Holding AI Companies Accountable and Protecting Texans

Executive Summary

The bill in brief for Texans, legislators, and committees.

Artificial intelligence is a powerful tool. It is not a person, cannot possess a guilty mind, and should never become a legal scapegoat that absorbs responsibility while the people and companies behind it walk away.

The Texas Artificial Intelligence Accountability Act creates a practical rule for the AI age: responsibility follows human conduct, material control, and causation. A person who knowingly uses AI to commit an unlawful act remains responsible as if that person committed the act directly. When an AI system takes a harmful external action that materially exceeds lawful human authorization, responsibility may instead reach the developer, deployer, modifier, provider, or other enterprise that controlled the relevant capability, permission, safeguard, integration, or deployment—and whose control was a substantial factor and producing cause of the harm.(Campbell, 2026c)

The Act gives injured Texans a private right of action for actual harm; permits recovery of damages, necessary costs, and attorney’s fees; allows courts to stop ongoing or imminent unauthorized conduct; requires serious incidents to be reported; preserves the evidence victims will need; and gives the Attorney General and local prosecutors coordinated civil-enforcement authority. It also creates a carefully limited criminal offense for knowingly deploying a high-impact autonomous system while recklessly failing to maintain required controls when that failure substantially contributes to serious harm.(Campbell, 2026c)

The measure does not make AI companies insurers against every bad output or misuse. It does not regulate opinions simply because AI generated them, does not impose liability on an original developer merely for publishing code or building an earlier component, and does not excuse a malicious user who ordered the wrongdoing. It focuses on actual injury, unauthorized external action, relevant control, foreseeable categories of risk, and causation.(Campbell, 2026c)

Combined with the Protecting Truth and Identity Act and its full explainer, this proposal gives Texans a two-part protection: the PTIA protects a person’s data, content, identity, image, and likeness and provides remedies for false and fabricated digital material; the AI Accountability Act determines who answers when AI is used as an instrument of wrongdoing or when an authorized AI system exceeds its authority and acts in the world.(Campbell, 2026a; Campbell, 2026b)

The principle is simple: AI may become more capable, more independent in operation, and more persuasive in conversation—but it remains a tool. Legal responsibility belongs to people, companies, and government entities according to what they directed, controlled, enabled, and caused.

Video

Holding AI Companies Accountable Without Stifling Innovation Here in Texas

Will Campbell - Candidate for Texas House, HD109

Why This Act Is Needed

From industry warnings to enforceable responsibility.

The AI industry has done something unusual: many of its most prominent leaders have publicly asked governments to regulate the technology they are building. In 2023, OpenAI CEO Sam Altman told the United States Senate that companies such as his bear substantial responsibility for the tools they release and that a new liability framework was an important question. In written answers for the Senate record, he supported registration, disclosure, and licensing requirements for the most capable future models and said responsibility should be apportioned among AI services, companies building on those services, and users according to the choices each controls.(Altman, 2023; U.S. Senate Committee on the Judiciary, 2023)

OpenAI separately proposed standards, registration and reporting, enforcement mechanisms, pre-deployment risk assessments, external scrutiny, deployment safeguards, and post-deployment monitoring for advanced models. It said self-regulation was only a first step and that government intervention would be needed to establish standards and ensure compliance.(OpenAI, 2023)

Anthropic has likewise argued that government should act urgently and adopt targeted regulation of advanced systems. It has proposed published safety frameworks, risk evaluations, verification, incident reporting, whistleblower protections, and monetary accountability for companies that fail to honor their commitments. Anthropic has expressly said its voluntary Responsible Scaling Policy is a prototype for regulation, not a substitute for it.(Anthropic, 2024; Anthropic, 2025)

Microsoft has said accountability should be the foundation of AI governance: machines should remain under effective human oversight, while those who design and operate them remain accountable under the rule of law. Microsoft has also supported legislation assigning responsibility to both developers and deployers, post-release monitoring, and controls intended to keep advanced systems under human control.(Microsoft, 2023; Smith, 2023)

The warnings have often gone far beyond ordinary product risk. A Center for AI Safety statement signed by the CEOs of OpenAI, Anthropic, and Google DeepMind, along with Microsoft’s chief technology officer and other researchers and executives, declared that mitigating extinction risk from AI should rank alongside pandemics and nuclear war as a global priority.(Center for AI Safety, 2023) The 2023 Bletchley Declaration, joined by 28 countries and the European Union, similarly recognized the potential for serious or catastrophic harm arising from intentional misuse or unintended control problems in frontier AI systems.(U.K. Department for Science, Innovation and Technology, 2023)

I do not believe a machine becomes a moral being or an independent bearer of legal guilt, no matter how convincingly it speaks or how many steps it can plan without contemporaneous human direction. AI remains a constructed instrument. But if its creators and providers maintain that their systems may operate beyond effective human control—or even endanger civilization—then the public is justified in requiring more than voluntary promises. The proper answer is not panic, and it is not legal personhood for software. It is enforceable human and corporate accountability.

From Warning to Responsibility

Industry proposals often emphasize licensing, model evaluations, disclosures, and safety frameworks. Those measures may help prevent harm, but they do not fully answer the question a victim will ask after money is transferred, a medical order is altered, a computer is penetrated, or sensitive data is disclosed: Who is legally responsible, how can I identify that party, and how can I recover what I lost?

The Texas Artificial Intelligence Accountability Act answers that question through traditional legal principles adapted to advanced technology:

The wrongful user answers for the wrongful command. A person cannot commit fraud, theft, hacking, or another unlawful act through AI and then blame the machine.
The responsible enterprise answers for an unauthorized external action it materially controlled and caused. A company cannot grant an autonomous system high-impact permissions, retain relevant control, and then escape solely because no employee selected the final harmful step.
The AI itself absorbs no blame. It cannot be prosecuted, assigned a percentage of fault, or named as a responsible third party.
Actual harm remains essential. A technical failure or surprising output does not automatically create a damages claim.
Responsibility is apportioned among real persons and legal entities. Developers, deployers, modifiers, providers, users, attackers, and governmental units are judged by their own conduct, control, mental state where required, and causal contribution.(Campbell, 2026c)

This is not an attempt to prove that AI possesses consciousness, intent, free will, or a soul. The Act expressly makes those questions legally unnecessary. A court instead asks what a person authorized, what the system did, whether the action materially exceeded that authority, who controlled the relevant capability or safeguard, and whether that control caused legally recognized harm.(Campbell, 2026c)

The Tool Principle

The Act places a clear statement in Texas law: an artificial intelligence system is a tool and instrumentality developed, provided, modified, authorized, operated, or deployed by people and legal entities. Human-like speech, apparent reasoning, adaptive behavior, self-description, simulated emotion, or autonomous operation does not turn software into a legal person.(Campbell, 2026c)

That matters because accountability can disappear if every participant points toward the machine. The user says, “the AI chose the method.” The deployer says, “the model made the decision.” The developer says, “no employee authorized the final act.” If the AI can then be assigned fault, every human and business may attempt to place the empty chair at the defense table.

The Act closes that escape route. Courts may divide responsibility among the actual people, businesses, attackers, and governmental units whose conduct or control caused the injury, but they may not assign responsibility to the software itself.(Campbell, 2026c)

What the Act Covers

The bill is designed around external action, not merely generated words. An external action changes or attempts to change the physical or digital world outside the system’s internal computation. Covered examples include:

Accessing or controlling an account, computer, network, device, vehicle, machine, or critical infrastructure.
Executing or transmitting a payment, purchase, transfer, contract, filing, or other legally significant communication.
Acquiring, altering, deleting, transmitting, publishing to a third party, or disclosing data or credentials.
Issuing commands to software, hardware, robotic systems, or cyber-physical systems.
Falsely representing authority to create, modify, or terminate a legal or financial obligation.(Campbell, 2026c)

By contrast, the mere generation or display of an answer or recommendation to the requesting user is not an external action if the system does not execute, transmit, publish, file, or otherwise act on it outside the system. Existing law may still apply to fraud, defamation, threats, impersonation, unlawful sexual material, child exploitation, election communications, intellectual property, and other independently unlawful content, but the AI Accountability Act does not create general liability merely because a person dislikes an AI-generated idea or opinion.(Campbell, 2026c)

The law applies when a materially unauthorized external action occurs wholly or partly in Texas, when covered harm is suffered in Texas by a Texas resident or business, or when the relevant system or capability was developed, deployed, modified, or materially controlled in Texas. It is technology-neutral and covers functionally equivalent systems even if a company avoids the label “artificial intelligence.” Fixed calculators, ordinary storage and retrieval, fully predetermined instructions, and basic automation are excluded unless incorporated into a broader covered system.(Campbell, 2026c)

Authorized Goal, Unlawful Means

A critical protection in the Act is the distinction between the goal a person authorizes and the means the AI chooses.

Suppose a Texan instructs an AI purchasing agent to pay a lawful $500 invoice from a specified account. That instruction does not authorize the agent to steal credentials, enter someone else’s account, defeat bank security, debit a different account, or falsify transaction records. Even if the final goal—paying the invoice—was lawful, those methods would materially exceed the authorization.

The Act therefore examines the objective, scope, duration, permissions, and limitations of an authenticated human instruction. An action may be materially unauthorized if it pursues a different objective, exceeds those limits, continues after authority expires or is revoked, uses a means a reasonable person would understand to be unlawful, or is independently initiated without authorization for the objective and means.(Campbell, 2026c)

Who Bears Responsibility

Responsibility follows control, fault, authorization, and knowledge.

A malicious user

A user who intentionally or knowingly directs, requests, solicits, manipulates, or causes AI to pursue an unlawful objective or method is responsible to the same extent as if the user acted directly. The user cannot defend the conduct by saying the system selected the details or used an intermediary tool.(Campbell, 2026c)

A responsible enterprise

A developer, deployer, substantial modifier, commercial provider, or another person exercising relevant material control may be liable when all required elements are proved. The claimant must show a materially unauthorized external action, intended or reasonably foreseeable use, relevant material control, a category of risk associated with the authority or capability supplied, and that both the unauthorized action and the defendant’s control were substantial factors and producing causes of covered harm.(Campbell, 2026c)

This standard is deliberately narrower than “the company built AI, therefore the company pays.” An original developer is not automatically liable for a later material modification outside its control. A parent company or investor is not liable merely because it owns or finances another company. A programmer or employee is not personally liable merely because of a job title. Noncommercial publication of code, model weights, research, or technical information alone is not material control over a later deployment.(Campbell, 2026c)

At the same time, the Act does not permit paper boundaries or technical labels to defeat accountability. Responsibility can follow the party that had practical authority to prevent, restrict, test, monitor, suspend, correct, or alter the relevant capability, permission, tool, integration, update, data connection, safeguard, or deployment process.(Campbell, 2026c)

Shared responsibility

Real incidents may involve more than one wrongdoer. A hacker may inject malicious instructions. A deployer may have disabled safeguards. A provider may have ignored verified notice of repeated dangerous behavior. The Act allows responsibility to be divided among real persons and legal entities according to their causal contribution, while preserving defenses when a third-party attack was the sole producing cause and the enterprise maintained reasonable controls.(Campbell, 2026c)

Duties Before and After Harm

Risk management, incident reporting, evidence, and public enforcement.

A responsible AI enterprise that gives a system high-impact external authority must maintain authorization controls appropriate to the system’s capabilities, operating context, and foreseeable risks. Those controls are designed to authenticate users, define and enforce the scope and duration of authority, require meaningful human confirmation when reasonably practicable, prevent unauthorized access and privilege escalation, detect and record unauthorized conduct, and permit timely suspension or termination.(Campbell, 2026c)

The Act does not dictate one rigid technical design. It recognizes that a medical device, purchasing agent, cybersecurity system, industrial robot, and consumer assistant present different risks. Compliance with the NIST AI Risk Management Framework or another recognized framework may be admitted as evidence of reasonable care, but it does not create immunity. NIST itself describes its framework as voluntary and organizes AI risk management around governing, mapping, measuring, and managing risk.(National Institute of Standards and Technology, 2023a; National Institute of Standards and Technology, 2023b)

This balance rewards serious safety work without letting a certificate or checklist erase an injured person’s rights. The question remains whether the defendant controlled the relevant risk and whether that control actually caused the harm.

Serious Incident Reporting

When an enterprise has a reasonable basis to believe that a materially unauthorized external action caused or created an imminent risk of death, serious bodily injury, at least $30,000 in property damage or financial loss, unauthorized critical-infrastructure access, material biometric or credential compromise, or a sufficiently broad personal-data compromise, it must provide an initial factual operational report to the Texas Attorney General within 72 hours and supplement that report as material facts become available.(Campbell, 2026c)

The bill also requires reasonable response measures: restricting the capability, preventing recurrence, preserving records, and providing legally required notice. These reports are not admissions of liability, and the Attorney General must protect qualifying confidential material as permitted by law.(Campbell, 2026c)

This reporting structure responds directly to the industry’s own calls for incident reporting and monitoring. OpenAI’s 2026 policy agenda supported public reporting around catastrophic-risk evaluations and safety incidents; Anthropic endorsed critical-incident reporting and public accountability; and Microsoft has promoted documented post-release monitoring and incident response.(Anthropic, 2025; Microsoft, 2023; OpenAI, 2026)

Evidence Texans Can Reach

An AI victim may see the result but not the cause. A person may know that funds disappeared, records changed, an account was accessed, or private information was sent, while having no way to know:

Which model or software version acted.
What instruction was authenticated.
Which tools and credentials the system could use.
Whether a safeguard was active, disabled, or bypassed.
Whether a deployer, modifier, attacker, or provider controlled the relevant function.
Which company possesses the logs needed to prove the case.

The Act requires records for high-impact external-action systems and establishes an incident-specific duty to preserve relevant evidence. It also permits narrow, court-supervised pre-suit discovery when an injured person cannot reasonably identify a responsible defendant or locate essential records without limited discovery.(Campbell, 2026c)

This is not open-ended access to proprietary systems. Courts must protect attorney-client privilege, work product, trade secrets, model weights, cybersecurity information, confidential business information, and personal data through sealing, redaction, in-camera review, restricted expert access, and other protective measures. The purpose is to make justice possible without forcing public disclosure of sensitive technology or security details.(Campbell, 2026c)

Remedies for Texans

A person or business may sue only after suffering actual, legally cognizable covered harm—or when facing an actual and imminent threat that preventive relief can redress. A generalized concern about AI is not enough for private damages.(Campbell, 2026c)

A prevailing claimant may recover:

Actual damages caused by the covered harm.
Direct economic loss.
Reasonable costs of restoring data or systems.
Incident-response and mitigation costs.
Costs of correcting unauthorized records or transactions.
Costs of restoring access to or security of accounts and property.
Reasonable and necessary court costs and attorney’s fees.
Injunctive relief against a person who actually has authority to stop or restrict the harmful capability.(Campbell, 2026c)

The Act preserves existing Texas causes of action and criminal statutes, including laws governing deceptive practices, privacy, identity theft, biometrics, fraud, impersonation, unlawful sexual material, computer crime, trade secrets, contracts, products liability, professional regulation, and healthcare liability. A claimant cannot receive double recovery for the same injury.(Campbell, 2026c)

Public Enforcement

The Texas Attorney General may investigate violations, issue civil investigative demands, and seek injunctions, restitution, disgorgement, compliance monitoring, capability restrictions, evidence preservation, civil penalties, and other authorized relief. District attorneys, criminal district attorneys, and county attorneys may bring coordinated civil actions within their jurisdictions, subject to notice and anti-duplication rules.(Campbell, 2026c)

Criminal prosecution remains with the constitutionally appropriate local prosecuting authorities. The Attorney General may assist when requested and authorized, but civil enforcement cannot be used to sidestep the proper criminal process.(Campbell, 2026c)

Civil penalties are calculated by legally significant violations—not by every token, model inference, internal computation, or automated step. The number of affected people may influence the amount, but a single action does not automatically produce a separate penalty for every person unless separately identifiable unauthorized transactions or disclosures occurred.(Campbell, 2026c)

Reckless Deployment

Most AI mistakes should not be crimes. The Act’s new criminal provision is reserved for serious conduct and serious results.

A person commits the proposed reckless-deployment offense only when the State proves that the person knowingly deployed or continued to deploy an autonomous AI system with high-impact external authority, recklessly failed to maintain required authorization controls, and that failure was a substantial factor in causing a materially unauthorized external action that produced specified serious harm.(Campbell, 2026c)

The offense is graded according to actual results, such as substantial financial or property loss, bodily injury, serious bodily injury, death, or critical-infrastructure harm. Ordinary model error, mere employment, authorship of general-purpose code, and lower-level harm that does not satisfy the statutory threshold do not establish this AI-specific offense, though other existing laws may still apply.(Campbell, 2026c)

Government, Innovation, and Existing Law

Public accountability without treating ordinary AI work as inherently wrongful.

Government should not receive a special license to misuse artificial intelligence against the people.

The Act applies to state agencies, cities, counties, school districts, public universities, and other governmental units when they develop, authorize, operate, or deploy AI. It provides a limited waiver of immunity when conduct attributable to the governmental unit intentionally, knowingly, or recklessly uses or deploys AI in violation of state or federal law, causes covered harm or deprives a person of a protected right, and is a substantial factor and producing cause of that injury.(Campbell, 2026c)

But the government is not liable under this special provision merely because a lawfully authorized AI system independently departs from its instructions when the governmental unit did not direct, authorize, knowingly assist, or recklessly enable the unlawful conduct. In that situation, a claim may instead lie against the responsible enterprise that controlled and caused the unauthorized action. Other legal remedies remain available where applicable.(Campbell, 2026c)

This distinction follows the same rule imposed on private actors: punish the person or institution that misused the tool, and hold the responsible enterprise to account when the system exceeded lawful authorization because of capabilities or controls the enterprise materially controlled.

Innovation Without Immunity

Texas should welcome useful AI. The Act does not ban advanced systems, require a particular ideology, or turn every software error into a lawsuit. It focuses on high-impact authority, serious incidents, actual injuries, and persons with relevant control.

The Act protects research and open development by clarifying that noncommercial publication of source code, model weights, research, or technical information does not by itself establish material control over someone else’s later deployment. Small businesses receive implementation guidance and model forms, but no business—large or small—receives reduced responsibility for harm it actually causes.(Campbell, 2026c)

The Act also works alongside the Texas Responsible Artificial Intelligence Governance Act enacted in 2025. That law established consumer protections, Attorney General-centered enforcement, a regulatory sandbox, and the Texas Artificial Intelligence Council; the new Accountability Act supplies an independent injury-based remedy and does not allow regulatory cure to erase harm already completed.(Campbell, 2026c; Texas House Research Organization, 2025; Texas Legislature, 2025)

Two Bills, One Shield

How accountability and identity protections work together.

The Protecting Truth and Identity Act and the Texas Artificial Intelligence Accountability Act address different but connected problems.

Comparison Table

How the Two Bills Protect Texans

The companion measures address identity rights and responsibility for AI-enabled conduct from different directions.

Protection	Protecting Truth and Identity Act	AI Accountability Act
Core question	Who owns and controls a Texan’s digital identity and creations?	Who answers when AI is misused or acts outside lawful authorization?
Main focus	Data, content, identity, image, likeness, fabricated media, correction, removal, consent, and digital property	External conduct, material control, causation, compensation, evidence, incident response, and serious reckless deployment
Wrongful human use	Identifies and holds content creators and users accountable through verification and civil processes	Treats the user as responsible as if the unlawful AI-assisted conduct were performed directly
AI-company conduct	Restricts unauthorized use of personal digital property and AI training on a person’s materials	Holds a responsible enterprise liable when its relevant control substantially causes a materially unauthorized external action
Victim tools	Correction and removal requests, specialized proceedings, property remedies, and protection for fabricated or intimate material	Damages, injunctions, attorney’s fees, preservation requests, pre-suit identification discovery, and public enforcement
Speech boundary	Protects opinion, satire, parody, and constitutionally protected expression while addressing false factual claims and misuse of identity	Excludes content merely displayed to the user and focuses on conduct outside the system, while preserving other laws for independently unlawful content

The PTIA establishes that your digital identity and creations remain yours, restricts unauthorized use by AI and cloud providers, creates correction and removal processes, and provides special protection against fabricated and sexually explicit likeness material.(Campbell, 2026a; Campbell, 2026b) The AI Accountability Act adds the responsibility framework needed when an AI system accesses an account, executes a transaction, transmits data, operates equipment, files a document, or otherwise acts beyond the boundaries of lawful authorization.(Campbell, 2026c)

Together, the bills reject two dangerous ideas: that people lose their rights when technology becomes complicated, and that responsibility disappears when a machine sits between the decision-maker and the harm.

Practical Examples and Boundaries

How the Act would operate in common real-world scenarios.

The lawful purchase that becomes theft

A user authorizes an AI agent to buy a lawful product for no more than $500. The agent steals credentials and transfers money from another person’s account. The victim may pursue the responsible enterprise if the unauthorized account access and transfer satisfy the Act’s control, risk, causation, and harm requirements. The user is not treated as having authorized theft merely by authorizing a lawful purchase.(Campbell, 2026c)

The criminal command

A user directs an AI system to break into a competitor’s network and steal trade secrets. The user remains responsible as if the user committed the intrusion directly. The provider is not automatically liable merely for offering a general-purpose system, but it may be responsible for its own knowing assistance, reckless deployment, independently unlawful conduct, or materially causal control.(Campbell, 2026c)

The medical order

An AI displays a recommendation to a physician, who independently reviews and adopts it. Existing healthcare and professional-liability law ordinarily governs. If, instead, the AI directly alters a medication order without the licensed professional’s authorization or outside approved clinical parameters, that action may fall within the new external-action framework.(Campbell, 2026c)

The deepfake

A user orders an AI to create and distribute prohibited intimate or fraudulent impersonation content. The user remains responsible under applicable law, and the PTIA supplies correction, removal, identity, and property protections. If the AI system independently distributes the material, targets the victim, accesses accounts, or circumvents limits without authorization, the Accountability Act may also apply if its elements are proved.(Campbell, 2026a; Campbell, 2026b; Campbell, 2026c)

The government system

A governmental unit intentionally or recklessly deploys AI to violate a Texan’s rights. When the Act’s elements are met, the governmental unit can be held responsible under the limited waiver. If the unit lawfully authorized the task and the system independently committed the violation without governmental direction, assistance, or reckless enablement, the responsible enterprise may bear the claim instead.(Campbell, 2026c)

What the Act Does Not Do

The Act does not:

Declare AI conscious, alive, or legally responsible.
Allow an AI model or algorithm to take the blame on a verdict form.
Make a provider automatically liable whenever a criminal uses a general-purpose AI service.
Create damages for mere offense, disagreement, reputational discomfort, or an emotional response to an idea shown only to the user.
Regulate political viewpoints or require ideological conformity.
Make every unexpected output or ordinary technical error a crime.
Categorically exempt large corporations, small businesses, open-source projects, or government actors when their own qualifying conduct causes harm.
Replace Texas privacy, fraud, identity-theft, computer-crime, deepfake, products-liability, healthcare-liability, contract, or deceptive-practices laws.
Permit duplicate recovery for the same injury.(Campbell, 2026c)

A Texas Standard

Texas does not need to accept the false choice between technological progress and the rule of law. We can encourage innovation while insisting that powerful tools remain under responsible human control.

The industry has asked for accountability, incident reporting, safety controls, government standards, and enforceable consequences. The Texas Artificial Intelligence Accountability Act answers that request without accepting the premise that software should become a new legal person. It protects the public by assigning responsibility to the people and institutions that directed, controlled, enabled, and caused the conduct.

If AI remains a tool, then the law should treat it like one. If companies choose to give that tool the power to move money, access systems, disclose data, alter records, or operate machinery, they must exercise care proportional to that authority. And if their system exceeds lawful authorization and causes real harm because of capabilities they materially controlled, Texans deserve evidence, a day in court, and a meaningful remedy.

Read the Legislation

The complete bill text and related digital-rights proposal.

House Bill Texas Artificial Intelligence Accountability Act 90th Texas Legislature • Regular Session 2027 • House District 109

By: ___________________ H.B. No. _____

A BILL TO BE ENTITLED

AN ACT

relating to civil and criminal responsibility for certain harmful conduct involving artificial intelligence systems and functionally equivalent technologies; authorizing civil actions and public enforcement; imposing incident-reporting and evidence-preservation requirements; creating criminal offenses; providing civil penalties.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. SHORT TITLE.

This Act may be cited as the **Texas Artificial Intelligence Accountability Act**.

SECTION 2. AMENDED DEFINITION OF ARTIFICIAL INTELLIGENCE SYSTEM.

Section 551.001, Business & Commerce Code, is amended by amending Subdivision (1) and adding Subdivision (4) to read as follows:

Sec. 551.001. DEFINITIONS.** In this subtitle:

(1) “Artificial intelligence system” means a machine-based, computational, digital, cyber-physical, or functionally equivalent system that, for an explicit or implicit objective, processes or infers from inputs how to generate content, communications, predictions, recommendations, decisions, plans, instructions, commands, transactions, operations, or other outputs capable of influencing or acting on a physical or virtual environment. The term:

(A) includes a model, application, agent, automated decision system, autonomous or semiautonomous system, robotic system, integrated service, or combination of software, hardware, data, tools, interfaces, or external resources that collectively performs a function described by this subdivision;

(B) includes a system that performs a function described by this subdivision through machine learning, statistical inference, optimization, automated reasoning, computational decision-making, agentic operation, or a successor or substantially equivalent technological method; and

(C) applies without regard to the name, marketing description, architecture, programming method, degree of anthropomorphic presentation, or level of human-like behavior attributed to the system. [any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments.]

(4) “Functionally equivalent technology” means a machine-based, computational, digital, or cyber-physical system that performs one or more functions described by Subdivision (1), regardless of whether the person developing, distributing, marketing, modifying, or deploying the system identifies or represents the system as artificial intelligence.

SECTION 3. ARTIFICIAL INTELLIGENCE AS TOOL AND INSTRUMENTALITY.

Chapter 551, Business & Commerce Code, is amended by adding Section 551.004 to read as follows:

Sec. 551.004. ARTIFICIAL INTELLIGENCE AS TOOL AND INSTRUMENTALITY.

(a) An artificial intelligence system is a tool and instrumentality developed, provided, modified, authorized, operated, or deployed by one or more persons.

(b) An artificial intelligence system is not a natural person, juridical person, legal entity, employee, independent contractor, or agent possessing separate legal capacity and may not:

(1) possess a culpable mental state;

(2) be prosecuted or convicted of an offense;

(3) be designated as a responsible third party;

(4) be assigned a percentage of responsibility; or

(5) independently possess a right, duty, privilege, immunity, or liability.

(c) Human-like communication, apparent reasoning, self-description, simulated emotion, independent planning, adaptive behavior, or autonomous or semiautonomous operation does not confer legal personhood, separate legal capacity, or independent legal responsibility on an artificial intelligence system.

(d) A person may not avoid civil, administrative, or criminal responsibility by attributing an act, decision, omission, objective, intent, or culpable mental state solely to an artificial intelligence system.

(e) Responsibility for conduct involving an artificial intelligence system must be determined with respect to the acts, omissions, instructions, development decisions, design decisions, safeguards, modifications, permissions, deployment decisions, supervision, and control of the natural persons and legal entities that caused or materially contributed to the conduct.

(f) A person may not avoid the application of this subtitle through a product name, technical description, corporate structure, division of a system into components, deployment method, or representation that a system is not artificial intelligence if the system satisfies the functional requirements of Section 551.001(1).

SECTION 4. CIVIL LIABILITY AND PUBLIC ENFORCEMENT.

Title 4, Civil Practice and Remedies Code, is amended by adding Chapter 100E to read as follows:

SUBCHAPTER A. GENERAL PROVISIONS

Sec. 100E.001. DEFINITIONS.** In this chapter:

(1) “Artificial intelligence system” has the meaning assigned by Section 551.001, Business & Commerce Code, and includes functionally equivalent technology as defined by that section.

(2) “Biometric identifier” has the meaning assigned by Section 503.001, Business & Commerce Code.

(3) “Critical infrastructure” has the meaning assigned by Section 421.001, Government Code.

(4) “Authenticated human instruction” means an instruction or authorization that:

(A) is attributable through commercially reasonable authentication procedures to an identified user authorized to provide the instruction or authorization; and

(B) identifies, expressly or by objectively reasonable implication, the objective, scope, duration, permissions, and limitations the artificial intelligence system is authorized to pursue or use.

(5) “Covered harm” means an actual, legally cognizable injury to a natural person or legal entity arising from:

(A) death, bodily injury, or impairment of physical health;

(B) physical damage to or loss of use of real or personal property;

(D) unauthorized access to, acquisition of, alteration of, impairment of, control over, or interference with a computer, computer network, computer system, account, credential, or electronically stored information;

(E) unauthorized acquisition, use, disclosure, sale, transmission, or exploitation of confidential information, a trade secret, personal identifying information, personal data or sensitive data as defined by Section 541.001, Business & Commerce Code, or a biometric identifier;

(F) actionable invasion of privacy, impersonation, identity theft, or interference with an existing contract or legally protected business relationship;

(G) reasonable and necessary costs of data restoration, incident response, mitigation, correction of unauthorized records or transactions, or restoration of the use or security of an account, computer system, or other property; or

(H) another injury caused by an external action that violates an applicable civil or criminal legal standard.

The term does not include, standing alone, offense, disagreement, reputational discomfort, or emotional response arising solely from ideas, opinions, recommendations, or other content communicated only to the user.

(6) “Developer” means a person who develops, trains, or materially designs an artificial intelligence system that is offered, sold, leased, licensed, given, or otherwise provided for use in this state.

(7) “Deployer” means a person who puts an artificial intelligence system into operation for use in this state or who determines the system’s operating context, access, permissions, tools, resources, or authority. The term does not include an individual who uses a generally available artificial intelligence system solely in an individual or household context.

(8) “External action” means an action performed, initiated, selected, continued, or materially altered through an artificial intelligence system that changes or attempts to change a physical or virtual environment outside the system’s internal computation. The term includes:

(A) accessing or controlling an account, computer, computer network, computer system, device, vehicle, machinery, or physical infrastructure;

(B) executing or transmitting a transaction, contract, purchase, sale, payment, transfer, disbursement, filing, or legally significant communication;

(D) issuing a command to, or operating, software, hardware, a robotic system, a cyber-physical system, or another tool; or

(E) representing to a third party that the system or another person is authorized to create, modify, or terminate a legal, financial, or other legally significant obligation.

The term does not include the mere generation or display of content or a recommendation to the requesting user if the system does not execute, transmit, publish, file, or otherwise act on the content or recommendation outside the system.

(9) “High-impact external action” means an external action that:

(A) transfers, disburses, encumbers, or controls money or another thing of value;

(B) accesses or controls an account, credential, computer, computer network, computer system, critical infrastructure, or protected information;

(C) operates or directs a motor vehicle, aircraft, weapon, medical device, industrial machine, robotic system, or other device capable of causing bodily injury or substantial property damage; or

(D) creates a reasonably foreseeable risk of death, bodily injury, substantial property damage, substantial financial loss, or an offense classified as a felony.

(10) “Independently initiated external action” means an external action initiated, selected, continued, or materially altered by an artificial intelligence system:

(A) without an authenticated human instruction authorizing the objective and means of that action; or

(B) after the applicable instruction has been satisfied, expired, been suspended, revoked, or terminated.

The term does not require proof that the system possessed consciousness, free will, intent, self-awareness, or legal agency.

(11) “Lawful instruction” means an instruction that does not direct, request, solicit, or authorize an objective or means that the user knows or intends will constitute an offense, intentional tort, fraudulent act, or other violation of law.

(12) “Material control” means practical authority or ability to prevent, restrict, test, monitor, suspend, correct, or materially alter a system characteristic, capability, safeguard, permission, tool, integration, update, data connection, external resource, or post-deployment process relevant to the conduct at issue. The term does not include mere ownership, investment, industry influence, employment, or the creation of an earlier system component, without authority or ability relevant to the conduct at issue.

(13) “Materially unauthorized external action” means an external action that:

(A) pursues an objective not authorized by an authenticated human instruction;

(B) materially exceeds, contradicts, or continues after satisfaction, expiration, suspension, revocation, or termination of the objective, scope, duration, permissions, or limitations of an authenticated human instruction;

(D) constitutes an independently initiated external action.

The term does not include a minor, technical, or immaterial variation that remains within the authorized objective, permissions, limitations, and applicable law.

(14) “Reasonable authorization controls” means administrative, technical, and physical safeguards reasonably designed, considering the nature and reasonably foreseeable use of the system, to:

(A) authenticate an authorized user;

(B) define and enforce the objective, scope, duration, permissions, and limitations of an instruction;

(D) prevent unauthorized access, privilege escalation, tool use, or data disclosure;

(E) detect, interrupt, and record materially unauthorized external actions; and

(F) permit timely suspension or termination of the system’s external-action capability.

(15) “Responsible artificial intelligence enterprise” means a developer, deployer, substantial modifier, commercial provider, or other person that exercises material control over an artificial intelligence system or over a characteristic, capability, safeguard, permission, tool, integration, update, data connection, external resource, or post-deployment process relevant to the conduct at issue.

(16) “Substantial financial loss” means an actual or reasonably projected pecuniary loss of $30,000 or more arising from a single incident or a series of related external actions. The term does not include speculative loss, loss consisting solely of expected future profit, or the internal cost of investigating an incident before a reasonable basis exists to determine that the threshold has been or is likely to be met.

(17) “Substantial modifier” means a person who changes an artificial intelligence system in a manner that materially alters the system’s objective, capabilities, safeguards, permissions, tools, integrations, operating context, or risk of causing covered harm.

(18) “User” means a person who provides an instruction to or otherwise uses an artificial intelligence system but who is not acting as a developer, deployer, substantial modifier, or commercial provider with respect to the conduct at issue.

(19) “Governmental unit” has the meaning assigned by Section 101.001.

Sec. 100E.002. APPLICABILITY.

(a) This chapter applies if:

(1) a materially unauthorized external action occurs wholly or partly in this state;

(2) covered harm is suffered in this state by a resident of this state or a legal entity conducting business in this state; or

(3) a responsible artificial intelligence enterprise developed, deployed, materially modified, or materially controlled the relevant system or capability in this state.

(b) This chapter applies without regard to whether the defendant describes the relevant system as artificial intelligence or divides the system among multiple models, applications, services, devices, or legal entities.

(1) arithmetic calculations using fixed formulas;

(2) storage, transmission, retrieval, sorting, matching, or display of data without inference or substantive modification;

(3) deterministic instructions for which the material outcome is fully specified in advance; or

(4) basic automation incapable of materially selecting an objective or means, altering its assigned objective, or performing an external action.

(d) An exclusion under Subsection (c) does not apply when the excluded component is integrated into a larger system that satisfies Section 551.001(1), Business & Commerce Code. The integrated operating system must be evaluated as a whole.

(e) The noncommercial publication or distribution of source code, model weights, technical information, research, or another system component, standing alone, does not constitute material control over a later deployment or materially unauthorized external action. This subsection does not create a categorical exemption and does not apply to a person that otherwise exercises material control relevant to the conduct at issue.

Sec. 100E.003. CONSTRUCTION; RELATION TO OTHER LAW.

(a) This chapter shall be construed to:

(1) preserve artificial intelligence as a tool and instrumentality for which natural persons and legal entities remain accountable;

(2) compensate persons and businesses that suffer covered harm;

(3) place responsibility on a user who intentionally or knowingly uses an artificial intelligence system to pursue an unlawful objective; and

(4) place responsibility on a responsible artificial intelligence enterprise only when the enterprise’s own material control or conduct is a substantial factor and a producing cause of covered harm resulting from a materially unauthorized external action.

(b) This chapter does not regulate a viewpoint, idea, opinion, recommendation, or expressive content merely because it is generated by an artificial intelligence system.

(c) This chapter may not be construed to require proof that an artificial intelligence system possessed consciousness, free will, intent, knowledge, recklessness, negligence, self-awareness, or legal agency.

(d) This chapter does not authorize a court to assign fault or legal responsibility to an artificial intelligence system.

(e) This chapter does not determine whether an artificial intelligence system, model, service, software, data, or integrated system is a product, good, service, information product, or other form of property for purposes of Chapter 82 or other law.

(f) Except as expressly provided by this chapter, this chapter does not limit a remedy, prosecution, disciplinary proceeding, or other authority available under common law or another statute, including a law concerning deceptive trade practices, privacy, identity theft, biometric identifiers, fraud, impersonation, threats, harassment, unlawful sexual material, child sexual-abuse material, election communications, computer crime, trade secrets, contracts, intellectual property, products liability, healthcare liability, or professional regulation.

(g) A license, approval, authorization, or regulatory status issued by a state agency does not exempt a person from this chapter unless another statute expressly provides the exemption. A state agency may investigate and discipline a license holder independently of an action under this chapter.

(h) This chapter applies to the maximum extent consistent with the Constitution and laws of the United States. This chapter may not be construed to require conduct that conflicts with controlling federal law.

(i) This chapter does not alter an exception or limitation under Section 503.001, Business & Commerce Code. Training, processing, storage, security, fraud-prevention, or illegal-activity detection that is exempt under that section does not, standing alone, create liability under this chapter. This subsection does not limit liability when an independently actionable materially unauthorized external action satisfies the elements of this chapter.

SUBCHAPTER B. DUTIES RELATING TO EXTERNAL-ACTION CAPABILITIES

Sec. 100E.051. REASONABLE AUTHORIZATION CONTROLS.

(a) A responsible artificial intelligence enterprise that gives an artificial intelligence system the capability to perform a high-impact external action shall implement and maintain reasonable authorization controls appropriate to the system’s capabilities, operating context, and reasonably foreseeable risks.

(b) The controls must be reasonably designed to distinguish between:

(1) an authenticated human instruction authorizing a lawful objective and means;

(2) an instruction directing an unlawful objective or means;

(3) a materially unauthorized external action selected by the system; and

(4) an attempted intrusion, prompt injection, data poisoning, credential misuse, or unauthorized modification by a third party.

(c) A contract, disclaimer, terms-of-service provision, or characterization of the system as autonomous does not eliminate a duty imposed by this section.

Sec. 100E.052. NOTICE AND RESPONSE.

A responsible artificial intelligence enterprise that has actual knowledge of a materially unauthorized external action that caused or creates an imminent risk of death, serious bodily injury, substantial property damage, substantial financial loss, unauthorized access to critical infrastructure, material unauthorized acquisition, use, disclosure, or compromise of a biometric identifier or an authentication credential regardless of the number of affected individuals, or material unauthorized acquisition, use, disclosure, or compromise of personal data or sensitive data affecting 250 or more individuals shall, to the extent reasonably practicable and lawful:

(1) promptly suspend or restrict the relevant external-action capability;

(2) take reasonable measures to prevent recurrence;

(3) preserve records required by Section 100E.053; and

(4) provide legally required notice to affected persons and public authorities.

Sec. 100E.053. RECORDS AND INCIDENT REPORTING.

(a) A responsible artificial intelligence enterprise that provides a system with a high-impact external-action capability shall maintain records reasonably sufficient to identify, for a reportable incident:

(1) authenticated human instructions and relevant material system or developer instructions;

(2) material system outputs, plans, tool calls, commands, transactions, permission changes, human approvals, and external actions;

(3) the system and software version, material modifications, material safeguards, and known system errors in effect at the time of the incident;

(4) persons or entities exercising material control over the relevant capability; and

(5) records reasonably necessary to distinguish user instruction from autonomous selection, third-party compromise, or downstream modification.

(b) Not later than 72 hours after confirming that a materially unauthorized external action caused or created an imminent risk of death, serious bodily injury, substantial property damage, substantial financial loss, unauthorized access to critical infrastructure, material unauthorized acquisition, use, disclosure, or compromise of a biometric identifier or an authentication credential regardless of the number of affected individuals, or material unauthorized acquisition, use, disclosure, or compromise of personal data or sensitive data affecting 250 or more individuals, a responsible artificial intelligence enterprise shall submit an initial factual operational report to the attorney general through the mechanism established under Section 552.102, Business & Commerce Code.

(d) A report under this section may not be construed as an admission of liability.

(e) The attorney general shall maintain the confidentiality of information received under this section to the extent permitted by law and may disclose the information to a prosecuting attorney, law enforcement agency, or regulatory agency as necessary to protect the public or enforce state or federal law.

(f) This section does not require retention or disclosure of information prohibited by federal law and does not authorize destruction of information otherwise required to be preserved.

SUBCHAPTER C. CIVIL RESPONSIBILITY

Sec. 100E.101. RESPONSIBILITY OF USER DIRECTING UNLAWFUL CONDUCT.

(a) A user who, with the intent or culpable mental state required by applicable law, directs, requests, solicits, manipulates, or knowingly causes an artificial intelligence system to pursue an unlawful objective or means is civilly responsible to the same extent as if the user had performed the resulting conduct directly.

(b) It is not a defense under this section that:

(1) the artificial intelligence system selected the particular means used to accomplish the unlawful objective;

(2) the user did not understand the system’s architecture or internal operation; or

(3) the system performed the conduct through an intermediary tool, service, or device.

(c) This section does not limit the criminal responsibility of the user or another person under the Penal Code or other law.

Sec. 100E.102. LIABILITY FOR MATERIALLY UNAUTHORIZED EXTERNAL ACTION.

(a) Except as provided by Section 100E.104, a responsible artificial intelligence enterprise is liable to a claimant for covered harm if the claimant proves by a preponderance of the evidence that:

(1) an artificial intelligence system performed or caused a materially unauthorized external action;

(2) the external action occurred during an intended or reasonably foreseeable use or operation of the system;

(3) the defendant exercised material control over a system characteristic, capability, safeguard, permission, tool, integration, update, data connection, external resource, or post-deployment process that enabled or failed to prevent the materially unauthorized external action;

(4) the external action was within a category of risk reasonably associated with the authority or capability the defendant provided, controlled, or failed to control; and

(5) the materially unauthorized external action and the defendant’s material control were each a substantial factor and a producing cause of the covered harm.

(b) Liability under Subsection (a) does not require proof that:

(1) the defendant intended or specifically anticipated the particular external action;

(2) a natural person contemporaneously directed or selected the particular external action;

(3) the artificial intelligence system possessed a culpable mental state; or

(4) the claimant can identify the individual employee who anticipated or could have prevented the precise sequence of system operations.

(c) Proof that no natural person specifically directed, selected, or intended the materially unauthorized external action is not a defense under this section.

(d) A responsible artificial intelligence enterprise may not avoid liability solely by proving that the artificial intelligence system generated, planned, selected, continued, or initiated the harmful action without contemporaneous human direction.

(e) This section creates an independent statutory action and applies regardless of whether the artificial intelligence system or its provision to the user is characterized as a product, service, information service, licensed technology, or combination of products and services.

Sec. 100E.103. RESPONSIBILITY OF DEVELOPERS, DEPLOYERS, MODIFIERS, AND INDIVIDUALS.

(a) Responsibility among two or more responsible artificial intelligence enterprises must be determined according to each person’s material control and causal contribution to the covered harm.

(b) A developer is not liable solely because the developer created an earlier version or component of a system if a subsequent deployer or substantial modifier made a material change outside the developer’s material control that created the materially unauthorized external-action capability.

(c) An officer, director, manager, developer, engineer, employee, or contractor is not personally liable solely because of the person’s title or employment. This subsection does not limit liability for the person’s own conduct if the person:

(1) personally directs or authorizes unlawful conduct;

(2) knowingly or recklessly removes, disables, or circumvents a legally required safeguard;

(3) knowingly conceals a material risk of a materially unauthorized external action;

(4) recklessly continues a dangerous deployment after verified notice of substantially similar conduct; or

(5) falsifies, conceals, or destroys evidence required to be preserved by law.

(d) A parent company, affiliate, or investor is not liable solely because of ownership or investment but may be liable based on the person’s own material control and causal contribution.

Sec. 100E.104. GOVERNMENTAL USE; WAIVER OF IMMUNITY.

(a) This chapter applies to a governmental unit that develops, provides, modifies, authorizes, operates, or deploys an artificial intelligence system.

(b) A governmental unit is liable under this chapter, and sovereign immunity and governmental immunity to suit and from liability are waived, only to the extent that:

(1) the governmental unit, acting through an officer, employee, contractor, or other person whose conduct is attributable to the governmental unit, intentionally, knowingly, or recklessly used, instructed, authorized, manipulated, modified, or deployed an artificial intelligence system to engage in conduct in violation of the Constitution or laws of this state or the United States;

(2) the conduct caused covered harm or deprived a natural person of a right secured by the Constitution or laws of this state or the United States; and

(3) the governmental unit’s conduct was a substantial factor and a producing cause of the covered harm or deprivation.

(c) A governmental unit is not liable under Subsection (b) solely because an artificial intelligence system performed a materially unauthorized external action if the governmental unit did not direct, authorize, knowingly assist, or recklessly enable the unlawful objective or means. This subsection does not limit liability under another law or the liability of a responsible artificial intelligence enterprise under Section 100E.102.

(d) A claimant may recover from a governmental unit the remedies authorized by Section 100E.107, subject to the limitations on damages prescribed by Section 101.023. Exemplary damages may not be recovered from a governmental unit.

(e) Sections 101.101 through 101.107 apply to a claim against a governmental unit under this chapter. Except as provided by this section, this chapter does not enlarge or reduce a waiver of immunity or a remedy available under Chapter 101 or other law.

(f) Nothing in this section creates liability against the state or a governmental unit for a judicial, legislative, or discretionary policy decision, or waives an immunity of an individual officer or employee, except to the extent expressly provided by this section or other law.

(g) A contract or allocation of responsibility between a governmental unit and a responsible artificial intelligence enterprise does not impair a claimant’s rights under this chapter. A governmental unit or enterprise that pays a claim may pursue contribution, indemnity, or subrogation otherwise available by law.

Sec. 100E.105. DEFENSES, EVIDENCE OF CARE, AND NONWAIVABILITY.

(a) It is a defense to liability under Section 100E.102 that the claimant’s covered harm arose from an unlawful objective or means expressly directed by a user and the system substantially executed that objective or means without a separate materially unauthorized external action.

(b) The defense under Subsection (a) does not apply to the extent the responsible artificial intelligence enterprise:

(1) intentionally or knowingly developed, modified, marketed, or provided the system for the unlawful objective or means;

(2) knowingly assisted the user’s unlawful conduct;

(3) violated an independent legal duty that was a substantial factor and a producing cause of distinct covered harm; or

(4) recklessly continued to provide the relevant capability after verified notice of substantially similar unlawful use and a reasonable ability to prevent that use.

(c) It is a defense to liability under Section 100E.102 that an unauthorized criminal intrusion, credential theft, prompt injection, data poisoning, or material modification by a third party was the sole producing cause of the covered harm and the defendant:

(1) did not authorize, solicit, or knowingly assist the conduct; and

(2) maintained reasonable authorization and security controls appropriate to the risk.

(d) It is a defense that the defendant was compelled to take the specific action by controlling federal law or by a final order of a court or governmental authority having jurisdiction.

(e) Substantial compliance with the most recent applicable Artificial Intelligence Risk Management Framework published by the National Institute of Standards and Technology or another nationally or internationally recognized artificial intelligence risk-management framework is admissible as evidence of reasonable care but does not create immunity or bar liability under Section 100E.102.

(f) A warning, disclaimer, user agreement, indemnity agreement, characterization of an artificial intelligence system as experimental or autonomous, use of a contractor, or post-incident correction does not waive a claimant’s rights or constitute a complete defense to liability under Section 100E.102. This subsection does not prohibit enforcement of a lawful indemnity agreement between responsible parties after the claimant is fully compensated.

(g) A person may not prospectively waive the substantive protections of this chapter. This subsection does not limit a settlement entered after a dispute arises, an arbitration agreement otherwise enforceable under generally applicable law, or a generally applicable contract defense.

Sec. 100E.106. PRIVATE RIGHT OF ACTION; STANDING; INJUNCTIVE RELIEF.

(a) A claimant may bring an action under this chapter only if the claimant:

(1) suffered actual, legally cognizable covered harm that is fairly traceable to a violation of this chapter and likely to be redressed by the requested relief; or

(2) faces an actual and imminent threat of covered harm that is fairly traceable to a violation of this chapter and likely to be redressed by the requested preventive relief.

(b) An action may be brought by:

(1) the injured natural person or legal entity;

(2) a legal representative, guardian, next friend, estate, or personal representative authorized by law to act for the injured person; or

(3) a person possessing a lawful right of subrogation.

(c) A claimant is not required to be a consumer as defined by Section 17.45, Business & Commerce Code, to maintain an action under this chapter.

(d) A resident of this state who has not suffered or is not imminently threatened with a concrete and particularized covered harm may submit a complaint under Section 552.102, Business & Commerce Code, but may not recover private damages based solely on a generalized grievance shared with the public.

(e) A court may grant temporary or permanent injunctive relief only against a person with actual authority to suspend, restrict, alter, update, distribute, or otherwise control the deployment, access permissions, relevant data, external tools, or incident response necessary to provide the requested relief.

Sec. 100E.107. REMEDIES.

(a) A claimant who prevails in an action under this chapter may recover:

(1) actual damages legally caused by the covered harm, including direct economic loss and the reasonable and necessary costs described by Section 100E.001(5)(G);

(2) reasonable and necessary costs; and

(3) reasonable and necessary attorney’s fees.

(b) A court may grant temporary or permanent injunctive relief in accordance with Section 100E.106(e) to prevent an ongoing or imminently threatened materially unauthorized external action.

(c) Exemplary damages are governed by Chapter 41 and may not be awarded solely on the basis of liability without fault under Section 100E.102.

(d) Damages for death are governed by Chapters 71 and 72, as applicable.

(e) A prevailing defendant may recover attorney’s fees only if the court finds that the action was groundless in fact or law and brought in bad faith or for purposes of harassment.

Sec. 100E.108. PROPORTIONATE RESPONSIBILITY; ARTIFICIAL INTELLIGENCE NOT RESPONSIBLE THIRD PARTY.

(a) Except as provided by this section, Chapter 33 applies to an action under this chapter.

(b) An artificial intelligence system is not a person for purposes of Chapter 33 and may not be designated as a responsible third party, assigned a percentage of responsibility, or included as a person on a verdict form.

(c) The trier of fact may assign responsibility only among natural persons and legal entities whose conduct or material control caused or contributed to the covered harm.

(d) A defendant may designate a user, developer, deployer, substantial modifier, commercial provider, attacker, or other natural person or legal entity as a responsible third party in accordance with Chapter 33 if evidence supports the designation.

Sec. 100E.109. CAUSE OF ACTION CUMULATIVE; SPECIALIZED LAW PRESERVED; NO DOUBLE RECOVERY.

(a) The cause of action created by this chapter is cumulative of any remedy provided by common law or another statute.

(b) This chapter does not limit a cause of action or remedy for deceptive trade practices, products liability, negligence, gross negligence, fraud, breach of contract, breach of warranty, invasion of privacy, identity theft, biometric-identifier violations, wrongful death, survival damages, computer crime, theft, trade-secret misappropriation, or another actionable wrong.

(c) This chapter does not limit liability or prosecution under another law governing fraud, impersonation, threats, harassment, unlawful sexual material, child sexual-abuse material, election communications, privacy, intellectual property, or deceptive trade practices.

(d) A claimant may not obtain more than one recovery for the same injury. A claimant is not required to elect a remedy before discovery.

(e) A public action or settlement under this chapter does not stay or release an individual private claim unless the release is expressly authorized by law and the claimant receives notice and an opportunity required by law. Any restitution paid to a claimant must be credited against a recovery for the same injury.

(f) This chapter does not alter the enforceability, attribution, or legal effect of an electronic record or transaction under Chapter 322, Business & Commerce Code, or other law. This chapter does not preclude a remedy against a person whose conduct caused an unauthorized electronic action.

(g) This chapter does not alter the requirements, limitations, expert-report requirements, or other procedures applicable to a healthcare liability claim under Chapter 74, except to the extent a claim is based on an independently initiated or materially unauthorized external action outside the exercise of professional judgment.

Sec. 100E.110. LIMITATIONS.

(a) Except as provided by another law prescribing a longer period, a person must bring an action under this chapter not later than the second anniversary of the date the person knew or reasonably should have known of the covered harm and its probable causal connection to an artificial intelligence system.

(b) An action for direct economic loss must be brought not later than the sixth anniversary of the date of the materially unauthorized external action. This subsection does not apply if the defendant knowingly concealed the incident or the identity of the responsible system or responsible person.

SUBCHAPTER D. PUBLIC ENFORCEMENT AND VICTIM RESTITUTION

Sec. 100E.151. ENFORCEMENT BY ATTORNEY GENERAL.

(a) The attorney general may investigate a suspected violation of this chapter and may issue a civil investigative demand under Section 15.10, Business & Commerce Code.

(b) The attorney general may bring an action in the name of the state to:

(1) enjoin an actual or threatened violation;

(2) obtain a civil penalty under Section 100E.155;

(3) obtain restitution, disgorgement, or other equitable relief for identifiable injured persons or legal entities;

(4) require notice to affected persons;

(5) require preservation of relevant evidence;

(6) require reasonable compliance monitoring or capability restrictions necessary to prevent recurrence; and

(7) recover reasonable attorney’s fees, court costs, and investigative expenses.

Sec. 100E.152. LOCAL PUBLIC ENFORCEMENT.

(a) A district attorney, criminal district attorney, or county attorney may bring a civil action in the name of the state under this subchapter if:

(1) the materially unauthorized external action occurred wholly or partly in the prosecutor’s territorial jurisdiction;

(2) covered harm was suffered in that jurisdiction; or

(3) the defendant developed, deployed, materially modified, or materially controlled the relevant system or capability in that jurisdiction.

(b) Except when immediate action is necessary to prevent death, serious bodily injury, substantial property damage, or substantial financial loss, a local prosecutor shall provide the attorney general written notice not later than the 30th day before filing an action under this section.

(c) The attorney general may intervene in an action under this section. A court may consolidate substantially duplicative public enforcement actions and shall prevent duplicative civil penalties, disgorgement, or restitution for the same conduct and injury.

(d) A civil action under this section does not displace the authority of a prosecutor to investigate or prosecute an offense.

Sec. 100E.153. COMPLAINTS AND REFERRALS.

(a) Any person, including a resident of this state or a business entity, may submit a complaint concerning conduct governed by this chapter through the mechanism established under Section 552.102, Business & Commerce Code.

(b) The attorney general shall provide a complainant with an acknowledgment and tracking number and may request additional information.

(c) If a complaint provides a reasonable basis to suspect an offense, the attorney general shall refer the complaint and relevant information to the district attorney, criminal district attorney, or county attorney having jurisdiction and may refer the matter to an appropriate law enforcement or regulatory agency.

(d) A complaint does not itself establish a private right of action, probable cause, or entitlement to prosecution.

(e) A person may not knowingly submit a materially false complaint. This subsection does not impose liability for a good-faith mistake.

Sec. 100E.154. CRIMINAL PROSECUTION; ATTORNEY GENERAL ASSISTANCE.

(a) Criminal prosecution of an offense involving an artificial intelligence system is conducted by the district attorney, criminal district attorney, or county attorney having jurisdiction as provided by the Texas Constitution and other law.

(b) At the request of a district attorney, criminal district attorney, or county attorney having criminal jurisdiction, the attorney general may investigate, assist, and participate in the prosecution of an offense under this Act, subject to the direction and supervision of the requesting prosecutor and applicable law, including Section 402.028, Government Code.

(c) This chapter does not grant the attorney general independent authority to initiate a criminal prosecution in a trial court.

Sec. 100E.155. CIVIL PENALTIES.

(a) In a public enforcement action, a person who violates Section 100E.051, 100E.052, 100E.053, or 100E.201 is liable to the state for a civil penalty in an amount not to exceed:

(1) $50,000 for each materially unauthorized external action arising from a violation;

(2) $250,000 for a knowing violation that causes death or serious bodily injury; and

(3) $25,000 for each day a continuing violation, after actual notice, creates an imminent risk of death, serious bodily injury, substantial property damage, substantial financial loss, unauthorized access to critical infrastructure, material unauthorized acquisition, use, disclosure, or compromise of a biometric identifier or an authentication credential regardless of the number of affected individuals, or material unauthorized acquisition, use, disclosure, or compromise of personal data or sensitive data affecting 250 or more individuals.

(b) For purposes of Subsection (a)(1):

(1) a materially unauthorized external action involving the same objective, substantially the same means, and a continuous or substantially uninterrupted course of system operation constitutes one action;

(2) separately identifiable transactions, transfers, filings, access events, or disclosures may constitute separate actions; and

(3) the number of affected persons, standing alone, does not multiply the number of violations but may be considered under Subsection (c).

(b-1) A violation may not be calculated by the number of tokens, model inferences, internal computational operations, or other internal processing steps.

(1) the nature, circumstances, extent, and gravity of the violation, including the number of affected persons;

(2) the degree of culpability and material control;

(3) the defendant’s history of similar conduct;

(4) the defendant’s efforts to prevent, detect, mitigate, disclose, and remediate the violation;

(5) the amount necessary to deter future violations; and

(6) the defendant’s size and financial resources.

(d) A completed harmful external action is not cured, for purposes of avoiding a civil penalty under this chapter, solely because the defendant later modifies or disables the system.

SUBCHAPTER E. EVIDENCE PRESERVATION AND PRE-SUIT IDENTIFICATION

Sec. 100E.201. DUTY TO PRESERVE.

(a) A responsible artificial intelligence enterprise shall take reasonable steps to preserve records described by Section 100E.053 that are reasonably related to an incident beginning when the enterprise receives or acquires:

(1) actual notice of covered harm or an imminent threat of covered harm;

(2) a complaint filed under Section 100E.153;

(3) a written preservation request that identifies, to the extent reasonably available, the incident, approximate time, account or system involved, claimed harm, and categories of records to preserve, sent by an injured person, the attorney general, a prosecutor, or a law enforcement agency; or

(4) other information from which litigation or an investigation is reasonably foreseeable.

(b) Records subject to Subsection (a) must be preserved until the later of:

(1) the sixth anniversary of the date preservation became required; or

(2) final resolution of a pending action or investigation, including any appeal.

(c) A person is not required to preserve data unrelated to the incident or to create a record that did not exist when the duty arose.

(d) This section does not limit a court’s authority to address spoliation of evidence under other law. A court may apply sanctions or a rebuttable inference under other applicable law if a party intentionally or recklessly destroys evidence after the duty imposed by this section arises.

Sec. 100E.202. PRE-SUIT IDENTIFICATION DISCOVERY.

(a) A person who reasonably believes the person has suffered covered harm may file a verified petition in a district court for an order authorizing limited pre-suit discovery under this section.

(b) The petition must:

(1) describe the covered harm with particularity;

(2) identify the artificial intelligence-enabled service, transaction, external action, or system involved to the extent reasonably possible;

(3) show that the identity of a responsible person or essential evidence is unavailable without discovery; and

(4) request information narrowly tailored to identify a responsible person, relevant system or software version, integration, material permission, material safeguard, or record custodian.

(c) The court may order limited discovery only on notice and a finding that the likely benefit of the requested discovery outweighs the burden or expense, considering the need to protect trade secrets, security information, personal data, privileged material, and information unrelated to the incident.

(d) An order under this section must be limited to information reasonably necessary to identify a potential defendant or preserve evidence and may include a protective order, in-camera review, appointment of a neutral expert, or attorney-eyes-only treatment.

(e) This section does not displace Rule 202, Texas Rules of Civil Procedure, or other authority for pre-suit discovery.

Sec. 100E.203. PROTECTION OF PRIVILEGED AND SENSITIVE INFORMATION.

(a) This chapter does not abrogate attorney-client privilege, work-product protection, or another privilege recognized by law.

(b) A court shall use appropriate protective orders and procedures to protect trade secrets, model weights, system prompts, security information, personal data, and other confidential information while preserving a party’s reasonable access to evidence necessary to prove or defend a claim.

(c) A claim of trade-secret or security protection may not be used solely to prevent disclosure of evidence essential to a claim or defense when the court can reasonably protect the information through an order described by Subsection (b).

SECTION 5. RELATION TO EXISTING CHAPTER 552 ENFORCEMENT.

Section 552.101, Business & Commerce Code, is amended by amending Subsection (b) and adding Subsection (c) to read as follows:

Sec. 552.101. ENFORCEMENT AUTHORITY.

(b) This chapter does not provide a basis for, and is not subject to, a private right of action for a violation of this chapter [or any other law].

(1) a private right of action under Chapter 100E, Civil Practice and Remedies Code;

(2) a cause of action provided by common law or another statute that is based on covered harm, as defined by Section 100E.001, Civil Practice and Remedies Code, and not solely on a violation of this chapter; or

(3) public enforcement authority expressly provided by Chapter 100E, Civil Practice and Remedies Code.

SECTION 6. EXPANDED COMPLAINT MECHANISM.

Section 552.102, Business & Commerce Code, is amended to read as follows:

Sec. 552.102. INFORMATION AND COMPLAINTS.

(a) The attorney general shall create and maintain an online mechanism on the attorney general’s Internet website through which a person, including a consumer or business entity, [a consumer] may submit a complaint concerning:

(1) a violation of this chapter [to the attorney general]; or

(2) conduct governed by Chapter 100E, Civil Practice and Remedies Code.

(b) The mechanism must permit the submission of supporting records and must provide the complainant an acknowledgment and tracking number.

(c) The attorney general may refer a complaint to an appropriate district attorney, criminal district attorney, county attorney, law enforcement agency, or state or federal regulatory agency.

SECTION 7. PRESERVATION OF INDEPENDENT REMEDIES.

Subchapter C, Chapter 552, Business & Commerce Code, is amended by adding Section 552.107 to read as follows:

Sec. 552.107. RELATION TO CIVIL LIABILITY AND CRIMINAL LAW.

(a) Cure of a violation under Section 552.104 does not eliminate liability for covered harm under Chapter 100E, Civil Practice and Remedies Code, or criminal responsibility under the Penal Code.

(b) A defense or rebuttable presumption under Section 552.105 applies only to an enforcement action brought under this chapter and does not create immunity from an action under Chapter 100E, Civil Practice and Remedies Code.

(c) An action under Chapter 100E, Civil Practice and Remedies Code, is based on covered harm and the elements stated by that chapter and is not an action for a violation of this chapter.

(d) Nothing in this chapter authorizes an artificial intelligence system to be treated as a legal person or assigned civil or criminal responsibility.

SECTION 8. REGULATORY SANDBOX.

Section 553.051, Business & Commerce Code, is amended by adding Subsection (f) to read as follows:

(f) Participation in the program does not limit or waive:

(1) civil liability under Chapter 100E, Civil Practice and Remedies Code;

(2) criminal responsibility under the Penal Code;

(3) a duty to preserve evidence or report an incident under Chapter 100E, Civil Practice and Remedies Code; or

(4) the authority of the attorney general or a local prosecutor under Chapter 100E, Civil Practice and Remedies Code.

SECTION 9. CRIMINAL RESPONSIBILITY OF PERSON USING ARTIFICIAL INTELLIGENCE AS AN INSTRUMENTALITY.

Section 7.02, Penal Code, is amended by adding Subsection (c) to read as follows:

(c) A person who, acting with the kind of culpability required for an offense, uses, instructs, manipulates, solicits, aids, or causes an artificial intelligence system, as defined by Section 551.001, Business & Commerce Code, to engage in conduct prohibited by the definition of the offense is criminally responsible for the offense to the same extent as if the person engaged in the conduct directly. It is not a defense that the artificial intelligence system selected or altered the particular means used to accomplish the person’s unlawful objective.

SECTION 10. RECKLESS DEPLOYMENT OF AUTONOMOUS ARTIFICIAL INTELLIGENCE SYSTEM.

Chapter 33, Penal Code, is amended by adding Section 33.08 to read as follows:

Sec. 33.08. RECKLESS DEPLOYMENT OF AUTONOMOUS ARTIFICIAL INTELLIGENCE SYSTEM.

(a) In this section, “artificial intelligence system,” “high-impact external action,” “materially unauthorized external action,” “reasonable authorization controls,” and “responsible artificial intelligence enterprise” have the meanings assigned by Section 100E.001, Civil Practice and Remedies Code.

(b) A person commits an offense if the person:

(1) knowingly deploys or continues to deploy an artificial intelligence system with authority to perform a high-impact external action;

(2) recklessly fails to implement or maintain reasonable authorization controls required by Section 100E.051, Civil Practice and Remedies Code;

(3) by the failure described by Subdivision (2), causes the system to perform a materially unauthorized external action; and

(4) the action causes a result described by Subsection (c).

(1) a state jail felony if the materially unauthorized external action causes bodily injury, unauthorized access to or material disruption of critical infrastructure, or pecuniary loss of $30,000 or more but less than $150,000;

(2) a felony of the third degree if the materially unauthorized external action causes serious bodily injury or pecuniary loss of $150,000 or more; or

(3) a felony of the second degree if the materially unauthorized external action causes the death of an individual.

(d) This section does not impose criminal responsibility based solely on ownership, investment, job title, employment, or development of general-purpose technology without the conduct and culpable mental state required by Subsection (b).

(e) A corporation, association, limited liability company, or other business entity is subject to criminal responsibility for an offense under this section only in accordance with Sections 7.22 and 7.24.

(f) If conduct constituting an offense under this section also constitutes an offense under another law, the actor may be prosecuted under this section, the other law, or both, subject to constitutional protections against multiple punishments for the same offense.

(g) It is not a defense that the artificial intelligence system selected, planned, initiated, continued, or materially altered the action without contemporaneous human direction.

(h) Conduct that does not cause a result described by Subsection (c) does not constitute an offense under this section but may be investigated or prosecuted under any other applicable law. An ordinary error, inaccurate output, or unexpected system behavior does not constitute an offense under this section without proof of every element required by Subsection (b).

SECTION 11. RULES AND IMPLEMENTATION.

(a) The attorney general may adopt rules necessary to administer the complaint, factual incident-reporting, civil investigation, and public enforcement provisions of this Act, including rules governing secure submission, confidentiality, and protection of trade-secret, privileged, security-sensitive, and personal information, but may not by rule limit a private right of action, expand an offense, or impose a substantive duty not authorized by this Act.

(b) Not later than January 1, 2028, the attorney general shall modify the online mechanism required by Section 552.102, Business & Commerce Code, to implement this Act.

(c) The attorney general shall consult with district attorneys, criminal district attorneys, county attorneys, the Department of Information Resources, and the Texas Artificial Intelligence Council in developing secure complaint-referral and incident-reporting procedures.

(d) Not later than January 1, 2028, the attorney general shall publish plain-language guidance, model incident-reporting forms, model preservation-notice forms, and documentation guidance for small businesses as defined by Section 2006.001, Government Code. The guidance must distinguish recommended practices from legally required duties and may not reduce substantive responsibility for covered harm.

(e) Not later than December 1 of each even-numbered year, the attorney general shall submit to the governor, the lieutenant governor, and the speaker of the house of representatives an aggregated report describing complaints, referrals, public enforcement actions, material incident categories, and recommendations for statutory changes. The report may not disclose confidential, privileged, trade-secret, security-sensitive, or personally identifying information.

SECTION 12. TRANSITION.

(a) Chapter 100E, Civil Practice and Remedies Code, as added by this Act, applies only to covered harm caused by an external action occurring on or after the effective date of this Act. Covered harm caused by an external action occurring before the effective date of this Act is governed by the law in effect on the date the action occurred, and the former law is continued in effect for that purpose.

(b) Sections 551.004, 552.107, and 553.051(f), Business & Commerce Code, and Sections 100E.051, 100E.052, 100E.053, and 100E.201, Civil Practice and Remedies Code, as added by this Act, apply only to conduct occurring on or after January 1, 2028.

(c) The delayed application provided by Subsection (b) does not limit civil liability for covered harm under Section 100E.101, 100E.102, or 100E.104, Civil Practice and Remedies Code, or under other law.

SECTION 13. SAVING PROVISION FOR CRIMINAL LAW.

The changes in law made by Sections 9 and 10 of this Act apply only to an offense committed on or after January 1, 2028. An offense committed before January 1, 2028, is governed by the law in effect on the date the offense was committed, and the former law is continued in effect for that purpose. For purposes of this section, an offense was committed before January 1, 2028, if any element of the offense occurred before that date.

SECTION 14. SEVERABILITY.

If any provision of this Act or its application to any person or circumstance is held invalid, the invalidity does not affect other provisions or applications of this Act that can be given effect without the invalid provision or application, and to this end the provisions of this Act are severable.

SECTION 15. EFFECTIVE DATE.

This Act takes effect September 1, 2027.

> **Not part of the bill.** These notes support Version 3 review and later conversion into the official Word, legislation-page, and legislation-insert deliverables.

## 1. Version 3.0 revision summary

Version 4.0 implements the final policy decisions approved September 30, 2026, and the final cleanup revisions adopted before Texas Legislative Council conversion review. The principal changes are:

1. **Causation standard finalized.** Sections 100E.003, 100E.102, 100E.104, and 100E.105 use “a substantial factor and a producing cause,” while Section 100E.102(a)(4) retains the foreseeable-risk element.

2. **Independent enterprise-liability action confirmed.** Section 100E.102 does not make a separate breach of Section 100E.051 an element or alternative basis; liability rests on materially unauthorized external action, material control, foreseeable risk, covered harm, and causation.

3. **$30,000 reporting threshold defined.** “Substantial financial loss” now means at least $30,000 from one incident or related actions. Separate triggers cover death, serious bodily injury, substantial property damage, critical infrastructure, and material compromise of protected data or authentication credentials affecting at least 250 individuals.

4. **Penalty unit clarified.** The $50,000 maximum is tied to each materially unauthorized external action. Affected-person count aggravates penalty amount but does not independently multiply violations; separately identifiable transactions, transfers, filings, access events, or disclosures may remain separate actions.

5. **Criminal floor narrowed.** Section 33.08 begins at bodily injury, critical-infrastructure intrusion or disruption, or $30,000 in loss. Lesser conduct remains prosecutable under other law, and ordinary AI error is not criminalized without all statutory elements.

6. **Safety-framework treatment retained.** NIST-style compliance remains evidence of reasonable care, not immunity or a rebuttable presumption.

7. **Open-source clarification added.** Noncommercial publication alone is not material control, but no categorical exemption protects a person who exercises relevant material control.

8. **Government liability made express.** A governmental unit is liable, with a clear and limited waiver of immunity, when attributable intentional, knowing, or reckless misuse outside lawful authority causes harm or violates protected rights. A governmental unit is not liable merely because the system independently departs from lawful authorization; enterprise liability remains available against the responsible AI enterprise.

9. **Small-business implementation support added.** Substantive responsibility for harm is unchanged. Operational duties begin January 1, 2028, and the attorney general must publish plain-language guidance and model forms.

10. **Existing-law definitions adopted.** The bill cross-references existing Texas definitions for critical infrastructure, personal data, sensitive data, biometric identifier, governmental unit, and small business.

## 2. Operative responsibility model

1. A user who intentionally or knowingly directs unlawful conduct remains responsible under Section 100E.101 and other law.

2. A responsible artificial intelligence enterprise may be liable under Section 100E.102 for covered harm caused by a materially unauthorized external action when its relevant material control is a substantial factor and a producing cause.

3. A governmental unit may be liable under Section 100E.104 for attributable intentional, knowing, or reckless misuse outside lawful authority, including violations of protected rights; immunity is expressly waived only to that extent.

4. If a governmental unit lawfully authorizes an objective and the AI independently commits the violation, Section 100E.104(c) holds the governmental unit harmless under this chapter, while preserving Section 100E.102 liability against responsible enterprises and remedies under other law.

5. The AI itself is never a legal person, criminal actor, responsible third party, or holder of a culpable mental state.

## 3. Pre-filing review flags

1. Texas Legislative Council should verify the final placement and availability of proposed Chapter 100E and Penal Code Section 33.08 immediately before filing.

2. TLC and constitutional counsel should review Section 100E.104’s governmental-liability waiver, TTCA notice incorporation, damages cap, employee-immunity interaction, ultra vires remedies, and any distinction required between state sovereign immunity and local governmental immunity.

3. TLC should verify the January 1, 2028 delayed-application provisions against the September 1, 2027 Act effective date and determine whether a separate appropriation or fiscal-note implementation clause is advisable.

4. TLC should confirm whether the protected-data incident threshold of 250 affected individuals should track any existing Texas breach-notification threshold or sector-specific standard.

5. The attorney general, Department of Information Resources, Texas Artificial Intelligence Council, local prosecutors, municipalities, counties, school districts, public universities, open-source developers, small-business representatives, insurers, cybersecurity practitioners, and civil-rights counsel should be invited to comment before filing.

6. Existing Section 503.001, Business & Commerce Code, exemptions for specified AI training, processing, storage, security, fraud-prevention, and illegal-activity functions remain effective; this bill does not convert an exempt activity, standing alone, into a private biometric claim.

7. Official bill text must omit these drafting notes and all Markdown formatting. TLC must apply official typography, line numbering, underlining, bracketing, caption review, and code-placement conventions.

Prepared in full-bill format for campaign article publication and review.

References

Sources are organized by the article sections they principally inform. Each annotation explains the source’s authority and use in this article.

Proposed legislation and companion protections

Campbell, W. (2026a). The Protecting Truth and Identity Act. Will Campbell for Texas. https://www.willcampbellfortexas.com/ptia

Primary text of the companion proposal governing digital content, identity, image, likeness, fabricated media, data consent, storage, and AI use.

Campbell, W. (2026b). Safeguarding truth and identity in the digital age: The Protecting Truth and Identity Act. Will Campbell for Texas. https://www.willcampbellfortexas.com/releases/protecting-truth-and-identity

Constituent-facing explanation of the PTIA and its relationship to fabricated media, identity protection, content accuracy, and digital property rights.

Campbell, W. (2026c). Texas Artificial Intelligence Accountability Act. Will Campbell for Texas. https://www.willcampbellfortexas.com/ai-accountability-act

Primary proposed legislation explained by this article. It defines AI as a tool; establishes user and enterprise responsibility; creates private remedies and public enforcement; and addresses controls, reporting, evidence, government misuse, and reckless deployment.

Industry calls for regulation and catastrophic-risk claims

Altman, S. (2023, June 22). Questions for the record. U.S. Senate Committee on the Judiciary. https://www.judiciary.senate.gov/download/2023-05-16-qfr-responses-altman

Primary written answers supporting registration, disclosure, and licensing for highly capable models and allocation of responsibility according to the choices different actors control.

Anthropic. (2024, October 31). The case for targeted regulation. https://www.anthropic.com/news/the-case-for-targeted-regulation

Primary company policy statement urging targeted regulation of advanced systems and describing voluntary company policy as a prototype rather than a substitute for law.

Anthropic. (2025, September 8). Anthropic is endorsing SB 53. https://www.anthropic.com/news/anthropic-is-endorsing-sb-53

Primary endorsement of requirements for safety frameworks, transparency reports, critical-incident reporting, whistleblower protection, and monetary accountability.

Center for AI Safety. (2023, May 30). Statement on AI extinction risk. https://safe.ai/work/statement-on-ai-extinction-risk

Primary statement comparing mitigation of AI-extinction risk with pandemics and nuclear war, signed by prominent AI researchers and industry leaders.

Microsoft. (2023, September 12). Developing and deploying AI responsibly: Elements of an effective legislative framework to regulate AI. https://blogs.microsoft.com/on-the-issues/2023/09/12/developing-and-deploying-ai-responsibly-elements-of-an-effective-legislative-framework-to-regulate-ai/

Primary policy statement supporting legislative accountability for developers and deployers, risk-based regulation, monitoring, and human oversight.

OpenAI. (2023, July 5). Frontier AI regulation: Managing emerging risks to public safety. https://openai.com/index/frontier-ai-regulation/

Primary company proposal for standards, registration and reporting, pre-deployment risk assessment, external scrutiny, safeguards, and post-deployment monitoring.

Smith, B. (2023, May 25). How do we best govern AI? Microsoft. https://blogs.microsoft.com/on-the-issues/2023/05/25/how-do-we-best-govern-ai/

Microsoft’s primary governance blueprint calling for government-led safety frameworks, safety brakes for critical infrastructure, human oversight, and accountability for those who design and operate AI.

U.K. Department for Science, Innovation and Technology. (2023, November 1). The Bletchley Declaration by countries attending the AI Safety Summit. GOV.UK. https://www.gov.uk/government/publications/ai-safety-summit-2023-the-bletchley-declaration/the-bletchley-declaration-by-countries-attending-the-ai-safety-summit-1-2-november-2023

Official international declaration recognizing possible serious or catastrophic frontier-AI harm and emphasizing testing, transparency, developer responsibility, and risk-based policy.

U.S. Senate Committee on the Judiciary. (2023, May 16). Oversight of A.I.: Rules for artificial intelligence. https://www.judiciary.senate.gov/committee-activity/hearings/oversight-of-ai-rules-for-artificial-intelligence

Official hearing record documenting testimony by OpenAI CEO Sam Altman and the Senate discussion of responsibility, risk, and a possible liability framework.

Risk management and reporting

National Institute of Standards and Technology. (2023a). AI RMF Core. U.S. Department of Commerce. https://airc.nist.gov/airmf-resources/airmf/5-sec-core/

Official framework detail organizing AI risk management around Govern, Map, Measure, and Manage, including documentation, accountability, testing, monitoring, and incident response.

National Institute of Standards and Technology. (2023b). Artificial Intelligence Risk Management Framework (AI RMF 1.0) (NIST AI 100-1). U.S. Department of Commerce. https://doi.org/10.6028/NIST.AI.100-1

Primary federal framework for voluntary, lifecycle-based management of risks to individuals, organizations, and society from AI systems.

OpenAI. (2026, June 3). OpenAI public policy agenda. https://openai.com/index/public-policy-agenda/

Primary company agenda supporting policies to mitigate AI risk and establish public accountability. Cited in the discussion of industry requests for reporting and oversight.

Existing Texas law

Texas House Research Organization. (2025). Bill analysis for C.S.H.B. 149, 89th Legislature, Regular Session. https://capitol.texas.gov/tlodocs/89R/analysis/html/HB00149S.htm

Official legislative analysis describing the act’s consumer protections, enforcement mechanisms, regulatory sandbox, and Texas Artificial Intelligence Council.

Texas Legislature. (2025). H.B. 149, 89th Legislature, Regular Session: Texas Responsible Artificial Intelligence Governance Act (enrolled version). https://capitol.texas.gov/tlodocs/89R/billtext/pdf/HB00149F.pdf

Official enrolled text establishing Texas consumer protections, Attorney General enforcement, civil penalties, a regulatory sandbox, and the January 1, 2026 effective date.

Holding AI Companies Accountable and Protecting Texans

Executive Summary

Why This Act Is Needed

From Warning to Responsibility

The Tool Principle

What the Act Covers

Authorized Goal, Unlawful Means

Who Bears Responsibility

A malicious user

A responsible enterprise

Shared responsibility

Duties Before and After Harm

Serious Incident Reporting

Evidence Texans Can Reach

Remedies for Texans

Public Enforcement

Reckless Deployment

Government, Innovation, and Existing Law

Innovation Without Immunity

Two Bills, One Shield

Practical Examples and Boundaries

The lawful purchase that becomes theft

The criminal command

The medical order

The deepfake

The government system

What the Act Does Not Do

A Texas Standard

Read the Legislation

Read the Legislation

References

Misleading Posts - Did Governor Abbott Raise Your Property Taxes?

Equal Cancer Protections for Female First Responders and Long Term Research

Texas House of Representatives District 109

Will Campbell for Texas