Government AI and Public Records

Short Answer

Government AI has requirements beyond the Texas Responsible Artificial Intelligence Governance Act (TRAIGA). SB 1964 directs an AI code of ethics and heightened-scrutiny standards, with specified assessments and notices. Implementing rules from the Texas Department of Information Resources (DIR) in 1 Texas Administrative Code chapter 219 took effect March 18, 2026. Their scope differs for state agencies, higher education and local government; a local government should not assume every state-agency provision applies to it. TRAIGA adds government social-scoring and biometric limits and an agency consumer-facing disclosure duty. A vendor’s uncured statutory breach can affect its government contract. Prompts and outputs made in public business can be public information, subject to applicable exceptions and retention rules. The agency remains responsible for identifying the rule, record and decision.

Which Laws Apply

Texas AI-specific: Government Code chapter 2054, subchapter S (SB 1964) and Government Code § 2054.068, Government Code § 2054.0965; 1 Texas Administrative Code chapter 219; Business and Commerce Code § 552.051(b), Business and Commerce Code § 552.053, Business and Commerce Code § 552.054; HB 2818; HB 3512.

Generally applicable Texas law: Government Code §§ 552.002 and 552.021 for public information; Chapter 441, Subchapter L for state records; Local Government Code Chapters 201 to 205 for local-government records; applicable procurement law.

Federal: constitutional limits on government action; FERPA for schools.

The SB 1964 Framework

SB 1964 adds Government Code §§ 2054.701 to 2054.713 (Subchapter S, as added by SB 1964, Section 5). Its § 2054.701 defines "unlawful harm"; do not confuse it with the unrelated DIR AI division provision in § 2054.701 as added by HB 2818. The act separates a generally applicable code of ethics from additional heightened-scrutiny safeguards. Its principal requirements are:

An AI code of ethics adopted by DIR, aligned with the National Institute of Standards and Technology (NIST) AI Risk Management Framework, which state agencies and local governments must adopt (Government Code § 2054.702).

Minimum risk management and governance standards for heightened scrutiny systems (Government Code § 2054.703).

Inventories of AI systems in agency information resources reviews, and local government reviews of heightened scrutiny systems on DIR’s request (Government Code § 2054.0965).

Impact assessments by agencies and their vendors covering risks of unlawful harm, system limitations and information governance; the assessments are confidential and excepted from the Public Information Act (Government Code § 2054.708).

Public disclosure that a person is interacting with AI, unless a reasonable person would know (Government Code § 2054.707, a state-agency duty).

A distinct standardized notice under Government Code § 2054.711: each state agency and local government deploying or using an AI system that is public-facing or a controlling factor in a consequential decision must include the notice on all related applications, Internet websites, and public computer systems. DIR develops the required form, which must include general information about the system and its data sources and measures taken to maintain compliance with information privacy laws and ethics standards.

A complaint web page maintained by the Attorney General with DIR (Government Code § 2054.710).

Enforcement runs through contracts. If the Attorney General, consulting DIR, finds that a vendor violated the subchapter and the vendor does not cure within 31 days, the agency may give notice of intent to void the contract, and may void it if the vendor still does not cure; a vendor with more than one voided contract can be referred to the Comptroller for debarment (Government Code § 2054.709).

DIR’s Rules

DIR adopted 1 TAC 219.11 and 219.20 to .24 in the March 13, 2026 Texas Register, effective March 18. The code addresses human oversight, fairness, accuracy, redress, transparency, privacy and security. The minimum standards address governance, written risk and impact assessments, human control and documentation. The adoption notice expressly recognizes limited local-government coverage. It also rejects creating an AI exception to the Public Information Act. Apply the operative rule to the covered entity and system; a school-district summary is not the legal text.

TRAIGA’s Government Provisions

TRAIGA’s social-scoring and biometric restrictions are in Business and Commerce Code §§ 552.053 and 552.054. The definition of governmental entity excludes hospital districts and institutions of higher education (Business and Commerce Code § 552.001(3)). Business and Commerce Code § 552.051 uses governmental agency for its disclosure duty; the wording should not be collapsed into the separate defined term. Business and Commerce Code § 552.051(c) expressly requires the governmental agency disclosure even where it would be obvious to a reasonable consumer that the consumer is interacting with an AI system. Government Code § 2054.707 contains its own reasonable-person exception for state-agency public-facing systems, but it does not expressly supply an exception to § 552.051. The reading that satisfies the statutory text is to comply with both duties where they overlap; no authoritative interpretation of the interaction between the two provisions has been located.

Schools

School districts must consider the Government Code and DIR rules applicable to local government, Education Code 26.0031 on parental rights concerning AI assessment of academic performance, and their records duties. Higher education has distinct statutory definitions and exemptions. A vendor’s contract should identify which entity’s obligations it supports instead of relying on a general government-compliant claim.

AI Records and the Public Information Act

The Public Information Act covers information written, produced, collected, assembled or maintained in connection with official business, in any medium. Prompts entered and outputs generated by public employees for official business are therefore likely public information, subject to the Act’s exceptions, and subject to records retention schedules. Agencies should decide how AI chat logs are captured, classified and retained before the first request arrives.

Illustrative Example (Hypothetical)

A Texas county uses an AI tool to pre-screen applications for a rental assistance program. Whether the tool is a heightened scrutiny system turns on the statutory definition, which covers autonomous decision-making and systems with a controlling role in consequential decisions. If county staff meaningfully review each recommendation before acting, the county has an argument that human review keeps the tool outside the category, but meaningful human review does not automatically eliminate every controlling-factor route, so the classification needs a provision-by-provision analysis. If the system is public-facing or a controlling factor in a consequential decision, Government Code § 2054.711 requires the standardized notice on all related applications, websites, and public computer systems. The § 2054.708 impact assessment duty applies to state agencies and vendors contracting with state agencies, so the county should not assume it is required of every county deployment, though the minimum standards developed under § 2054.703 address local governments and the AI code of ethics addresses public redress. The vendor’s contract should allocate any assessment work and the cure obligations under Government Code § 2054.709. The prompts and outputs generated in processing applications are county records.

What Is Unsettled

Classification as a heightened-scrutiny system turns on the statutory function and decision, including whether the system is a controlling factor. Public-information exceptions require a records-specific analysis. The public-sector sandbox does not remove retention duties or substitute for the regulatory sandbox authorized by TRAIGA.