SB1964 - Relating to the regulation and use of artificial intelligence systems and the management of data by governmental entities.

      S.B. No. 1964         AN ACT   relating to the regulation and use of artificial intelligence   systems and the management of data by governmental entities.          BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:          SECTION 1.  Section 2054.003, Government Code, is amended by   adding Subdivisions (1-a), (2-b), (2-c), (6-a), and (11) to read as   follows:                 (1-a)     "Artificial intelligence system" means a   machine-based system that for explicit or implicit objectives   infers from provided information a method to generate outputs, such   as predictions, content, recommendations, or decisions, to   influence a physical or virtual environment with varying levels of   autonomy and adaptiveness after deployment.                 (2-b)     "Consequential decision" means a decision that   has a material legal or similarly significant effect on the   provision, denial, or conditions of a person's access to a   government service.                 (2-c)  "Controlling factor" means a factor that is:                       (A)     the principal basis for making a   consequential decision; or                       (B)     capable of altering the outcome of a   consequential decision.                 (6-a)     "Heightened scrutiny artificial intelligence   system" means an artificial intelligence system specifically   intended to autonomously make, or be a controlling factor in   making, a consequential decision.   The term does not include an   artificial intelligence system intended to:                       (A)  perform a narrow procedural task;                       (B)     improve the result of a previously completed   human activity;                       (C)     perform a preparatory task to an assessment   relevant to a consequential decision; or                       (D)     detect decision-making patterns or   deviations from previous decision-making patterns.                 (11)     "Principal basis" means the use of an output   produced by a heightened scrutiny artificial intelligence system to   make a decision without:                       (A)     human review, oversight, involvement, or   intervention; or                       (B)  meaningful consideration by a human.          SECTION 2.  Section 2054.068(b), Government Code, is amended   to read as follows:          (b)  The department shall collect from each state agency   information on the status and condition of the agency's information   technology infrastructure, including information regarding:                (1)  the agency's information security program;                (2)  an inventory of the agency's servers, mainframes,   cloud services, artificial intelligence systems, including   heightened scrutiny artificial intelligence systems, and other   information technology equipment;                (3)  identification of vendors that operate and manage   the agency's information technology infrastructure; and                (4)  any additional related information requested by   the department.          SECTION 3.  Section 2054.0965, Government Code, is amended   by amending Subsection (b) and adding Subsection (c) to read as   follows:          (b)  Except as otherwise modified by rules adopted by the   department, the review must include:                (1)  an inventory of the agency's major information   systems, as defined by Section 2054.008, and other operational or   logistical components related to deployment of information   resources as prescribed by the department;                (2)  an inventory of the agency's major databases and   applications;                (3)  a description of the agency's existing and planned   telecommunications network configuration;                (4)  an analysis of how information systems,   components, databases, applications, and other information   resources have been deployed by the agency in support of:                      (A)  applicable achievement goals established   under Section 2056.006 and the state strategic plan adopted under   Section 2056.009;                      (B)  the state strategic plan for information   resources; and                      (C)  the agency's business objectives, mission,   and goals;                (5)  agency information necessary to support the state   goals for interoperability and reuse; [ and ]                (6)   an inventory and identification of the artificial   intelligence systems and heightened scrutiny artificial   intelligence systems deployed by the agency, including an   evaluation of the purpose of and risk mitigation measures for each   system and an analysis of each system's support of the agency's   strategic plan under this subchapter; and                 (7)   confirmation by the agency of compliance with   state statutes, rules, and standards relating to information   resources and artificial intelligence systems, including the   artificial intelligence system code of ethics developed under   Section 2054.702, and minimum standards developed under Section   2054.703 .           (c)     Local governments shall complete a review of the   deployment and use of heightened scrutiny artificial intelligence   systems and, on request, provide the review to the department in the   manner the department prescribes.          SECTION 4.  Section 2054.137, Government Code, is amended by   adding Subsection (a-1) and amending Subsection (c) to read as   follows:           (a-1)     A state agency with 150 or fewer full-time employees   may:                 (1)     designate a full-time employee of the agency to   serve as a data management officer; or                 (2)     enter into an agreement with one or more state   agencies to jointly employ a data management officer if approved by   the department.          (c)  In accordance with department guidelines, the data   management officer for a state agency shall annually post on the   Texas Open Data Portal established by the department under Section   2054.070 at least three high-value data sets as defined by Section   2054.1265.  The high-value data sets may not include information   that is confidential or protected from disclosure under state or   federal law.          SECTION 5.  Chapter 2054, Government Code, is amended by   adding Subchapter S to read as follows:   SUBCHAPTER S. ARTIFICIAL INTELLIGENCE           Sec.   2054.701.     DEFINITION. In this subchapter, "unlawful   harm" means any condition in which the use of an artificial   intelligence system results in a consequential decision that causes   harm to an individual who is a member of a state or federally   protected class in violation of law. The term does not include a   developer's or deployer's offer, license, or use of a heightened   scrutiny artificial intelligence system for the sole purpose of   testing the system before deployment to identify, mitigate, or   otherwise ensure compliance with state and federal law.           Sec.   2054.702.     ARTIFICIAL INTELLIGENCE SYSTEM CODE OF   ETHICS. (a) The department by rule shall establish an artificial   intelligence system code of ethics for use by state agencies and   local governments that procure, develop, deploy, or use artificial   intelligence systems.           (b)     At a minimum, the artificial intelligence system code of   ethics must include guidance for the deployment and use of   artificial intelligence systems and heightened scrutiny artificial   intelligence systems that aligns with the Artificial Intelligence   Risk Management Framework (AI RMF 1.0) published by the National   Institute of Standards and Technology.   The guidance must address:                 (1)  human oversight and control;                 (2)  fairness and accuracy;                 (3)  transparency, including consumer disclosures;                 (4)  data privacy and security;                 (5)     public and internal redress, including   accountability and liability; and                 (6)     the frequency of evaluations and documentation of   improvements.           (c)     State agencies and local governments shall adopt the   code of ethics developed under this section.           Sec.   2054.703.     MINIMUM STANDARDS FOR HEIGHTENED SCRUTINY   ARTIFICIAL INTELLIGENCE SYSTEMS. (a) The department by rule shall   develop minimum risk management and governance standards for the   development, procurement, deployment, and use of heightened   scrutiny artificial intelligence systems by a state agency or local   government.           (b)     The minimum standards must be consistent with the   Artificial Intelligence Risk Management Framework (AI RMF 1.0)   published by the National Institute of Standards and Technology and   must:                 (1)     establish accountability measures, such as   required reports describing the use of, limitations of, and   safeguards for the heightened scrutiny artificial intelligence   system;                 (2)     require the assessment and documentation of the   heightened scrutiny artificial intelligence system's known   security risks, performance metrics, and transparency measures:                       (A)  before deploying the system; and                       (B)  at the time any material change is made to:                             (i)  the system;                             (ii)     the state or local data used by the   system; or                             (iii)  the intended use of the system;                 (3)     provi [Text truncated for display. Full text available on LegiScan.]