1. (a) A state agency that deploys or uses a heightened scrutiny artificial intelligence system or, at the request of a contracting state agency, a vendor that contracts with the state agency for the deployment or use of a heightened scrutiny AI system shall conduct an impact assessment:

   1. (1) prior to deploying the heightened scrutiny AI system; and

   2. (2) at the time any material change is made to:

      1. (A) The system;
      2. (B) The state or local data used by the system; or
      3. (C) The intended use of the system.

2. (b) A heightened scrutiny AI system impact assessment required by this section must include:

   1. (1) A description of the system, including its training data, model, and intended use;
   2. (2) How the agency will use the system and who within the state agency is responsible for its deployment and ongoing monitoring and evaluation;
   3. (3) Whether the system will process or store any PII provided by the agency or the users of the agency's system and, if so, whether the system will use that information to train the model;
   4. (4) Potential risks of unlawful harm that the agency identifies and steps the agency can take to limit those risks;
   5. (5) System limitations identified by the agency;
   6. (6) How the agency will monitor the system outputs to evaluate accuracy and harm and identify the intervals at which the monitoring will occur; and
   7. (7) The retention duration for the system's inputs and outputs and the method for deleting outputs once the identified retention period has passed.
3. (c) A state agency or a vendor contracted by the state agency shall either develop its own AI impact assessment for heightened scrutiny artificial intelligence systems or use the standard impact assessment form created by the department.

4. (d) A state agency that deploys or uses a heightened scrutiny artificial intelligence system shall maintain a record of the AI impact assessment for as long as required by the applicable state records retention schedule.

   1. (1) If a vendor that contracts with the state agency for the deployment or use of a heightened scrutiny AI system conducts an impact assessment, the state agency must receive a copy of the completed impact assessment, which is treated as the document of record.
   2. (2) The state agency shall make a copy of the assessment available to the department on request.

5. (e) Local governments shall:

   1. (1) Comply with all requirements established by the department regarding the procurement of information resources and information resources technology that include a heightened scrutiny AI system;
   2. (2) Consider conducting an impact assessment in alignment with the state agency requirements established by subsections (a)- (c) when deploying a heightened scrutiny AI system; and
   3. (3) Review relevant resources posted by the department on its website.

Source Note:The provisions of this §219.23 adopted to be effective March 18, 2026, 51 TexReg 1610.