Texas SB 1964 Compliance Guide — Government AI & Data

Meet Texas SB 1964 requirements with Risk Meridian

Government is our depth. Risk Meridian’s TX Govt Compliance module keeps the whole SB 1964 record in one place. Every system gets a Heightened Scrutiny AI (HSAI) determination with a written rationale against the § 2054.003(6-a)(A)–(D) definition and its four statutory exclusions. For governmental organizations the risk model is binary, matching the statute: the HSAI determination is the classification that triggers the extra controls, and every non-HSAI system carries inventory and oversight duties only — the LOW/MODERATE/HIGH tier used by private organizations does not apply. That proportionality is the point: the documented exclusion analysis keeps ordinary agency AI out of the heavy workflow. Versioned § 219.22 risk assessments capture known security risks and available mitigation steps, performance metrics relating to accuracy and operational efficiency, and transparency — the algorithms and decision-making, the training data, and the availability of inputs and outputs for monitoring over time. § 219.23(b) impact assessments — mandatory for state agencies and institutions of higher education, advisory for local governments (§ 219.23(e)(2)) — run before deployment and at any material change, and stay confidential and exempt from public-disclosure requests under § 2054.708(c), so candid risk documentation stays candid. Each HSAI also carries the AI Risk Officer deployment decision — a documented approve or deny with notes and executive-head notification (§ 219.22(c)) — the governance act itself, not just a form. Entity-level artifacts record the code-of-ethics and minimum-standards adoptions (§§ 2054.702(c), 2054.703(c)), the AI Risk Officer designation (1 TAC § 219.21(a)), the Acceptable Use Policy with all-employee training (§ 219.24(b)), a Code-of-Ethics obligations checklist with per-obligation status, notes, and evidence across § 219.11(c)/(e)/(f)/(g)/(h)/(i) — covering all AI systems, not just HSAI — recurring periodic-evaluation records (§ 219.11(k)(2)), AI-records retention with Public Information Act consideration (§ 219.11(j)(3) — those records are not PIA-exempt, unlike impact assessments), and advisory data-source and modification records (§ 219.11(l)(2)). Training is tracked as three distinct duties — annual certified AI training (§§ 2054.5191, 2054.5193), all-employee AUP training (§ 219.24(b)), and per-HSAI risk training for employees and contractors (§ 219.24(c)) — no single course satisfies all three. The Disclosures module produces standardized-notice records (§ 2054.711) including the hospital-district consent-form carve-out (§ 2054.711(c) — whether that method also satisfies the rule’s separate § 219.11(g)(2)(C) public-facing disclosure duty is unresolved; confirm with counsel), and a separate auto-generated Public-Facing AI Disclosure control tracks the distinct § 2054.707 duty for state agencies and institutions of higher education. A Vendor AI Register tracks § 2054.709 notice-and-cure clauses on the 31/31-day timeline and records two distinct vendor clauses — the risk-framework clause, NIST’s or a comparable standard such as ISO/IEC 42001 (1 TAC § 219.24(d)), and the separate vendor ethical-principles clause binding vendors to the entity’s AI ethical principles and relevant laws (§ 219.11(j)(2)(B); DIR refused to let vendors substitute their own principles). Obligations render as Mandatory or Advisory to match the adopted rule’s modal verbs — advisory items are never flattened to Required. Three governmental reports ship today: the DIR Submission Pack for the on-request review (§ 2054.0965(c)) — entity-aware, now bundling the AUP adoption, the § 219.11 ethics-obligations checklist, per-HSAI review decisions, periodic evaluations, retention and PIA records, both vendor clauses, and a training breakdown by type; missing mandatory artifacts render NOT ON FILE for state agencies and universities, while a local government’s elective assessments are labeled advisory, never “missing”; the IRDR AI Answer Set for state agencies and institutions of higher education (§ 2054.0965(b)(6)–(7)) — per-system uses-AI, heightened-scrutiny, and risk-mitigation answers with purpose evaluation, strategic-plan-support analysis, and the (b)(7) compliance confirmation built from the adoption artifacts; and a Classification Crosswalk that reconciles TRAIGA-lineage vocabulary (high-risk, substantial factor) with the SB 1964/TAC 219 terms your statutory duties actually key to (heightened scrutiny, controlling factor), with a written reconciliation rationale per system. 1 TAC Chapter 219 was adopted effective March 18, 2026 — verify field-level details against the adopted rule and current DIR guidance, and IRDR mappings against DIR’s current instrument. Records are kept Encrypted · SSO (Google & Microsoft) · TOTP MFA · RBAC · Tamper-evident audit log. Risk Meridian helps you build a defensible record; it does not replace legal advice. The same record preserves TRAIGA’s rebuttable presumption of reasonable care (§ 552.105(c)) and answers a civil investigative demand (§ 552.103) if the Attorney General ever asks.