On February 26, 2026, the Texas Department of Information Resources adopted Chapter 219 of Title 1 of the Texas Administrative Code, its rules on artificial intelligence. Senate Bill 1964, passed in 2025, required them. DIR proposed the rules on November 7, 2025, and adopted them with only nonsubstantive changes. They took effect March 18, 2026.
The rules cover state agencies and public colleges and universities. They also reach local governments, in the limited scope SB 1964 requires.
Agencies and covered local governments must adopt and follow a statewide AI code of ethics whenever they procure, develop, deploy, or use AI. Its principles include:
- Human oversight, including systems that can be paused, restricted, or disabled.
- Fairness, accuracy, and redress, with a point of contact and a procedure for people harmed by a consequential decision.
- Transparency, including disclosure of public-facing AI and never presenting AI as a human.
- Privacy and security, accountability, employee training, and documentation.
High-risk systems get more. Each entity must designate an AI Risk Officer and keep an inventory of “heightened scrutiny” systems. Before it develops, buys, deploys, or uses one, and again after any material change, it must complete a written risk assessment covering security risks, accuracy, and transparency. The Risk Officer reviews the assessment, approves or denies deployment, and notifies the agency head. The records are kept under state retention rules.
Vendors are written in. Entities must bind vendors by contract to the ethical principles and applicable law. Vendors deploying heightened-scrutiny systems for a government entity must be contractually bound to a risk management framework, such as NIST’s AI Risk Management Framework or a comparable standard.
The Register text we reviewed did not show the rules’ full definitions, including what makes a system subject to heightened scrutiny.
The rules name a person who says yes or no before a high-risk system goes live.
Why it matters
An ethics code alone is a list of principles. Texas attached an approver and a paper trail. The AI Risk Officer and the written assessment create a point of accountability that an auditor can check.
The vendor clauses move the rules into procurement. A company selling a high-risk AI system to a Texas agency now needs a risk framework it can name in the contract. And because the rules reach universities and some local governments, they apply well beyond state agencies.
Questions for your organization
- Who is your AI Risk Officer, and do they have the authority to deny deployment?
- Which of your systems belong on the heightened-scrutiny inventory?
- Do your vendor contracts bind vendors to the principles and, for high-risk systems, to a named risk framework?
- Can each public-facing AI system be paused or disabled, and who would do it?
- Where does a resident go for redress?
Texas did not stop at principles. It named who signs off before the system goes live.
Sources