AI governance for Texas government & hospital districts
Texas state agencies, local governments, and hospital districts now face a distinct public-sector AI stack — SB 1964, HB 3512, and TRAIGA, with SB 1188 potentially in play for hospital districts. Risk Meridian gives public-sector teams one platform to classify governmental AI systems, document rationales, track training, and produce procurement-, board-, and audit-ready evidence.
No credit card required.
The public-sector AI stack is already in effect
SB 1964 and HB 3512 both took effect September 1, 2025, and TRAIGA comes into force January 1, 2026. For governmental entities, that means AI use, data management, procurement, ethics, DIR interaction, personnel training, and TRAIGA disclosure duties are converging on the same teams at the same time. The agencies that document their governance now — with written rationales, versioned assessments, and a clean training record — are the ones ready when procurement, a board, or an auditor asks. Specific obligations and applicability should be confirmed against each statute and with counsel.
Your obligations, statute by statute
SB 1964 and HB 3512 apply to governmental entities — state agencies and local governments. A hospital district may qualify and may also reach SB 1188. Confirm applicability with counsel; Risk Meridian helps you document across every framework.
SB 1964
Effective Sept 1, 2025
SB 1964 addresses the regulation and use of artificial intelligence systems and the management of data by governmental entities. It touches government AI use and data management, ethics, procurement, the Texas Department of Information Resources (DIR), and a Public Sector Artificial Intelligence Systems Advisory Board. Risk Meridian helps you classify governmental AI systems, capture written rationales, and assemble a DIR-ready submission pack — while you confirm specific obligations against the statute and with counsel.
HB 3512
Effective Sept 1, 2025
HB 3512 concerns artificial intelligence training programs for certain employees and officials of state agencies and local governments. If your personnel fall within the scope of the statute, you need a defensible record of who completed training and when. Risk Meridian tracks completion and expiry and supports fiscal-year reporting — with applicability to specific roles confirmed under the statute and with counsel.
TRAIGA (HB 149)
In force Jan 1, 2026
TRAIGA is an intent-based prohibition statute enforced exclusively by the Texas Attorney General, with a 60-day cure period and no private right of action. Beyond the general prohibitions, government agencies must disclose AI-to-consumer interactions (§ 552.051(b)) and are barred from AI social scoring (§ 552.053) and certain biometric identification (§ 552.054). TRAIGA starts from a rebuttable presumption of reasonable care (§ 552.105(c)); if the AG investigates, a civil investigative demand can require a system’s purpose, data, outputs, limits, and oversight process (§ 552.103). NIST AI RMF substantial compliance is a named affirmative defense (§ 552.105(e)), and for licensed personnel a licensing agency may add sanctions up to $100,000 after a violation finding and AG recommendation (§ 552.106) — so a documented governance record is how you evidence good faith.
SB 1188 (hospital districts)
Effective Sept 1, 2025
A hospital district is a healthcare provider, so TRAIGA's patient AI-use disclosure duty (§ 552.051(f)) and SB 1188 (record review, EMR-offshoring limits, patient notification) apply to it. Note an important nuance: TRAIGA expressly excludes a hospital district from its definition of “governmental entity” (§ 552.001(3)), so TRAIGA's governmental-only prohibitions do not bind districts under that chapter. Districts may still be reached by SB 1964 and HB 3512 on those statutes' own terms. Whether and how each applies to your district should be confirmed with counsel — Risk Meridian is built to document across all of them.
How Risk Meridian helps public-sector teams
A government module built for the depth the public sector actually faces — governmental-AI classification, DIR-ready packs, training tracking, and the enterprise rigor procurement and audit expect.
Governmental-AI Classifier
Classify each AI system your agency uses and capture a written rationale for the classification — the kind of documented, defensible reasoning procurement officers, boards, and auditors expect. Every classification is attributable and reviewable.
Versioned Assessments
Assessments are versioned, so you keep a full history of how a governmental AI system was evaluated over time. When systems, vendors, or use cases change, prior assessments remain intact as part of the record.
DIR Submission Pack
Assemble a DIR submission pack from your live records — classifications, rationales, and assessments organized for review. Confirm the specific contents required against the statute and DIR guidance and with counsel.
Vendor-Clause Tracking
Track AI-related contract clauses across your vendors so procurement and legal can see, at a glance, which agreements carry the terms your governance program relies on — and which need attention at renewal.
HB 3512 Training Tracker
Record public-sector AI-training completion and expiry for the employees and officials in scope, and pull fiscal-year reporting when you need it. Keep a clean, exportable record of who is current and who is due.
Enterprise Rigor & Audit Trail
Multi-tenant RBAC keeps agency data separated by role, a tamper-evident audit log records every action, and PDF artifacts give you portable evidence. Security is Encrypted (in transit and at rest), RBAC, and a tamper-evident audit log.
TRAIGA Reasonable-Care Record
TRAIGA presumes a person used reasonable care (§ 552.105(c)). Risk Meridian keeps the current, attributable record — classifications, assessments, disclosures, and oversight — that preserves that presumption, answers a civil investigative demand if the Attorney General asks (§ 552.103), and evidences the NIST AI RMF affirmative defense (§ 552.105(e)).
Hospital districts
Both government and healthcare — in one program
Hospital districts sit at the intersection of the public-sector and healthcare AI stacks. That overlap is a burden when it lives in spreadsheets and a strength when it lives in one documented, defensible record. Risk Meridian lets your district govern AI use across every applicable framework without duplicating work.
- A hospital district can be a governmental entity and a healthcare provider at the same time.
- Its AI use may span SB 1964, HB 3512, TRAIGA, and SB 1188 — often simultaneously.
- Applicability of each statute should be confirmed with counsel, not assumed.
- Document once across all four frameworks from a single system of record.
SB 1964 and HB 3512 apply to governmental entities; a hospital district may qualify. Whether SB 1188 and the others apply to your district should be confirmed with counsel.
AI governance for Texas government — FAQs
Common questions from agency IT leaders, procurement officers, hospital-district administrators, and public-sector counsel.
- Does SB 1964 apply to my agency or local government?
- SB 1964 addresses the regulation and use of AI systems and the management of data by governmental entities, and it applies to state agencies and local governments. It became effective September 1, 2025 and touches government AI use, data management, ethics, procurement, DIR, and a Public Sector Artificial Intelligence Systems Advisory Board. For the specific obligations that attach to your entity, review the statute directly and confirm with counsel — Risk Meridian helps you build and maintain the underlying documentation either way.
- What does HB 3512 require, and who has to be trained?
- HB 3512, effective September 1, 2025, concerns AI training programs for certain employees and officials of state agencies and local governments. Which roles are in scope should be confirmed under the statute and with counsel rather than assumed. Risk Meridian gives you a training tracker that records completion and expiry for the personnel you identify and supports fiscal-year reporting, so you can produce a defensible record on request.
- How does TRAIGA affect government agencies specifically?
- TRAIGA is an intent-based prohibition statute that comes into force January 1, 2026. Its general prohibitions apply broadly, and government agencies additionally have AI-use disclosure duties. TRAIGA is enforced exclusively by the Texas Attorney General, includes a 60-day cure period, and has no private right of action. Because NIST AI RMF substantial compliance is an explicit affirmative defense, keeping a documented governance record is how your agency evidences good faith.
- Our hospital district provides healthcare — which laws apply?
- A hospital district is a healthcare provider, so TRAIGA's patient AI-use disclosure duty (§ 552.051(f)) and SB 1188 apply. One nuance worth knowing: TRAIGA expressly excludes hospital districts from its “governmental entity” definition (§ 552.001(3)), so TRAIGA's governmental-only prohibitions do not bind districts under that chapter — but SB 1964 and HB 3512 may reach them on their own terms. That overlap is exactly why documentation matters. Confirm applicability with counsel; Risk Meridian lets you document across all of them from a single system of record.
- What can I hand to procurement, my board, or an auditor?
- Risk Meridian produces PDF artifacts from your live records — governmental-AI classifications with written rationales, versioned assessments, a DIR submission pack, vendor-clause status, and HB 3512 training reports. Every action is captured in a tamper-evident audit log with role-based access, so the evidence you present is attributable and defensible for procurement, board, and audit review.
- Does Risk Meridian guarantee compliance with these statutes?
- No. Risk Meridian does not guarantee compliance, and no vendor can. What the platform does is help you document your governance program and build a defensible record across SB 1964, HB 3512, TRAIGA, and — for hospital districts — SB 1188. Specific obligations and applicability should always be confirmed against the statutes and with your counsel.
Get your public-sector AI program procurement-ready
Start now. Classify your first governmental AI system, capture the rationale, and begin building the DIR-ready, board-ready, audit-ready record your agency needs — audit-ready in under an hour.
No credit card required.
SB 1964, HB 3512, and TRAIGA support in one platform
Governmental-AI classifier with written rationales
Encrypted · RBAC · Tamper-evident audit log