TX SB1964: Relating to the regulation and use of artificial intelligence systems and the management of data by governmental entities.

In one paragraph

Texas's SB 1964 sets rules for AI used by state agencies and local governments. The Department of Information Resources (DIR) must adopt an AI code of ethics and minimum risk-management standards for "heightened scrutiny" AI (systems specifically intended to autonomously make, or be a controlling factor in, consequential decisions on access to government services), aligned with NIST's AI RMF 1.0, which agencies and local governments must adopt. State agencies and their vendors must assess such systems for risks of unlawful harm, agencies must give notice of public-facing AI, and vendors that do not cure violations can lose contracts. Signed June 20, 2025; effective September 1, 2025.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

Vendors deploying heightened scrutiny AI for Texas state agencies must assess risks of unlawful harm, limitations and data governance and report known violations; uncured violations can void contracts and lead to debarment. DIR sandbox vendors file quarterly reports. No other business duties.

Key provisions

1. 1Heightened scrutiny AI system: one specifically intended to autonomously make, or be a controlling factor in making, a consequential decision (material legal or similarly significant effect on access to a government service); excludes systems for narrow procedural tasks, improving completed human work, preparatory tasks, or detecting decision-making patterns (Gov't Code § 2054.003)
2. 2DIR must adopt by rule an AI code of ethics (human oversight, fairness and accuracy, transparency including consumer disclosures, privacy and security, redress and accountability, evaluation frequency) and minimum risk management and governance standards for heightened scrutiny systems, both aligned with NIST's AI RMF 1.0; state agencies and local governments must adopt both (§§ 2054.702, 2054.703)
3. 3The standards must require assessing and documenting a heightened scrutiny system's known security risks, performance metrics and transparency measures before deployment and on any material change, and set guidelines for contractually requiring vendors that deploy such systems for agencies or local governments to implement risk management frameworks (§ 2054.703(b))
4. 4A state agency that deploys or uses a heightened scrutiny system, or a vendor contracting with it to do so, must assess risks of unlawful harm, system limitations and information governance practices; assessments go to DIR on request and are confidential (§ 2054.708)
5. 5Notice: state agencies must disclose public-facing AI unless a reasonable person would know it is AI; state agencies and local governments using public-facing AI or AI that is a controlling factor in a consequential decision must post a standardized DIR notice on related applications, websites and public computer systems (public hospitals and academic medical centers may use a general statement in patient consent forms) (§§ 2054.707, 2054.711)
6. 6Enforcement: agencies and vendors must report known violations to DIR (if applicable) and the Attorney General, who may sue to enjoin them; a vendor that fails to respond or cure before the 31st day after notice gets a notice of intent to void the contract, and if still uncured before the 31st day after that, the agency may void it; DIR refers vendors with more than one voided contract to the comptroller, which may bar them from state contracts. The Attorney General must run an AI complaint web page (§§ 2054.709, 2054.710)
7. 7Also: AI inventories in agency IT reports; local governments must review their heightened scrutiny systems and give the review to DIR on request; DIR training materials and forums; an eight-member public sector AI advisory board; a DIR sandbox in which eligible DIR customers test AI with DIR-registered vendors (quarterly reports); agencies with 150 or fewer employees may designate or share a data management officer (§§ 2054.068, 2054.0965, 2054.137, 2054.704-2054.706)
8. 8Signed by the Governor June 20, 2025 (Chapter 1148); effective September 1, 2025; DIR rules and the complaint web page are due as soon as practicable, and DIR and the Attorney General report to the Legislature by November 30 of each even-numbered year

Latest legislative action

Jun 20, 2025. Signed by the Governor; effective on 9/1/25

Sponsors

Roll call votes (showing 3 of 4)