Texas AI Law

Guide

AI Vendor Contracts

The terms that matter in an AI services agreement, which ones Texas law requires, and how Texas courts read risk-shifting clauses.

Law checked through

Short Answer

Texas law mandates particular AI vendor terms only in covered relationships. Texas Data Privacy and Security Act (TDPSA) Business and Commerce Code § 541.104(b) specifies controller-processor contract terms. Government Code § 2054.708 to .709 address covered government systems and vendor compliance. Other terms allocate commercial risk: permitted data use, outputs, IP claims, security, accuracy, changes and exit. Texas fair-notice and express-negligence rules matter when an indemnity shifts a party’s own negligence; they do not convert every vendor indemnity into the same clause. Start with the legal role and the promised task, then test the actual contract against them.

Which Laws Apply

  • Texas AI-specific: Business and Commerce Code § 552.103(b) and Business and Commerce Code § 552.105(e)(1) (misuse by another person); Government Code § 2054.708 and Government Code § 2054.709 for government contracts.
  • Generally applicable Texas law: Texas Data Privacy and Security Act (TDPSA) Business and Commerce Code § 541.104; Texas Uniform Trade Secrets Act (TUTSA); Uniform Electronic Transactions Act (UETA) Business and Commerce Code § 322.014; Deceptive Trade Practices-Consumer Protection Act (DTPA) waiver rules; Texas contract law.
  • Federal: Health Insurance Portability and Accountability Act (HIPAA) business associate terms where applicable; Children’s Online Privacy Protection Act (COPPA) for services directed to children.

Required Terms

When a vendor processes personal data for a controller under the TDPSA, the contract must contain the terms listed in Business and Commerce Code § 541.104(b). HB 149 also expanded the processor’s duty to assist with security to cover personal data processed by an AI system (Business and Commerce Code § 541.104(a)(2)). A health care customer will need a HIPAA business associate agreement. A state agency or local government buying a heightened scrutiny system must obtain an impact assessment and can void the contract if the vendor violates SB 1964 and does not cure (Government Code § 2054.708, Government Code § 2054.709).

Negotiated Terms Worth Addressing

TermIssue
Data use and trainingWhether inputs and outputs may train or improve models; opt-out mechanics; treatment of aggregated or de-identified data
Retention and deletionPeriods for prompts, outputs, logs and backups; deletion on termination; legal hold cooperation
ConfidentialityTreatment of inputs as the customer’s confidential information, which supports trade secret “reasonable measures”
SubprocessorsNotice and objection rights; flow-down of terms
OutputsOwnership or license of outputs; no vendor claim to customer outputs
InfringementIndemnity for claims that the model or outputs infringe; exclusions for customer prompts
Accuracy and performanceWarranties, service levels, disclaimers; what substantiation the vendor will provide for marketed metrics
Model changesNotice before material changes to models, terms or data practices; right to retest or exit
Regulatory cooperationHelp responding to a Texas Responsible Artificial Intelligence Governance Act (TRAIGA) civil investigative demand, which may ask for training data types, metrics, limitations and monitoring (Business and Commerce Code § 552.103(b))
MisuseAllocation of responsibility when the other party or a third party misuses the system; TRAIGA excuses a defendant whose system was misused by another (Business and Commerce Code § 552.105(e)(1))
ExitData return, transition assistance, deletion certificates

Texas Rules on Risk Shifting

Ethyl Corp. v. Daniel Construction Co., 725 S.W.2d 705, 708 (Tex. 1987), requires intent to indemnify a party for its own negligence to be stated expressly within the contract. Dresser Industries v. Page Petroleum, 853 S.W.2d 505, 508 to 509 (Tex. 1993), applies fair-notice requirements to indemnities and advance releases of a party’s own negligence. Statutory anti-indemnity rules can impose further limits in particular industries. Consumer waivers face Business and Commerce Code § 17.42’s conditions, including a conspicuous signed waiver, independent counsel and the prescribed language. A vendor’s standard disclaimer is not a reliable substitute for that analysis.

Agent Actions and Electronic Contracts

If the AI service will place orders, accept terms or send communications on the customer’s behalf, the contract should say who bears the risk of an agent’s mistake. Texas’s Uniform Electronic Transactions Act already allows contracts to form through electronic agents without human review (Business and Commerce Code § 322.014). See AI Agents and Contract Formation.

Illustrative Example (Hypothetical)

A Texas hospital system licenses an AI documentation tool. It needs a business associate agreement, TDPSA processor terms for any non-HIPAA personal data, a no-training commitment for patient data, retention limits for audio and transcripts, an infringement indemnity, notice of model changes and the vendor’s help if the Attorney General issues a civil investigative demand about the tool’s performance.

What Is Unsettled

Coverage under the DTPA depends on the consumer definition in Business and Commerce Code § 17.45(4), the transaction and the exemptions. The definition excludes a business consumer with assets of $25 million or more, or that is owned or controlled by a corporation or entity with assets of $25 million or more. That exclusion turns on the actual purchaser’s assets and control, not on business status in general, and the exemptions in Business and Commerce Code § 17.49 require the same transaction-by-transaction check. It is not an exemption for all business buyers or all vendors. Output disclaimers, accuracy claims and negotiated limitations must be read together. Whether a particular clause allocates the asserted loss is a contract question, not a general AI exemption.

Sources