Insight
AI Data Duties in Texas Processor Contracts
HB 149 added AI to a processor’s security assistance duty under the Texas Data Privacy and Security Act (TDPSA). It did not add a new mandatory contract clause.
Law checked through
Section 3 of HB 149 amended Business and Commerce Code § 541.104(a), which lists how a processor must assist a controller under the Texas Data Privacy and Security Act. The processor’s duty to help with the security of processing personal data now expressly includes personal data collected, stored or processed by an artificial intelligence system (Business and Commerce Code § 541.104(a)(2)). The other assistance duties remain: helping with consumer rights requests, breach notification under chapter 521 and data protection assessments.
The contract requirements in Business and Commerce Code § 541.104(b) were not changed. A controller does not need a new “AI clause” to comply. What changes is the content of the security assistance a controller can expect: where a vendor’s AI system handles personal data, the vendor must help secure that processing as part of its statutory duty.
In practice, controllers will want contract language that makes the duty concrete: a description of how the vendor’s AI components store and protect personal data, notice of changes to models or data flows, and cooperation in assessments that cover AI processing. Those are negotiated terms built on a statutory baseline.