BILL ANALYSIS

Senate Research Center	C.S.S.B. 1964
89R22286 LRM-F	By: Parker
	Business & Commerce
	4/14/2025
	Committee Report (Substituted)

AUTHOR'S / SPONSOR'S STATEMENT OF INTENT

As artificial intelligence (AI) technologies rapidly evolve, state and local governments increasingly rely on automated tools to deliver services, make decisions that affect individuals, and optimize internal processes. However, existing laws do not sufficiently address the complex issues of transparency, accountability, and the protection of individual rights arising from government use of AI systems.

S.B. 1964 seeks to create a clear, enforceable framework for the procurement, development, and deployment of AI systems by government agencies in Texas. By mandating compliance with a code of ethics and minimum standards aligned with the National Institute of Standards and Technology's AI Risk Management Framework, the bill promotes responsible AI use and mitigates risks posed by automated decision-making. It empowers the Department of Information Resources to provide guidance, develop training and educational programs, and conduct statewide oversight, ensuring that new AI technologies are vetted for fairness, transparency, and security before being implemented. The inclusion of an advisory board, sandbox program, and complaint webpage fosters collaboration, public input, and accountability, while the bill's enforcement mechanisms, including contract-voiding provisions and referral to the Comptroller of Public Accounts, help guarantee adherence to these standards. Overall, the proposed regulatory structure seeks to increase government efficiency, safeguard individual rights, improve public trust in AI-driven processes, and uphold ethical and legal standards in Texas government operations.

(Original Author's/Sponsor's Statement of Intent)

C.S.S.B. 1964 amends current law relating to the regulation and use of artificial intelligence systems and the management of data by governmental entities.

RULEMAKING AUTHORITY

Rulemaking authority is expressly granted to the Texas Department of Information Resources in

SECTION 5 (Sections 2054.702, 2054.703, and 2054.712, Government Code) of this bill.

SECTION BY SECTION ANALYSIS

SECTION 1. Amends Section 2054.003, Government Code, by adding Subdivisions (1-a), (2-b), (2-c), (6-a), and (11) to define "artificial intelligence system," "consequential decision," "controlling factor," "heightened scrutiny artificial intelligence system," and "principal basis."

SECTION 2. Amends Section 2054.068(b), Government Code, to require the Texas Department of Information Resources (DIR) to collect from each state agency information on the status and condition of the agency's information technology infrastructure, including information regarding an inventory of the agency's servers, mainframes, cloud services, artificial intelligence (AI) systems, including heightened scrutiny AI systems, and other information technology equipment.

SECTION 3. Amends Section 2054.0965, Government Code, by amending Subsection (b) and adding Subsection (c), as follows:

(b) Requires that the review completed by a state agency of the operational aspects of the agency's information resources deployment, except as otherwise modified by rules adopted by DIR, include certain information, including an inventory and identification of the AI systems and heightened scrutiny AI systems deployed by the agency, including an evaluation of the purpose of and risk mitigation measures for each system and an analysis of how each system supports the agency's strategic plan under Subchapter E (Strategic and Operating Plans; Information), and confirmation by the agency of compliance with state statutes, rules, and standards relating to information resources and AI systems, including the AI system code of ethics developed under Section 2054.702, and minimum standards developed under Section 2054.703. Makes nonsubstantive changes.

(c) Requires local governments to complete a review of the deployment and use of heightened scrutiny AI systems and provide the review to DIR, in a manner DIR prescribes.

SECTION 4. Amends Section 2054.137, Government Code, by adding Subsection (a-1) and amending Subsection (c), as follows:

(a-1) Authorizes a state agency with 150 or fewer full-time employees to designate a fulltime employee of the agency to serve as a data management officer or enter into an agreement with one or more state agencies to jointly employ a data management officer if approved by DIR.

(c) Requires the data management officer for a state agency, in accordance with DIR guidelines, to annually post on the Texas Open Data Portal established by DIR under Section 2054.070 (Central Repository for Publicly Accessible Electronic Data) at least three high-value data sets as defined by Section 2054.1265 (Posting High-Value Data Sets on Internet).

SECTION 5. Amends Chapter 2054, Government Code, by adding Subchapter S, as follows:

SUBCHAPTER S. ARTIFICIAL INTELLIGENCE

Sec. 2054.701. DEFINITION. Defines "unlawful harm."

Sec. 2054.702. ARTIFICIAL INTELLIGENCE SYSTEM CODE OF ETHICS. (a) Requires DIR by rule to establish an AI system code of ethics for use by state agencies and local governments that procure, develop, deploy, or use AI systems.

(b) Requires that, at a minimum, the AI system code of ethics include guidance for the deployment and use of AI systems and heightened scrutiny AI systems that aligns with the AI Risk Management Framework (AI RMF 1.0) published by the National Institute of Standards and Technology. Requires that the guidance address certain subjects.

Sec. 2054.703. MINIMUM STANDARDS FOR HEIGHTENED SCRUTINY ARTIFICIAL INTELLIGENCE SYSTEMS. (a) Requires DIR by rule to develop minimum risk management and governance standards for the development, procurement, deployment, and use of heightened scrutiny AI systems by a state agency or local government.

(b) Requires that the minimum standards be consistent with the AI Risk Management Framework (AI RMF 1.0) published by the National Institute of Standards and Technology and that they include certain provisions.

Sec. 2054.704. EDUCATIONAL OUTREACH PROGRAM. (a) Requires DIR to develop educational materials on AI systems to promote the responsible use of the systems and awareness of the risks and benefits of system use, explain consumer rights in relation to the systems, and describe risk mitigation techniques.

(b) Requires DIR to develop training materials for state and local government employees and the general public. Requires that the training materials be made available on DIR's public Internet website.

(c) Require DIR to host statewide forums and training sessions on AI systems best practices for state and local government employees.

(d) Authorizes DIR to use money appropriated to DIR to produce materials required by this section and contract with a vendor to produce those materials.

Sec. 2054.705. PUBLIC SECTOR ARTIFICIAL INTELLIGENCE SYSTEMS ADVISORY BOARD. (a) Provides that a public sector AI systems advisory board (advisory board) is established to assist state agencies in the development, deployment, and use of AI systems.

(b) Requires the advisory board to perform certain duties.

(d) Provides that the advisory board is composed of eight members, including six members representing state agencies, including one member representing an agency with fewer than 150 employees, appointed by the governor or the governor's designee and two public members with expertise in technology, appointed by the governor or the governor's designee.

(e) Provides that advisory board members serve two-year terms. Authorizes advisory board members to be reappointed.

(f) Provides that advisory board members are not entitled to compensation or reimbursement of expenses for service on the advisory board.

Sec. 2054.706. ARTIFICIAL INTELLIGENCE SYSTEM SANDBOX PROGRAM. (a) Defines "eligible entity," "program," and "vendor."

(b) Requires DIR to establish and administer a program to support eligible entities in contracting with vendors to engage in research, development, training, testing, and other pre-deployment activities related to AI systems to effectively, efficiently, and securely assist the entity in accomplishing its public purposes.

(c) Requires DIR to create an application process for vendors to apply to participate in the program. Requires that the application process include a detailed description of the AI system proposed for participation in the program and the system's intended use, a risk-assessment of the system that addresses potential impacts on the public, and a plan for mitigating any adverse consequences discovered during the system's testing phase.

(d) Requires a vendor participating in the program to, with oversight by DIR, provide eligible entities with secure access to an AI system used in the program.

(e) Requires DIR to provide to vendors and eligible entities participating in the program detailed guidelines regarding the exemption from compliance with otherwise applicable regulations provided by the program.

(f) Requires the eligible entities and vendors to submit quarterly reports to DIR that include performance measures for the AI system, risk mitigation strategies implemented during system testing, feedback on program effectiveness and efficiency, and any additional information DIR requests.

(g) Requires DIR, not later than November 30 of each even-numbered year, to produce an annual report and submit the report to the legislature summarizing the number of eligible entities and vendors participating in the program and the program outcomes and recommendations for legislative or other action.

(h) Authorizes DIR, notwithstanding Section 2054.383 (Establishment of Additional Statewide Technology Centers), to operate the program as a statewide technology center under Subchapter L (Statewide Technology Centers).

Sec. 2054.707. DISCLOSURE REQUIREMENTS. (a) Requires a state agency that procures, develops, deploys, or uses a public-facing AI system to provide clear disclosure of interaction with the system to the public as provided by the AI system code of ethics established under Section 2054.702. Provides that the disclosure is not required if a reasonable person would know the person is interacting with an AI system.

(b) Requires a vendor contracting with a state agency to deploy or operate an AI system to also provide the disclosure required under Subsection (a).

Sec. 2054.708. IMPACT ASSESSMENTS. (a) Requires a state agency that deploys or uses an AI system or a vendor that contracts with a state agency for the deployment or use of a system to conduct assessment that outlines risks of unlawful harm, system limitations, and information governance practices.

(b) Requires the state agency or vendor to make a copy of the assessment available to DIR upon request.

(c) Provides that an impact assessment created under this section is confidential and not subject to disclosure under Chapter 552 (Public Information). Authorizes the state agency or DIR to redact or withhold the information as confidential under Chapter 552 without requesting a decision from the attorney general under Subchapter G (Attorney General Decisions), Chapter 552.

(d) Requires DIR to take actions necessary to ensure the confidentiality of information submitted under this section, including restricting access to submitted information to only authorized personnel and implementing physical, electronic, and procedural protections.

Sec. 2054.709. ENFORCEMENT. (a) Requires a state agency or vendor, if the agency or vendor is made aware of a violation of this subchapter, to report the violation to DIR, if applicable, and the attorney general.

(b) Requires the attorney general to review a report submitted under this section or a complaint reported through the web page established under Section 2054.711, and determine whether to bring an action to enjoin a violation of this subchapter.

(c) Requires the attorney general, if the attorney general, in consultation with DIR, determines that a vendor violated this subchapter, to provide the vendor with a written notice of the violation.

(d) Requires the state agency, if a vendor fails to respond or cure the violation before the 31st day after the date the vendor receives the written notice under Subsection (c), to provide the vendor with a notice of intent to void the contract. Authorizes the vendor to respond and seek to cure the violation before the 31st day after the date the vendor receives the notice of intent.

(e) Authorizes the state agency, if the vendor fails to cure the violation before the 31st day after the date the vendor receives the notice of intent to void the contract under Subsection (d), to void the contract without further obligation to the vendor.

(f) Requires DIR, if DIR determines that a vendor has had more than one contract voided under Subsection (e), to refer the matter to the Comptroller of Public Accounts of the State of Texas (comptroller). Authorizes the comptroller, using procedures prescribed by Section 2155.077 (Barring Vendor from Participation in State Contracts), to bar the vendor from participating in a state agency contract.

Sec. 2054.710. ARTIFICIAL INTELLIGENCE SYSTEM COMPLAINT WEB PAGE. (a) Requires the attorney general, in collaboration with DIR, to establish a web page on the attorney general's Internet website that allows a person to report a complaint relating to AI systems, including instances of an AI system allegedly unlawfully infringing on the person's constitutional rights or financial livelihood or the use of an AI system that allegedly results in unlawful harm.

(b) Requires that a complaint submitted on the web page created under Subsection (a) be distributed to DIR.

(c) Authorizes a person who submits a complaint on the web page created under Subsection (a) to request an explanation from DIR.

(d) Requires the attorney general to post on the attorney general's Internet website information that educates persons regarding the risks and benefits of AI systems and explains a person's rights in relation to AI systems.

(e) Authorizes the attorney general, if the attorney general, in consultation with DIR, determines that the complaint is substantiated and a violation of this chapter occurred, to seek enforcement under Section 2054.709.

(f) Requires the attorney general, not later than November 30 of each even-numbered year, to submit to the legislature a report summarizing the complaints received under this section, the resolutions of the complaints, and any enforcement actions taken.

Sec. 2054.711. STANDARDIZED NOTICE. (a) Requires each state agency and local government deploying or using an AI system that is public-facing or that is a controlling factor in a consequential decision to include a standardized notice on all related applications, Internet websites, and public computer systems.

(b) Requires DIR to develop a form that agencies are required to use for the notice required under Subsection (a). Requires that the form include general information about the system, information about the data sources the system uses and measures taken to maintain compliance with information privacy laws and ethics standards.

Sec. 2054.712. RULES. Requires DIR to adopt rules to implement this subchapter.

SECTION 6. (a) Requires DIR, as soon as practicable after the effective date of this Act, to adopt rules necessary to implement Subchapter S, Chapter 2054 (Information Resources), Government Code, as added by this Act, and develop the outreach program and form required by Sections 2054.704 and 2054.711, Government Code, as added by this Act.

(b) Requires the Office of the Attorney General, as soon as practicable after the effective date of this Act, to establish the webpage as required by Section 2054.710, Government Code, as added by this Act.

SECTION 7. Effective date: September 1, 2025.