Government AI and Public Records

Short Answer

Government AI has requirements beyond TRAIGA. SB 1964 directs an AI code of ethics and heightened-scrutiny standards, with specified assessments and notices. DIR’s implementing rules in 1 Texas Administrative Code Chapter 219 took effect March 18, 2026. Their scope differs for state agencies, higher education and local government; a local government should not assume every state-agency provision applies to it. TRAIGA adds government social-scoring and biometric limits and an agency consumer-facing disclosure duty. A vendor’s uncured statutory breach can affect its government contract. Prompts and outputs made in public business can be public information, subject to applicable exceptions and retention rules. The agency remains responsible for identifying the rule, record and decision.

Which Laws Apply

Texas AI-specific: Government Code chapter 2054, subchapter S (SB 1964) and Government Code 2054.068, Government Code 2054.0965; 1 Texas Administrative Code chapter 219; Business and Commerce Code 552.051(b), Business and Commerce Code 552.053, Business and Commerce Code 552.054; HB 2818; HB 3512.

Generally applicable Texas law: Government Code 552.002 and .021 for public information; Chapter 441, Subchapter L for state records; Local Government Code Chapters 201 to 205 for local-government records; applicable procurement law.

Federal: constitutional limits on government action; FERPA for schools.

The SB 1964 Framework

SB 1964 adds Government Code 2054.701 to .710. Its consequential-decision and heightened-scrutiny definitions appear in Government Code 2054.701 as added by SB 1964, Section 5, not the unrelated DIR division provision with the same section number. The act separates a generally applicable code of ethics from additional heightened-scrutiny safeguards. Its principal requirements are:

An AI code of ethics adopted by DIR, aligned with the NIST AI Risk Management Framework, which state agencies and local governments must adopt (Government Code 2054.702).

Minimum risk management and governance standards for heightened scrutiny systems (Government Code 2054.703).

Inventories of AI systems in agency information resources reviews, and local government reviews of heightened scrutiny systems on DIR’s request (Government Code 2054.0965).

Impact assessments by agencies and their vendors covering risks of unlawful harm, system limitations and information governance; the assessments are confidential and excepted from the Public Information Act (Government Code 2054.708).

Public disclosure that a person is interacting with AI, unless a reasonable person would know (Government Code 2054.707), and standardized notices on applications and websites where AI is public-facing or a controlling factor in a consequential decision (Government Code 2054.711).

A complaint web page maintained by the Attorney General with DIR (Government Code 2054.710).

Enforcement runs through contracts. If the Attorney General, consulting DIR, finds that a vendor violated the subchapter and the vendor does not cure within 31 days, the agency may give notice of intent to void the contract, and may void it if the vendor still does not cure; a vendor with more than one voided contract can be referred to the Comptroller for debarment (Government Code 2054.709).

DIR’s Rules

DIR adopted 1 TAC 219.11 and 219.20 to .24 in the March 13, 2026 Texas Register, effective March 18. The code addresses human oversight, fairness, accuracy, redress, transparency, privacy and security. The minimum standards address governance, written risk and impact assessments, human control and documentation. The adoption notice expressly recognizes limited local-government coverage. It also rejects creating an AI exception to the Public Information Act. Apply the operative rule to the covered entity and system; a school-district summary is not the legal text.

TRAIGA’s Government Provisions

TRAIGA’s social-scoring and biometric restrictions are in Business and Commerce Code 552.053 and .054. The definition of governmental entity excludes hospital districts and institutions of higher education (Business and Commerce Code 552.001(3)). Business and Commerce Code § 552.051 uses governmental agency for its disclosure duty; the wording should not be collapsed into the separate defined term. Government Code 2054.707 contains an obvious-interaction exception, but TRAIGA Business and Commerce Code 552.051(c) requires its disclosure even where AI interaction is obvious. A covered agency must satisfy the overlapping rule; the Government Code exception does not excuse a TRAIGA duty.

Schools

School districts must consider the Government Code and DIR rules applicable to local government, Education Code 26.0031 on parental rights concerning AI assessment of academic performance, and their records duties. Higher education has distinct statutory definitions and exemptions. A vendor’s contract should identify which entity’s obligations it supports instead of relying on a general government-compliant claim.

AI Records and the Public Information Act

The Public Information Act covers information written, produced, collected, assembled or maintained in connection with official business, in any medium. Prompts entered and outputs generated by public employees for official business are therefore likely public information, subject to the Act’s exceptions, and subject to records retention schedules. Agencies should decide how AI chat logs are captured, classified and retained before the first request arrives.

Illustrative Example (Hypothetical)

A Texas county uses an AI tool to pre-screen applications for a rental assistance program. The tool is a controlling factor in a consequential decision, so the county must treat it as a heightened scrutiny system, complete an assessment, post the standardized notice and give applicants a route to redress. The vendor’s contract should allocate the assessment work and the cure obligations under Government Code 2054.709. The prompts and outputs generated in processing applications are county records.

What Is Unsettled

Classification as a heightened-scrutiny system turns on the statutory function and decision, including whether the system is a controlling factor. Public-information exceptions require a records-specific analysis. The public-sector sandbox does not remove retention duties or substitute for the regulatory sandbox authorized by TRAIGA.