement;                (8)  Public redress.           Sec. 2054.703.  MINIMUM STANDARDS FOR HEIGHTENED SCRUTINY   ARTIFICIAL INTELLIGENCE SYSTEMS. (a) The department by rule shall   develop minimum risk management and governance standards for the   development, procurement, deployment, and use of heightened   scrutiny artificial intelligence systems by a state agency or   local government.          (b)  The minimum standards must be consistent with the   Artificial Intelligence Risk Management Framework (AI RMF 1.0)   published by the National Institute of Standards and Technology and   must:                (1)  establish accountability measures, such as   required reports describing the use of, limitations of, and   safeguards for the heightened scrutiny artificial intelligence   system;                (2)  require the assessment and documentation of the   heightened scrutiny artificial intelligence system's known   security risks, performance metrics, and transparency measures:                      (A)  before deploying the system;   and                      (C)  at the time any material change is made to:                            (i)  the system;                            (ii)  the state or local data used by the   system; or                            (iii)  the intended use of the system;                (3)  provide resources to local governments to advise   on the management of heightened scrutiny artificial intelligence   system procurement and deployment, data protection measures, and   employee training; and                (4)  establish guidelines for:                      (A)  risk management frameworks, acceptable use   policies, and training employees; and                      (B)  mitigating the risk of unlawful harm by   contractually requiring third party vendors to implement risk   management system frameworks when deploying heightened scrutiny   artificial intelligence systems on behalf of state agencies or   local governments.          (c)  State agencies and local governments shall both adopt   the code of ethics developed under Section 2054.702 and the   standards developed under Subsection (b).          Sec. 2054.704.  EDUCATIONAL OUTREACH PROGRAM. (a) The   department shall develop educational materials on artificial   intelligence systems to promote the responsible use of the systems   and awareness of the risks and benefits of system use, explain   consumer rights in relation to the systems, and describe risk   mitigation techniques.          (b)  The department shall develop training materials for   state and local government employees and the general public. The   training materials must be made available on the department's   public Internet website.          (c)  The department shall host statewide forums and training   sessions on artificial intelligence systems best practices for   state and local government employees.          (d)  The department may:                (1)  use money appropriated to the department to   produce materials required by this section; and                (2)  contract with a vendor to produce those materials.          Sec. 2054.705.  PUBLIC SECTOR ARTIFICIAL INTELLIGENCE   SYSTEMS ADVISORY BOARD. (a) A public sector artificial   intelligence systems advisory board is established to assist state   agencies in the development, deployment, and use of artificial   intelligence systems.          (b)  The advisory board shall obtain and disseminate   information on artificial intelligence systems, including use   cases, policies, and guidelines, facilitate shared resources   between state agencies, and consult with the department on   artificial intelligence systems issues.          (c)  The department shall provide administrative support for   the advisory board.          (d)  The advisory board is composed of eight members as   follows:                (1)  six members representing state agencies,   including one member representing an agency with fewer than 150   employees, appointed by the governor; and                (2)  two public members, appointed by the governor or   the governor's designee, with technology expertise.          (e)  Advisory board members serve two-year terms. Advisory   board members may be reappointed.          (f)  Advisory board members are not entitled to compensation   or reimbursement of expenses for service on the advisory board.          (g)  The advisory board shall direct state agencies to:                (1)  Identify opportunities to implement AI solutions   that reduce administrative burdens;                (2)  Recommend the elimination of regulations that   unnecessarily restrict AI innovation; and                (3)  Identify opportunities to streamline procurement   processes to enable AI adoption.          Sec. 2054.706.  ARTIFICIAL INTELLIGENCE SYSTEM SANDBOX   PROGRAM. (a) In this section:                (1)  "Eligible entity" means an eligible customer under   Section 2054.0525.                (2)  "Program" means the program established by this   section that is designed to allow temporary testing of an   artificial intelligence system in a controlled, limited manner   without requiring full compliance with otherwise applicable   regulations.                (3)  "Vendor" means a person registered with the   department as a contractor to provide commodity items under Section   2157.068.          (b)  The department shall establish and administer a program   to support eligible entities in contracting with vendors to engage   in research, development, training, testing, and other   pre-deployment activities related to artificial intelligence   systems to effectively, efficiently, and securely assist the entity   in accomplishing its public purposes.          (c)  The department shall create an application process for   vendors to apply to participate in the program. The application   process must include:                (1)  a detailed description of the artificial   intelligence system proposed for participation in the program and   the system's intended use;                (2)  a risk-assessment of the system that addresses   potential impacts on the public; and                (3)  a plan for mitigating any adverse consequences   discovered during the system's testing phase.          (d)  A vendor participating in the program shall, with   oversight by the department, provide eligible entities with secure   access to an artificial intelligence system used in the program.          (e)  The department shall provide to vendors and eligible   entities participating in the program detailed guidelines   regarding the exemption from compliance with otherwise applicable   regulations provided by the program.          (f)  The eligible entities and vendors shall submit   quarterly reports to the department that include:                (1)  performance measures for the artificial   intelligence system;                (2)  risk mitigation strategies implemented during   system testing;                (3)  feedback on program effectiveness and efficiency;   and                (4)  any additional information the department   requests.          (g)  Not later than November 30 of each even-numbered year,   the department shall produce an annual report and submit the report   to the legislature summarizing:                (1)  the number of eligible entities and vendors   participating in the program and the program outcomes; and                (2)  recommendations for legislative or other action.          (h)  Notwithstanding Section 2054.383, the department may   operate the program as a statewide technology center under   Subchapter L.          Sec. 2054.707.  DISCLOSURE REQUIREMENTS. (a) A state   agency that procures, develops, deploys, or uses an artificial   intelligence system shall provide clear disclosure of the system to   the public as provided by the artificial intelligence system code   of ethics established under Section 2054.702.          (b)  A vendor contracting with a state agency to deploy or   operate an artificial intelligence system must also provide the   disclosure required under Subsection (a).          Sec. 2054.708.  IMPACT ASSESSMENTS. (a) A state agency that   deploys or uses an artificial intelligence system or a vendor that   contracts with a state agency for the deployment or use of a system   shall conduct a semiannual system assessment that outlines:                (1)  risks of unlawful harm;                (2)  system limitations; and                (3)  information governance practices;           (b)  The state agency or vendor shall submit make available a   copy of the assessment to the department upon request.          (c)  The impact assessments created under this section are   confidential and not subject to disclosure under Chapter 552. The   state agency or department may redact or withhold the information   as confidential under Chapter 552 without requesting a decision   from the attorney general under Subchapter G, Chapter 552.          (d)  The Department shall take all necessary steps to ensure   the confidentiality of Submitted Information, including but not   limited to, restricting access to submitted information to   authorized personnel only and implementing physical, electronic,   and procedural safeguards to protect submitted information.          Sec. 2054.710.  ENFORCEMENT. (a) If a state agency or   vendor is made aware that a violation of this subchapter has   occurred, the agency or vendor shall report the violation to the   department, if applicable, and the attorney general.          (b)  The attorney general shall:                (1)  review a report submitted under this section or a   complaint reported through the webpage established under Section   2054.711; and                (2)  determine whether to bring an action to enjoin a   violation of this subchapter.          (c)  If the attorney general determines that a vendor   violated this subchapter, the attorney general shall provide the   vendor with a written notice of the violation. The vendor shall have   30 days from the date of the notice to cure the violation.          (d)  If the vendor fails to cure the violation within the   30-day period specific in subsection (c), the state agency may void   the contract without further obligation to the vendor. The state   agency shall provide the vendor with a 30-day notice of its intent   to void the contract, during which time the vendor may address any   remaining issues to the satisfaction of the state agency.          (e)  If the vendor does not satisfactorily address the issues   within the 30-day notice period specified in subsection (d), the   state agency may void the contract without further obligation to   the vendor.          (d)  If the department determines that a vendor has had more   than one contract voided under Subsection (c), the department shall   refer the matter to the comptroller. Using procedures prescribed   by Section 2155.077, the comptroller may bar the vendor from   participating in a state agency contract.          Sec. 2054.711.  ARTIFICIAL INTELLIGENCE SYSTEM COMPLAINT   WEBPAGE. (a) The attorney general shall, in collaboration with the   department, establish a webpage on the attorney general's Internet   website that allows a person to report a complaint relating to   artificial intelligence systems, including:                (1)  instances of an artificial intelligence system   allegedly unlawfully infringing on the person's constitutional   rights or financial livelihood; or                (2)  the use of an artificial intelligence system that   allegedly results in unlawful harm.          (b)  A complaint submitted on the webpage created under   Subsection (a) must be distributed to the department.          (c)  A person who submits a complaint on the webpage created   under Subsection (a) may request from the department an explanation   as provided by Section 2054.702(b)(1)(D).          (d)  The attorney general shall post on the attorney   general's Internet website information that:                (1)  educates persons regarding the risks and benefits   of artificial intelligence systems; and                (2)  explains a person's rights in relation to   artificial intelligence systems.          (e)  Not later than November 30 of each even-numbered year,   the attorney general shall submit to the legislature a report   summarizing the complaints received under this section, the   resolutions of the complaints, and any enforcement actions taken.          Sec. 2054.712.  STANDARDIZED NOTICE. (a) Each state agency   and local government that deploys or uses an artificial   intelligence system that the public directly accesses or that is a   controlling factor in a any decision that has a material legal or   similarly significant effect on the provision, denial, or   conditions of a person's access to a government service shall   include a standardized notice on all related applications, Internet   websites, and public computer systems.          (b)  The department shall develop a form that agencies must   use for the notice required under Subsection (a). The form must   include:                (1)  general information about the system;                (2)  information about the data sources the system   uses; and                (3)  measures taken to maintain compliance with   information privacy laws and ethics standards.          Sec. 2054.713.  RULES. The department shall adopt rules to   implement this subchapter.          SECTION 6.  (a) As soon as practicable after the effective   date of this Act, the Department of Information Resources shall:                (1)  adopt rules necessary to implement Subchapter S,   Chapter 2054, Government Code, as added by this Act; and                (2)  develop the outreach program and form required by   Sections 2054.704 and 2054.712, Government Code, as added by this   Act.          (b)  As soon as practicable after the effective date of this   Act, the office of the attorney general shall establish the webpage   as required by Section 2054.711, Government Code, as added by this   Act.          SECTION 7.  This Act takes effect September 1, 2025.