BILL ANALYSIS

C.S.S.B. 1964

By: Parker

Delivery of Government Efficiency

Committee Report (Substituted)

BACKGROUND AND PURPOSE

The bill sponsor has informed the committee that as artificial intelligence (AI) technologies rapidly evolve, state and local governments increasingly rely on automated tools to deliver services, make decisions that affect individuals, and optimize internal processes. The bill sponsor has also informed the committee that existing state law does not sufficiently address the complex issues of transparency, accountability, and the protection of individual rights arising from government use of AI systems. C.S.S.B. 1964 seeks to address this issue by creating a clear, enforceable framework for the procurement, development, and deployment of AI systems by government agencies in Texas.

CRIMINAL JUSTICE IMPACT

It is the committee's opinion that this bill does not expressly create a criminal offense, increase the punishment for an existing criminal offense or category of offenses, or change the eligibility of a person for community supervision, parole, or mandatory supervision.

RULEMAKING AUTHORITY

It is the committee's opinion that rulemaking authority is expressly granted to the Department of Information Resources in SECTION 5 of this bill.

ANALYSIS

C.S.S.B. 1964 amends the Government Code to set out provisions relating to the regulation and use of artificial intelligence (AI) systems and the management of data by governmental entities.

AI and Information Resources

AI System Code of Ethics and Minimum Standards

C.S.S.B. 1964 requires the Department of Information Resources (DIR) by rule to establish an AI system code of ethics for use by state agencies and local governments that procure, develop, deploy, or use AI systems. At a minimum, the AI system code of ethics must include guidance for the deployment and use of AI systems and heightened scrutiny AI systems that aligns with the Artificial Intelligence Risk Management Framework (AI RMF 1.0) published by the National Institute of Standards and Technology. The bill defines "heightened scrutiny AI system" as an AI system specifically intended to autonomously make, or be a controlling factor in making, a consequential decision, excluding an AI system intended to do the following:

· perform a narrow procedural task;

· improve the result of a previously completed human activity;

· perform a preparatory task to an assessment relevant to a consequential decision; or

· detect decision-making patterns or deviations from previous decision-making patterns.

The bill requires such guidance to address the following:

· human oversight and control;

· fairness and accuracy;

· transparency, including consumer disclosures;

· data privacy and security;

· public and internal redress, including accountability and liability; and

· the frequency of evaluations and documentation of improvements.

The bill requires state agencies and local governments to adopt the code of ethics developed under these provisions.

C.S.S.B. 1964 requires DIR by rule to develop minimum risk management and governance standards for the development, procurement, deployment, and use of heightened scrutiny AI systems by a state agency or local government. The minimum standards must be consistent with the AI RMF 1.0 and do the following:

· establish accountability measures, such as required reports describing the use of, limitations of, and safeguards for the heightened scrutiny AI system;

· require the assessment and documentation of the heightened scrutiny AI system's known security risks, performance metrics, and transparency measures before deploying the system and at the time any material change is made to the system, the state or local data used by the system, or the intended use of the system;

· provide to local governments resources that advise on managing, procuring, and deploying a heightened scrutiny AI system, including data protection measures and employee training; and

· establish guidelines for risk management frameworks, acceptable use policies, training employees and for mitigating the risk of unlawful harm by contractually requiring vendors to implement risk management frameworks when deploying heightened scrutiny AI systems on behalf of state agencies or local governments.

The bill requires state agencies and local governments to adopt the minimum standards.

Educational Outreach Program

C.S.S.B. 1964 requires DIR to develop educational materials on AI systems to promote the responsible use of those systems and awareness of the risks and benefits of system use, explain consumer rights in relation to those systems, and describe risk mitigation techniques. The bill requires DIR to develop training materials for state and local government employees and the general public. The bill requires the training materials to be made available on DIR's public website and requires DIR to host statewide forums and training sessions on AI systems best practices for state and local government employees. The bill authorizes DIR to use money appropriated to DIR to produce the required materials and contract with a vendor to produce those materials. The bill requires DIR to develop the outreach program as soon as practicable after the bill's effective date.

Public Sector AI Systems Advisory Board

C.S.S.B. 1964 establishes a public sector AI systems advisory board to assist state agencies in the development, deployment, and use of AI systems. The bill requires the advisory board to do the following:

· obtain and disseminate information on AI systems, including use cases, policies, and guidelines;

· facilitate shared resources between state agencies;

· consult with DIR on AI systems issues;

· identify opportunities for state agencies to implement AI systems to reduce administrative burdens and to streamline the state procurement process for AI systems; and

· recommend elimination of rules that restrict the innovation of AI systems.

The bill requires DIR to provide administrative support for the advisory board and establishes the composition of the eight member advisory board as follows:

· six members representing state agencies, including one member representing an agency with fewer than 150 employees, appointed by the governor or the governor's designee; and

· two public members with expertise in technology, appointed by the governor or the governor's designee.

The bill establishes that advisory board members serve two-year terms and may be reappointed. Advisory board members are not entitled to compensation or reimbursement of expenses for service on the board.

AI System Sandbox Program

C.S.S.B. 1964 requires DIR to establish and administer a program to support eligible entities in contracting with vendors to engage in research, development, training, testing, and other pre-deployment activities related to AI systems to effectively, efficiently, and securely assist the entity in accomplishing its public purposes. The bill requires DIR to create an application process for vendors to apply to participate in the program, which must include the following components:

· a detailed description of the AI system proposed for participation in the program and the system's intended use;

· a risk assessment of the system that addresses potential impacts on the public; and

· a plan for mitigating any adverse consequences discovered during the system's testing phase.

The bill requires a vendor participating in the program, with oversight by DIR, to provide eligible entities with secure access to an AI system used in the program. The bill requires DIR to provide to vendors and eligible entities participating in the program detailed guidelines regarding the exemption from compliance with otherwise applicable regulations provided by the program.

C.S.S.B. 1964 requires eligible entities and vendors to submit quarterly reports to DIR that include performance measures for the AI system, risk mitigation strategies implemented during system testing, feedback on program effectiveness and efficiency, and any additional information DIR requests. The bill requires DIR, not later than November 30 of each even-numbered year, to produce an annual report and submit the report to the legislature summarizing the number of eligible entities and vendors participating in the program and the program outcomes and recommendations for legislative or other action. The bill authorizes DIR to operate the program as a statewide technology center and requires DIR to share information and resources for the program with any other DIR program established to allow a person, without holding a license or certificate of registration under state law, to test an AI system for a limited time and on a limited basis.

C.S.S.B. 1964 defines the following terms for purposes of the AI system sandbox program:

· "eligible entity" as an eligible customer under statutory provisions establishing customers eligible for DIR services; and

· "vendor" as a person registered with DIR as a contractor to provide commodity items under statutory provisions relating to the purchase of information technology commodity items.

Disclosure Requirements; Impact Assessments

C.S.S.B. 1964 requires a state agency that procures, develops, deploys, or uses a public-facing AI system to provide clear disclosure of interaction with the system to the public as provided by the AI system code of ethics established under the bill's provisions. The disclosure is not required if a reasonable person would know the person is interacting with an AI system.

C.S.S.B. 1964 requires a state agency that deploys or uses a heightened scrutiny AI system or a vendor that contracts with a state agency for the deployment or use of a heightened scrutiny AI system to conduct a system assessment that outlines risks of unlawful harm, system limitations, and information governance practices. The bill requires the state agency or vendor to make a copy of the assessment available to DIR on request. The bill establishes that such an impact assessment is confidential and not subject to disclosure under state public information law. The bill authorizes a state agency or DIR to redact or withhold information as confidential under state public information law without requesting an applicable decision from the attorney general. The bill requires DIR to take actions necessary to ensure the confidentiality of information submitted under an impact assessment, including restricting access to submitted information to only authorized personnel and implementing physical, electronic, and procedural protections.

Enforcement

C.S.S.B. 1964 requires a state agency or vendor, if the agency or vendor becomes aware of a violation of the bill's provisions regarding AI with respect to information resources, to report the violation to DIR, if applicable, and the attorney general. The bill requires the attorney general to review such a report or a complaint reported through the web page established under the bill's provisions and to determine whether to bring an action to enjoin such a violation.

C.S.S.B. 1964 requires the attorney general, if the attorney general, in consultation with DIR, determines that a vendor violated the bill's provisions regarding AI with respect to information resources, to provide the vendor with a written notice of the violation. The bill requires a state agency, if a vendor fails to respond or cure the violation before the 31st day after the date the vendor receives such written notice, to provide the vendor with a notice of intent to void the contract. The bill authorizes a vendor to respond and seek to cure the violation before the 31st day after the date the vendor receives the notice of intent to void the contract. If the vendor fails to cure the violation before the 31st day after the date the vendor receives the notice of intent, the state agency may void the contract without further obligation to the vendor. The bill requires DIR to refer the matter to the comptroller of public accounts if DIR determines that a vendor has had more than one contract voided under these provisions. The bill authorizes the comptroller to bar such a vendor from participating in a state agency contract using the procedures prescribed under applicable statute.

AI System Complaint Web Page

C.S.S.B. 1964 requires the attorney general, in collaboration with DIR, to establish a web page on the attorney general's website that allows a person to report a complaint relating to AI systems, including instances of an AI system allegedly unlawfully infringing on the person's constitutional rights or financial livelihood or the use of an AI system that allegedly results in unlawful harm. A complaint submitted on the web page must be distributed to DIR. The bill authorizes a person who submits a complaint on the web page to request an explanation from DIR. The bill requires the attorney general to post on the attorney general's website information that educates persons regarding the risks and benefits of AI systems and explains a person's rights in relation to AI systems.

C.S.S.B. 1964 authorizes the attorney general to seek enforcement under the bill's provisions if the attorney general, in consultation with DIR, determines that a complaint is substantiated and a violation of the bill's provisions regarding AI with respect to information resources occurred. The bill requires the attorney general, not later than November 30 of each even-numbered year, to submit to the legislature a report summarizing the complaints received under these provisions, the resolutions of the complaints, and any enforcement actions taken. The bill requires the office of the attorney general to establish the web page as soon as practicable after the bill's effective date.

Standard Notices; Efficient Use of Resources; Rules

C.S.S.B. 1964 requires each state agency and local government deploying or using an AI system that is public-facing or that is a controlling factor in a consequential decision to include a standardized notice on all related applications, websites, and public computer systems. The bill requires DIR to develop a form as soon as practicable after the bill's effective date that agencies must use for the required notice. The form must include general information about the system, information about the data sources the system uses, and measures taken to maintain compliance with information privacy laws and ethics standards.

C.S.S.B. 1964 requires DIR to coordinate the activities under the bill's provisions and any other law relating to AI systems to ensure efficient system implementation and to streamline the use of DIR's resources, including information sharing and personnel.

C.S.S.B. 1964 requires DIR to adopt rules to implement the bill's provisions regarding AI with respect to information resources as soon as practicable after the bill's effective date.

Unlawful Harm

C.S.S.B. 1964 defines "unlawful harm" as any condition in which the use of an AI system results in a consequential decision that causes harm to an individual who is a member of a state or federally protected class in violation of law. The term does not include a developer's or deployer's offer, license, or use of a heightened scrutiny AI system for the sole purpose of testing the system before deployment to identify, mitigate, or otherwise ensure compliance with state and federal law.

Information Technology Infrastructure Report and Information Resources Deployment Review

C.S.S.B. 1964 expands the information that DIR is required to collect from each state agency relating to the status and condition of the agency's information technology infrastructure to include information regarding the agency's AI systems, including heightened scrutiny AI systems.

C.S.S.B. 1964 requires a state agency's biennial information resources deployment review to include the following information:

· an inventory and identification of the AI systems and heightened scrutiny AI systems deployed by the agency, including an evaluation of the purpose of and risk mitigation measures for each system and an analysis of each system's support of the agency's applicable strategic plan; and

· confirmation by the agency of compliance with state statutes, rules, and standards relating to AI systems, including the AI system code of ethics and the minimum standards developed under the bill's provisions.

The bill requires local governments to complete a review of the deployment and use of heightened scrutiny AI systems and, on request, provide the review to DIR in the manner prescribed by DIR.

State Agency Data Management Officers

C.S.S.B. 1964 authorizes a state agency with 150 or fewer full-time employees to designate a full-time employee of the agency to serve as a data management officer or enter into an agreement with one or more state agencies to jointly employ a data management officer if approved by DIR. The bill specifies that the frequency with which the data management officer for a state agency is required to post at least three high-value data sets on the Texas Open Data Portal is annually.

Definitions

C.S.S.B. 1964 defines the following terms for purposes of provisions relating to information resources:

· "AI system" as a machine-based system that for explicit or implicit objectives infers from provided information a method to generate outputs, such as predictions, content, recommendations, or decisions, to influence a physical or virtual environment with varying levels of autonomy and adaptiveness after deployment;

· "consequential decision" as a decision that has a material, legal, or similarly significant effect on the provision, denial, or conditions of a person's access to a government service;

· "controlling factor" as a factor generated by an AI system that is the principal basis for making a consequential decision or capable of altering the outcome of a consequential decision; and

· "principal basis" as the use of an output produced by a heightened scrutiny AI system to make a decision without human review, oversight, involvement, or intervention or meaningful consideration by a human.

EFFECTIVE DATE

September 1, 2025.

COMPARISON OF SENATE ENGROSSED AND SUBSTITUTE

While C.S.S.B. 1964 may differ from the engrossed in minor or nonsubstantive ways, the following summarizes the substantial differences between the engrossed and committee substitute versions of the bill.

While both the engrossed and the substitute require local governments to complete a review of the deployment and use of heightened scrutiny AI systems and provide the review to DIR in the manner prescribed by DIR, the substitute includes a specification not present in the engrossed that such review is provided on request.

The substitute includes the following provisions that did not appear in the engrossed:

· a requirement for DIR to share information and resources for the AI system sandbox program with any other DIR program established to allow a person, without holding a license or certificate of registration under state law, to test an AI system for a limited time and on a limited basis; and

· a requirement for DIR to coordinate the activities under the bill's provisions regarding AI with respect to information resources and any other law relating to AI systems to ensure efficient system implementation and to streamline the use of DIR's resources, including information sharing and personnel.

The substitute omits a provision from the engrossed that required a vendor contracting with a state agency to deploy or operate an AI system to provide a disclosure of interaction with the system to the public as provided by the bill's provisions.

While both the engrossed and the substitute require a state agency that deploys or uses an AI system or a vendor that contracts with a state agency for the deployment or use of an AI system to conduct a system assessment that outlines certain information, the substitute includes a specification not in the engrossed that such an AI system is a heightened scrutiny AI system.

Both the engrossed and the substitute authorize the attorney general, if the attorney general, in consultation with DIR, determines that a complaint submitted on the web page established under the bill's provisions is substantiated and a violation of certain provisions has occurred, to seek enforcement under the bill's provisions. However, the engrossed specified that the violation is of statutory provisions governing information resources, while the substitute specifies that the violation is of the bill's provisions regarding AI with respect to information resources.