AN ACT
 	relating to the regulation of the use of artificial intelligence
 	systems in this state; providing civil penalties.
 	       BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
 	       SECTION 1.  This Act may be cited as the Texas Responsible
 	Artificial Intelligence Governance Act
 	       SECTION 2.  Title 11, Business & Commerce Code, is amended by
 	adding Subtitle D to read as follows:
 	SUBTITLE D. ARTIFICIAL INTELLIGENCE PROTECTION
 	CHAPTER 551. ARTIFICIAL INTELLIGENCE PROTECTION
 	SUBCHAPTER A. GENERAL PROVISIONS
 	       Sec. 551.001.  DEFINITIONS. In this chapter:
 	             (1)  "Artificial intelligence system" means the use of
 	machine learning and related technologies that use data to train
 	statistical models for the purpose of enabling computer systems to
 	perform tasks normally associated with human intelligence or
 	perception, such as computer vision, speech or natural language
 	processing, and content generation.
 	             (2)  "Biometric identifier" means a retina or iris
 	scan, fingerprint, voiceprint, or record of hand or face geometry.
 	             (3)  "Council" means the Artificial Intelligence
 	Council established under Chapter 553.
 	             (4)  "Consumer" means an individual who is a resident
 	of this state acting only in an individual or household context.
 	The term does not include an individual acting in a commercial or
 	employment context.
 	             (5)  "Deploy" means to put into effect or
 	commercialize.
 	             (6)  "Deployer" means a person doing business in this
 	state that deploys an artificial intelligence system.
 	             (7)  "Developer" means a person doing business in this
 	state that develops an artificial intelligence system.
 	             (8)  "Distributor" means a person, other than the
 	Developer or Deployer, that makes an artificial intelligence system
 	available in the market for a commercial purpose.
 	             (9)  "Health care service or treatment" means a health
 	care treatment, service, or procedure designed to maintain, treat,
 	diagnose, prevent, alleviate, cure, or heal a patient's physical or
 	mental condition, illness, injury, or disease, including
 	preventative care.
 	             (10)  "Interactive computer service" has the meaning
 	assigned by Section 323.001, Business and Commerce Code.
 	             (11)  "Personal data" has the meaning assigned to it by
 	Section 541.001, Business and Commerce Code.
 	             (12)  "Personal data" has the meaning assigned to it by
 	Section 541.001, Business and Commerce Code.
 	             (13)  "Political viewpoint discrimination" means the
 	intentional limitation of a person's ability to express or receive
 	the expression of another person based solely on the person's
 	political beliefs, opinions, or affiliation.
 	             (14)  "Sensitive personal attribute" means race,
 	political opinions, religious or philosophical beliefs, ethnic
 	orientation, mental health diagnosis, or sex. The term does not
 	include conduct that would be classified as an offense under
 	Chapter 21, Penal Code.
 	       Sec. 551.002.  APPLICABILITY OF CHAPTER.  This chapter
 	applies to a person that:
 	             (1)  conducts business, promotes, or advertises in this
 	state or produces a product or service consumed by residents of this
 	state; or
 	             (2)  engages in the development, distribution, or
 	deployment of an artificial intelligence system in this state; and
 	       Sec. 551.003.  SANDBOX PROGRAM EXCEPTION. Excluding
 	violations of Subchapter B, this chapter does not apply to the
 	development of an artificial intelligence system that is used
 	exclusively for research, training, testing, or other
 	pre-deployment activities performed by active participants of the
 	sandbox program in compliance with Chapter 552.
 	       Sec. 551.004.  DISCLOSURE OF AN ARTIFICIAL INTELLIGENCE
 	SYSTEM TO CONSUMERS. (a) A government agency that makes available
 	an artificial intelligence system that is intended to interact with
 	consumers shall disclose to each consumer, before or at the time of
 	interaction:
 	             (1)  that the consumer is interacting with an
 	artificial intelligence system;
 	       (b)  Disclosure is required under subsection (a) of this
 	section regardless of whether it would be obvious to a reasonable
 	person that the person is interacting with an artificial
 	intelligence system.
 	       (c)  All disclosures under subsection (a) shall be clear and
 	conspicuous and written in plain language, and avoid the use of a
 	dark pattern as defined by 541.001, Business & Commerce Code.
 	       (d)  All disclosures under subsection (a) may be linked to a
 	separate webpage of the developer or deployer.
 	       (e)  Any requirement in this section that may conflict with
 	state or federal law may be exempt.
 	       (f)  Any disclosure in a Health care service or treatment may
 	be prescribed to a consumer through entry waiver forms.
 	SUBCHAPTER B. PROHIBITED USES
Sec. 551.051.  MANIPULATION OF HUMAN BEHAVIOR TO INCITE HARM
 	OR CRIMINALITY. An artificial intelligence system shall not be
 	intentionally developed or deployed to incite or encourage a person
 	to:
 	             (1)  commit physical self-harm, including suicide;
 	             (2)  harm another person; or
 	             (3)  engage in criminal activity.
 	       Sec. 551.052.  MANIPULATION OF HUMAN BEHAVIOR TO CIRCUMVENT
 	INFORMED DECISION-MAKING. An artificial intelligence system shall
 	not intentionally use Deceptive Trade Practices, as defined by
 	Chapter 17 of the Texas Business and Commerce Code
Sec.551.053.  SOCIAL SCORING. (a) The use by a government
 	entity of AI systems for the evaluation or classification of
 	natural persons or groups of persons over a certain period of time
 	based on their social behavior or known, inferred or predicted
 	personal or personality characteristics, with the social score
 	leading to all of the following shall be prohibited:
 	             (i)  detrimental or unfavorable treatment of certain
 	natural persons or groups of persons in social contexts that are
 	unrelated to the contexts in which the data was originally
 	generated or collected;
 	             (ii)  detrimental or unfavorable treatment of certain
 	natural persons or groups of persons that is unjustified or
 	disproportionate to their social behavior or its gravity; and
 	             (iii)  infringement, constraining, or otherwise
 	chilling of any right guaranteed under the United States
 	Constitution, the Texas Constitution, federal law, or Texas law.
 	       (b)  This section applies to government entities using
 	artificial intelligence systems to constrain civil liberties, not
 	any artificial intelligence system developed or deployed for
 	commercial purposes.
Sec. 551.054.  CAPTURE OF BIOMETRIC IDENTIFIERS USING
 	ARTIFICIAL INTELLIGENCE. (a) A government entity in this state
 	shall not develop or deploy an artificial intelligence system
 	developed with biometric identifiers of individuals and the
 	targeted or untargeted gathering of images or other media from the
 	internet or any other publicly available source shall not be
 	deployed for the purpose of uniquely identifying a specific
 	individual, if it would infringe, constrain, or otherwise chill any
 	right guaranteed under the United States Constitution, the Texas
 	Constitution, federal law, or Texas law.
 	       (b)  An individual is not considered to be informed nor to
 	have provided consent for such purpose pursuant to Section 503.001,
 	Business and Commerce Code, based solely upon the existence on the
 	internet, or other publicly available source, of an image or other
 	media containing one or more biometric identifiers.
 	       (c)  This section applies to systems designed for government
 	entities to constrain civil liberties, not any artificial
 	intelligence system developed or deployed for commercial purposes
 	or any other government entity purpose.
Sec. 551.056.  POLITICAL VIEWPOINT DISCRIMINATION. (a) An
 	artificial intelligence system shall not be developed or deployed
 	in a manner that intentionally results in political viewpoint
 	discrimination or otherwise intentionally infringes upon a
 	person's freedom of association or ability to freely express the
 	person's beliefs or opinions.
 	       (b)  An interactive computer service may not, through the use
 	of an artificial intelligence system:
 	             (1)  block, ban, remove, de-platform, demonetize,
 	debank, de-boost, restrict, or otherwise discriminate against a
 	user based on the user's political speech; or
 	             (2)  modify or manipulate a user's content or posting
 	for the purpose of censoring the user's political speech.
 	       (c)  The prohibitions in subsection (b) apply regardless of
 	whether the actions of the interactive computer service are
 	automated or conducted with human oversight.
 	       (d)  This section does not apply to speech that:
 	             (1)  is illegal under federal or state law;
 	             (2)  constitutes a credible threat of violence or
 	incitement to imminent lawless action;
 	             (3)  contains obscene material as defined by Section
 	43.21, Penal Code;
 	             (4)  Contains unlawful deep fake video or image in
 	violation of Section 21.165, Penal Code; or
 	             (5)  violates intellectual property rights under
 	applicable law.
 	       (e)  This section shall be construed to be consistent with
 	applicable federal law, including 47 U.S.C. Section 230, and the
 	United States Constitution.
Sec. 551.058.  UNLAWFUL DISCRIMINATION. An artificial
 	intelligence system shall not be developed or deployed with the
 	intent to unlawfully discriminate against a protected class in
 	violation of the laws of this state or federal law. Disparate impact
 	alone is not sufficient to show intent to discriminate.
Sec. 551.061.  CERTAIN SEXUALLY EXPLICIT VIDEOS, IMAGES, AND
 	CHILD PORNOGRAPHY.  An artificial intelligence system shall not be
 	developed or deployed with the sole intent of producing, assisting
 	or aiding in producing, or distributing unlawful visual material in
 	violation of Section 43.26, Penal Code or an unlawful deep fake
 	video or image in violation of Section 21.165, Penal Code. Factors
 	to be considered in evaluating the primary purpose or function of an
 	artificial intelligence system shall include marketing materials
 	and terms of use associated with the system.
SUBCHAPTER C.  ENFORCEMENT AND CONSUMER PROTECTIONS
 	       Sec. 551.101.  CONSTRUCTION AND APPLICATION. (a) This
 	chapter shall be broadly construed and applied to promote its
 	underlying purposes, which are:
 	             (1)  to facilitate and advance the responsible
 	development and use of artificial intelligence systems;
 	             (2)  to protect individuals and groups of individuals
 	from known, and unknown but reasonably foreseeable, risks
 	associated with artificial intelligence;
 	             (3)  to provide transparency regarding those risks in
 	the development, deployment, or use of artificial intelligence
 	systems; and
 	             (4)  to provide reasonable notice regarding the use of
 	artificial intelligence systems by state agencies.
Sec. 551.102.  ENFORCEMENT AUTHORITY. The attorney general
 	has authority to enforce this chapter. Excluding, researching,
 	training, testing, or the conducting of other pre-deployment or
 	post-deployment activities by active participants of the sandbox
 	program, in compliance with Chapter 552, does not subject a
 	developer or deployer to penalties or actions.
 	       Sec. 551.103.  INTERNET WEBSITE AND COMPLAINT MECHANISM.
 	The attorney general shall post on the attorney general's Internet
 	website an online mechanism through which a consumer may submit a
 	complaint under this chapter to the attorney general.
Sec. 551.104.  INVESTIGATIVE AUTHORITY. (a) If the
 	attorney general receives a complaint alleging a violation of this
 	chapter through the online mechanism established under Section
 	551.103, the attorney general may issue a civil investigative
 	demand.  The attorney general shall issue such demands in
 	accordance with and under the procedures established under Section
 	15.10.
 	       (b)  The attorney general may request from the associated
 	party, pursuant to a civil investigative demand issued under
 	Subsection (a), any one of the following;
 	             (1)  A High Level Statement disclosing the purpose,
 	intended use cases, and deployment context of, and benefits
 	afforded by, the artificial intelligence system;
 	             (2)  a High Level description of the categories of data
 	the artificial intelligence system processes as inputs and the
 	outputs the artificial intelligence system produces;
 	             (3)  any metrics used to evaluate the performance and
 	known limitations of the artificial intelligence system;
 	             (4)  a High Level description of the post-deployment
 	monitoring and user safeguards provided concerning the artificial
 	intelligence system, including the oversight, use, and learning
 	process established by the deployer to address issues arising from
 	the deployment of the artificial intelligence system;
 	             (5)  a high-level summary of the type of data used to
 	program or train the artificial intelligence system; or
 	             (6)  Any other relevant documentation reasonably
 	necessary for the attorney general to conduct an investigation and
 	determine liability or fault of the offender.
 	       (c)  The attorney general may not institute an action for a
 	civil penalty against a developer or deployer for artificial
 	intelligence systems that remain isolated from customer
 	interaction in a pre-deployment environment.
Sec. 551.105.  NOTICE OF VIOLATION OF CHAPTER; OPPORTUNITY
 	TO CURE. (a) Before bringing an action under Section 551.106, the
 	attorney general shall notify a developer, distributor, or deployer
 	in writing, not later than the 60th day before bringing the action,
 	identifying the specific provisions of this chapter the attorney
 	general alleges have been or are being violated. The attorney
 	general may not bring an action against the developer or deployer
 	if:
 	             (1)  within the 60-day period, the developer or
 	deployer cures the identified violation; and
 	             (2)  the developer or deployer provides the attorney
 	general a written statement that the developer or deployer:
 	                   (A)  cured the alleged violation;
 	                   (B)  notified the consumer, if technically
 	feasible, and the council that the developer or deployer's
 	violation was addressed, if the consumer's contact information has
 	been made available to the developer or deployer and the attorney
 	general;
 	                   (C)  provided supportive documentation to show
 	how the violation was cured; and
 	                   (D)  made changes to internal policies, if
 	necessary, to reasonably ensure that no such further violations are
 	likely to occur.
 	       (b)  In any action brought forward by the attorney general or
 	any violation of this chapter, it shall be an affirmative defense
 	that the developer, deployer, or other person:
 	             (1)  discovers and cures an identified violation under
 	Subchapter B through:
 	                   (A)  feedback that the developer, deployer, or
 	other person encourages deployers or users to provide to such
 	developer, deployer, or other person;
 	                   (B)  testing, such as adversarial testing or
 	red-teaming;
 	                   (C)  an internal review process; and is otherwise
 	in compliance with the latest version of the Artificial
 	Intelligence Risk Management Framework published by the National
 	Institute of Standards and Technology, ISO/IEC 42001, or another
 	nationally or internationally recognized risk management framework
 	for artificial intelligence systems; or
 	                   (D)  following guidelines set by state agencies as
 	appropriate.
Sec. 551.106.  CIVIL PENALTY; INJUNCTION. (a) The attorney
 	general may bring an action in the name of this state to restrain or
 	enjoin the person from violating this chapter and seek injunctive
 	relief.
 	       (b)  The attorney general may recover reasonable attorney's
 	fees and other reasonable expenses incurred in investigating and
 	bringing an action under this section.
 	       (c)  The attorney general may assess and collect an
 	administrative fine against a developer or deployer who fails to
 	timely cure a violation or who breaches a written statement
 	provided to the attorney general, of not less than $10,000 and not
 	more than $12,000 per uncured violation.
 	       (d)  The attorney general may assess and collect an
 	administrative fine against a developer or deployer who fails to
 	timely cure a violation that is determined to be uncurable, of not
 	less than $80,000 and not more than $200,000 per violation after
 	conviction of such violation.
 	       (e)  A developer or deployer who was found in violation of
 	and continues to operate with the provisions of this chapter shall
 	be assessed an administrative fine of not less than $2,000 and not
 	more than $40,000 per day.
 	       (f)  There is a rebuttable presumption that a developer,
 	distributor, or deployer used reasonable care as required under
 	this chapter if the developer, distributor, or deployer complied
 	with their duties in preventing violations under Subchapter B.
 	       (g)  A developer, distributor, or deployer may seek an
 	expedited hearing or other process, including a request for
 	declaratory judgment, if the developer, distributor, or deployer
 	believes its actions have not violated this chapter.
Sec. 551.107.  ENFORCEMENT ACTIONS BY STATE AGENCIES. (a) A
 	state agency may sanction an individual licensed, registered, or
 	certified by that agency for violations of Subchapter B, including:
 	             (1)  the suspension, probation, or revocation of a
 	license, registration, certificate, or other form of permission to
 	engage in an activity; and
 	             (2)  monetary penalties up to $100,000.
 	       (b)  a state agency may not sanction an individual that is
 	licensed, registered, or certified by that agency for violations of
 	Subchapter B until individuals or entities have been sentenced for
 	violations of this chapter, and received recommendations from the
 	attorney general for subsequent enforcement.
 	       Sec. 551.108.  CONSUMER RIGHTS AND REMEDIES. A consumer may
 	appeal decision made by an artificial intelligence system which has
 	an adverse impact on their health, welfare, safety, or fundamental
 	rights, and shall have the right to obtain from the deployer clear
 	and meaningful explanations of the role of the artificial
 	intelligence system in the decision-making procedure and the main
 	elements of the decision taken.
SUBCHAPTER D. CONSTRUCTION OF CHAPTER; LOCAL PREEMPTION
 	       Sec. 551.151.  CONSTRUCTION OF CHAPTER. This chapter may
 	not be construed as imposing a requirement on a developer, a
 	deployer, or other person that adversely affects the rights or
 	freedoms of any person, including the right of free speech.
 	       Sec. 551.152.  LOCAL PREEMPTION. This chapter supersedes
 	and preempts any ordinance, resolution, rule, or other regulation
 	adopted by a political subdivision regarding the use of artificial
 	intelligence systems.
CHAPTER 552. ARTIFICIAL INTELLIGENCE REGULATORY SANDBOX PROGRAM
 	SUBCHAPTER A. GENERAL PROVISIONS
 	       Sec. 552.001.  DEFINITIONS. In this chapter:
 	             (1)  "Applicable agency" means a state agency
 	responsible for regulating a specific sector impacted by an
 	artificial intelligence system.
 	             (2)  "Consumer" means a person who engages in
 	transactions involving an artificial intelligence system or is
 	directly affected by the use of such a system.
 	             (3)  "Council" means the Artificial Intelligence
 	Council established by Chapter 553.
 	             (4)  "Department" means the Texas Department of
 	Information Resources
 	             (5)  "Program participant" means a person or business
 	entity approved to participate in the sandbox program.
 	             (6)  "Sandbox program" means the regulatory framework
 	established under this chapter that allows temporary testing of
 	artificial intelligence systems in a controlled, limited manner
 	without full regulatory compliance.
SUBCHAPTER B. SANDBOX PROGRAM FRAMEWORK
Sec. 552.051.  ESTABLISHMENT OF SANDBOX PROGRAM. (a) The
 	department, in coordination with the council, shall administer the
 	Artificial Intelligence Regulatory Sandbox Program to facilitate
 	the development, testing, and deployment of innovative artificial
 	intelligence systems in Texas.
 	       (b)  The sandbox program is designed to:
 	             (1)  promote the safe and innovative use of artificial
 	intelligence across various sectors including healthcare, finance,
 	education, and public services;
 	             (2)  encourage the responsible deployment of
 	artificial intelligence systems while balancing the need for
 	consumer protection, privacy, and public safety; and
 	             (3)  provide clear guidelines for artificial
 	intelligence developers to test systems while temporarily exempt
 	from certain regulatory requirements.
Sec. 552.052.  APPLICATION PROCESS. (a) A person or
 	business entity seeking to participate in the sandbox program must
 	submit an application to the council.
 	       (b)  The application must include:
 	             (1)  a detailed description of the artificial
 	intelligence system and its intended use;
 	             (2)  a benefit assessment that addresses potential
 	impacts on consumers, privacy, or public safety;
 	             (3)  a plan for mitigating any adverse consequences
 	during the testing phase; and
 	             (4)  proof of compliance with federal artificial
 	intelligence laws and regulations, where applicable.
Sec. 552.053.  DURATION AND SCOPE OF PARTICIPATION. A
 	participant may test and deploy an artificial intelligence system
 	under the sandbox program for a period of up to 36 months, unless
 	extended by the department for good cause.
SUBCHAPTER C. OVERSIGHT AND COMPLIANCE
 	       Sec. 552.101.  AGENCY COORDINATION. (a) The department
 	shall coordinate with all relevant state regulatory agencies to
 	oversee the operations of the sandbox participants.
 	       (b)  The council or a relevant agency may recommend to the
 	department that a participant's sandbox privileges be revoked if
 	the artificial intelligence system:
 	             (1)  poses undue risk to public safety or welfare;
 	             (2)  violates any federal or state laws that the
 	sandbox program cannot override.
Sec. 552.102.  REPORTING REQUIREMENTS. (a) Each sandbox
 	participant must submit quarterly reports to the department, which
 	shall include:
 	             (1)  system performance metrics;
 	             (2)  updates on how the system mitigates any risks
 	associated with its operation; and
 	             (3)  feedback from consumers and affected stakeholders
 	that are using a product that has been deployed from this section.
 	       (b)  The department must submit an annual report to the
 	legislature detailing:
 	             (1)  the number of participants in the sandbox program;
 	             (2)  the overall performance and impact of artificial
 	intelligence systems tested within the program; and
 	             (3)  recommendations for future legislative or
 	regulatory reforms.
 	       (c)  The council shall maintain the confidentiality of the
 	intellectual property, trade secrets, and other sensitive
 	information of the sandbox.
CHAPTER 553. TEXAS ARTIFICIAL INTELLIGENCE COUNCIL
 	SUBCHAPTER A. CREATION AND ORGANIZATION OF COUNCIL
 	       Sec. 553.001.  CREATION OF COUNCIL. (a) The Artificial
 	Intelligence Council is administratively attached to the Texas
 	Department of Information Resources, and the office shall provide
 	administrative support to the council as provided by this section.
 	       (b)  The office and the council shall enter into a memorandum
 	of understanding detailing:
 	             (1)  the administrative support the council requires
 	from the office to fulfill the purposes of this chapter;
 	             (2)  the reimbursement of administrative expenses to
 	the office; and
 	             (3)  any other provisions available by law to ensure
 	the efficient operation of the council as attached to the office.
 	       (c)  The purpose of the council is to:
 	             (1)  ensure artificial intelligence systems are
 	ethical and in the public's best interest and do not harm public
 	safety or undermine individual freedoms by finding gaps in the
 	Penal Code and Chapter 82, Civil Practice and Remedies Code and
 	making recommendations to the Legislature.
 	             (2)  identify existing laws and regulations that impede
 	innovation in artificial intelligence development and recommend
 	appropriate reforms;
 	             (3)  analyze opportunities to improve the efficiency
 	and effectiveness of state government operations through the use of
 	artificial intelligence systems and make recommendations to
 	applicable state agencies regarding the use of artificial
 	intelligence to improve the efficiency and effectiveness of agency
 	operations;
 	             (4)  investigate and evaluate potential instances of
 	regulatory capture, including undue influence by technology
 	companies or disproportionate burdens on smaller innovators
 	through the use of artificial intelligence systems;
 	             (5)  investigate and evaluate the influence of
 	technology companies on other companies and determine the existence
 	or use of tools or processes designed to censor competitors or users
 	through the use of artificial intelligence systems;
 	             (6)  offer guidance and recommendations to the state
 	legislature on the ethical and legal use of artificial
 	intelligence;
 	             (7)  conduct and publish a study of the current
 	artificial intelligence regulatory environment; and
 	             (8)  in coordination with the Department of Information
 	Resources, monitor the Artificial Intelligence Regulatory Sandbox
 	Program established under Chapter 552 and make recommendations for
 	improvements to the program.
Sec. 553.002.  COUNCIL MEMBERSHIP. (a) The council is
 	composed of 10 members as follows:
 	             (1)  four members of the public appointed by the
 	governor;
 	             (2)  two members of the public appointed by the
 	lieutenant governor;
 	             (3)  two members of the public appointed by the speaker
 	of the house of representatives;
 	             (4)  one senator appointed by the lieutenant governor
 	as a nonvoting member; and
 	             (5)  one member of the house of representatives
 	appointed by the speaker of the house of representatives as a
 	nonvoting member.
 	       (b)  Voting members of the council serve staggered four-year
 	terms, with the terms of four members expiring every two years.
 	       (c)  The governor shall appoint a chair from among the
 	members, and the council shall elect a vice chair from its
 	membership.
 	       (d)  The council may establish an advisory board composed of
 	individuals from the public who possess expertise directly related
 	to the council's functions, including technical, ethical,
 	regulatory, and other relevant areas.
Sec. 553.003.  QUALIFICATIONS. (a) Members of the council
 	must be Texas residents and have knowledge or expertise in one or
 	more of the following areas:
 	             (1)  artificial intelligence technologies;
 	             (2)  data privacy and security;
 	             (3)  ethics in technology or law;
 	             (4)  public policy and regulation;
 	             (5)  risk management related to artificial
 	intelligence systems;
 	             (6)  expertise in improving the efficiency and
 	effectiveness of government operations; or
 	             (7)  expertise in anti-competitive practices and
 	market fairness.
 	       Sec. 553.004.  STAFF AND ADMINISTRATION. (a) The council
 	may employ an executive director and other personnel as necessary
 	to perform its duties.
 	       (b)  The council, its administration, and its staff must not
 	account for more than 4% of the budget of the department of
 	information resources.
SUBCHAPTER B. POWERS AND DUTIES OF THE COUNCIL
Sec. 553.101.  ISSUANCE OF ADVISORY REPORTS. (a) The
 	council may issue reports to the state legislature regarding the
 	use of artificial intelligence systems in the state.
 	       (b)  The council may issue reports on state use of artificial
 	intelligence systems regarding:
 	             (1)  the compliance of artificial intelligence systems
 	with Texas law;
 	             (2)  the ethical implications of artificial
 	intelligence deployments in the state;
 	             (3)  data privacy and security concerns related to
 	artificial intelligence systems; or
 	             (4)  potential liability or legal risks associated with
 	the use of AI.
 	       Sec. 553.102.  TRAINING AND EDUCATIONAL OUTREACH. The
 	council shall conduct training programs for state agencies and
 	local governments on the use of artificial intelligence systems.
Sec. 553.103.  LIMITATION OF AUTHORITY. (a) The council may
 	not:
 	       (1)  Promulgate rules, regulations, binding guidance, or
 	anything construed as regulations or guidance on any entity or
 	agency; or
 	       (2)  Interfere with or override state agency operations.
 	(b)  The council's duties are limited to providing evaluations,
 	       SECTION 3.  Section 503.001, Business & Commerce Code is
 	amended by adding Subsection (c-3) to read as follows:
 	       (c-3)  This section does not apply to the training,
 	processing, or storage of biometric identifiers involved in
 	artificial intelligence systems, as defined by Section 551.001,
 	unless performed for the purpose of uniquely identifying a specific
 	individual.  If a biometric identifier captured for the purpose of
 	training an artificial intelligence system is subsequently used for
 	a commercial purpose, the person possessing the biometric
 	identifier is subject to this section's provisions for the
 	possession and destruction of a biometric identifier and the
 	associated penalties.
SECTION 4.  Sec.541.104(a), Business & Commerce Code is
 	amended to read as follows:
 	       Sec. 541.104.  DUTIES OF PROCESSOR. (a) A processor shall
 	adhere to the instructions of a controller and shall assist the
 	controller in meeting or complying with the controller's duties or
 	requirements under this chapter, including:
 	             (1)  assisting the controller in responding to consumer
 	rights requests submitted under Section 541.051 by using
 	appropriate technical and organizational measures, as reasonably
 	practicable, taking into account the nature of processing and the
 	information available to the processor;
 	             (2)  assisting the controller with regard to complying
 	with the [requirement]requirements relating to the security of
 	processing personal data, and if applicable, the data collected,
 	stored, and processed by artificial intelligence systems and to the
 	notification of a breach of security of the processor's system
 	under Chapter 521, taking into account the nature of processing and
 	the information available to the processor; and
 	             (3)  providing necessary information to enable the
 	controller to conduct and document data protection assessments
 	under Section 541.105.
SECTION 5.  Section 325.011, Government Code, is amended to
 	read as follows:
 	       Sec. 325.011.  CRITERIA FOR REVIEW. The commission and its
 	staff shall consider the following criteria in determining whether
 	a public need exists for the continuation of a state agency or its
 	advisory committees or for the performance of the functions of the
 	agency or its advisory committees:
 	             (1)  the efficiency and effectiveness with which the
 	agency or the advisory committee operates;
 	             (2)(A)  an identification of the mission, goals, and
 	objectives intended for the agency or advisory committee and of the
 	problem or need that the agency or advisory committee was intended
 	to address; and
 	                   (B)  the extent to which the mission, goals, and
 	objectives have been achieved and the problem or need has been
 	addressed;
 	             (3)(A)  an identification of any activities of the
 	agency in addition to those granted by statute and of the authority
 	for those activities; and
 	                   (B)  the extent to which those activities are
 	needed;
 	             (4)  an assessment of authority of the agency relating
 	to fees, inspections, enforcement, and penalties;
 	             (5)  whether less restrictive or alternative methods of
 	performing any function that the agency performs could adequately
 	protect or provide service to the public;
 	             (6)  the extent to which the jurisdiction of the agency
 	and the programs administered by the agency overlap or duplicate
 	those of other agencies, the extent to which the agency coordinates
 	with those agencies, and the extent to which the programs
 	administered by the agency can be consolidated with the programs of
 	other state agencies;
 	             (7)  the promptness and effectiveness with which the
 	agency addresses complaints concerning entities or other persons
 	affected by the agency, including an assessment of the agency's
 	administrative hearings process;
 	             (8)  an assessment of the agency's rulemaking process
 	and the extent to which the agency has encouraged participation by
 	the public in making its rules and decisions and the extent to which
 	the public participation has resulted in rules that benefit the
 	public;
 	             (9)  the extent to which the agency has complied with:
 	                   (A)  federal and state laws and applicable rules
 	regarding equality of employment opportunity and the rights and
 	privacy of individuals; and
 	                   (B)  state law and applicable rules of any state
 	agency regarding purchasing guidelines and programs for
 	historically underutilized businesses;
 	             (10)  the extent to which the agency issues and
 	enforces rules relating to potential conflicts of interest of its
 	employees;
 	             (11)  the extent to which the agency complies with
 	Chapters 551 and 552 and follows records management practices that
 	enable the agency to respond efficiently to requests for public
 	information;
 	             (12)  the effect of federal intervention or loss of
 	federal funds if the agency is abolished;
 	             (13)  the extent to which the purpose and effectiveness
 	of reporting requirements imposed on the agency justifies the
 	continuation of the requirement; [and]
 	             (14)  an assessment of the agency's cybersecurity
 	practices using confidential information available from the
 	Department of Information Resources or any other appropriate state
 	agency; and
 	             (15)  an assessment, using information available from
 	the Department of Information Resources, the Attorney General, or
 	any other appropriate state agency, of the agency's use of
 	artificial intelligence systems in its operations and its oversight
 	of the use of artificial intelligence systems by entities or
 	persons under the agency's jurisdiction, and any related impact on
 	the agency's ability to achieve its mission, goals, and objectives.
SECTION 6.  Section 2054.068(b), Government Code, is amended
 	to read as follows:
 	       (b)  The department shall collect from each state agency
 	information on the status and condition of the agency's information
 	technology infrastructure, including information regarding:
 	             (1)  the agency's information security program;
 	             (2)  an inventory of the agency's servers, mainframes,
 	cloud services, and other information technology equipment;
 	             (3)  identification of vendors that operate and manage
 	the agency's information technology infrastructure; [and]
 	             (4)  any additional related information requested by
 	the department; and
 	             (5)  an evaluation of the use, or considered use, of
 	artificial intelligence systems by each state agency.
SECTION 7.  Section 2054.0965(b), Government Code, is
 	amended to read as follows:
 	       Sec. 2054.0965.  INFORMATION RESOURCES DEPLOYMENT REVIEW.
 	       (b)  Except as otherwise modified by rules adopted by the
 	department, the review must include:
 	             (1)  an inventory of the agency's major information
 	systems, as defined by Section 2054.008, and other operational or
 	logistical components related to deployment of information
 	resources as prescribed by the department;
 	             (2)  an inventory of the agency's major databases,
 	artificial intelligence systems, and applications;
 	             (3)  a description of the agency's existing and planned
 	telecommunications network configuration;
 	             (4)  an analysis of how information systems,
 	components, databases, applications, and other information
 	resources have been deployed by the agency in support of:
 	                   (A)  applicable achievement goals established
 	under Section 2056.006 and the state strategic plan adopted under
 	Section 2056.009;
 	                   (B)  the state strategic plan for information
 	resources; and
 	                   (C)  the agency's business objectives, mission,
 	and goals;
 	             (5)  agency information necessary to support the state
 	goals for interoperability and reuse; and
 	             (6)  confirmation by the agency of compliance with
 	state statutes, rules, and standards relating to information
 	resources.
SECTION 8.  Not later than September 1, 2026, the attorney
 	general shall post on the attorney general's Internet website the
 	online mechanism required by Section 551.041, Business & Commerce
 	Code, as added by this Act.
 	       SECTION 9.  This Act takes effect January 1, 2026.