Governance and Vendors

Short Answer

Start with the proposed task and the information the tool can reach through uploads, integrations and account permissions. Compare the vendor’s binding terms with its product settings: a training opt-out alone does not settle retention, support access or subcontractor use. When the Texas Data Privacy and Security Act applies and the vendor acts as a processor, Business and Commerce Code § 541.104(b) specifies contract terms, and Business and Commerce Code § 541.104(a)(2) now expressly covers assistance with the security of personal data processed by an AI system. Trade secret protection separately depends on reasonable secrecy measures. TRAIGA gives a practical reason to keep records of testing and internal review: several of its defenses turn on how a violation was discovered and whether the business follows a recognized risk framework. The NIST AI Risk Management Framework is voluntary, but TRAIGA names its Generative AI Profile. The first step is to identify the actual use, the actor, the affected information and the source of the asserted duty. Keep the tool’s instructions, applicable terms and material settings with the approval record. A statute, a court order and a practical control have different legal effects. The Guides below explain those differences; the Tracker preserves the effective dates and the dated enforcement or litigation events. Related Insights cover individual developments without replacing the underlying Guide.

Key Authorities

• Companion: Texas IP Law, IP Licenses and Assignments.