Title BC, Business and Commerce Code

Sec. 541.107. REQUIREMENTS FOR SMALL BUSINESSES. (a) A person described by Section 541.002(a)(3) may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer. (b) A person who violates this section is subject to the penalty …

Sec. 541.151. ENFORCEMENT AUTHORITY EXCLUSIVE. The attorney general has exclusive authority to enforce this chapter. Added by Acts 2023, 88th Leg., R.S., Ch. 995 (H.B. 4), Sec. 2, eff. July 1, 2024.

Sec. 541.152. INTERNET WEBSITE AND COMPLAINT MECHANISM. The attorney general shall post on the attorney general's Internet website: (1) information relating to: (A) the responsibilities of a controller under Subchapters B and C; (B) the responsibilities of a processor under Subch…

Sec. 541.153. INVESTIGATIVE AUTHORITY. (a) If the attorney general has reasonable cause to believe that a person has engaged in or is engaging in a violation of this chapter, the attorney general may issue a civil investigative demand. The procedures established for the issuance …

Sec. 541.154. NOTICE OF VIOLATION OF CHAPTER; OPPORTUNITY TO CURE. Before bringing an action under Section 541.155, the attorney general shall notify a person in writing, not later than the 30th day before bringing the action, identifying the specific provisions of this chapter t…

Sec. 541.155. CIVIL PENALTY; INJUNCTION. (a) A person who violates this chapter following the cure period described by Section 541.154 or who breaches a written statement provided to the attorney general under that section is liable for a civil penalty in an amount not to exceed …

Sec. 541.156. NO PRIVATE RIGHT OF ACTION. This chapter may not be construed as providing a basis for, or being subject to, a private right of action for a violation of this chapter or any other law. Added by Acts 2023, 88th Leg., R.S., Ch. 995 (H.B. 4), Sec. 2, eff. July 1, 2024.…

Sec. 541.201. CONSTRUCTION OF CHAPTER. (a) This chapter may not be construed to restrict a controller's or processor's ability to: (1) comply with federal, state, or local laws, rules, or regulations; (2) comply with a civil, criminal, or regulatory inquiry, investigation, subpoe…

Sec. 541.202. COLLECTION, USE, OR RETENTION OF DATA FOR CERTAIN PURPOSES. (a) The requirements imposed on controllers and processors under this chapter may not restrict a controller's or processor's ability to collect, use, or retain data to: (1) conduct internal research to deve…

Sec. 541.203. DISCLOSURE OF PERSONAL DATA TO THIRD-PARTY CONTROLLER OR PROCESSOR. (a) A controller or processor that discloses personal data to a third-party controller or processor, in compliance with the requirements of this chapter, does not violate this chapter if the third-p…

Sec. 541.204. PROCESSING OF CERTAIN PERSONAL DATA BY CONTROLLER OR OTHER PERSON. (a) Personal data processed by a controller under this subchapter may not be processed for any purpose other than a purpose listed in this subchapter unless otherwise allowed by this chapter. Persona…

Sec. 541.205. LOCAL PREEMPTION. This chapter supersedes and preempts any ordinance, resolution, rule, or other regulation adopted by a political subdivision regarding the processing of personal data by a controller or processor. Added by Acts 2023, 88th Leg., R.S., Ch. 995 (H.B. …

Sec. 542.001. DEFINITIONS. In this chapter: (1) "Breach of system security" has the meaning assigned by Section 521.053. (2) "Exemplary damages" has the meaning assigned by Section 41.001, Civil Practice and Remedies Code. (3) "Personal identifying information" and "sensitive per…

Sec. 542.002. APPLICABILITY OF CHAPTER. This chapter applies only to a business entity in this state that: (1) has fewer than 250 employees; and (2) owns or licenses computerized data that includes sensitive personal information. Added by Acts 2025, 89th Leg., R.S., Ch. 1029 (S.B…

Sec. 542.003. CYBERSECURITY PROGRAM SAFE HARBOR: EXEMPLARY DAMAGES PROHIBITED. Notwithstanding any other law, in an action arising from a breach of system security, a person harmed as a result of the breach may not recover exemplary damages from a business entity to which this ch…

Sec. 542.004. CYBERSECURITY PROGRAM. (a) For purposes of Section 542.003, a cybersecurity program must: (1) contain administrative, technical, and physical safeguards for the protection of personal identifying information and sensitive personal information; (2) conform to an indu…

Sec. 542.005. CONSTRUCTION OF CHAPTER; NO PRIVATE CAUSE OF ACTION. This chapter may not be construed to create a private cause of action or change a common law or statutory duty. Added by Acts 2025, 89th Leg., R.S., Ch. 1029 (S.B. 2610), Sec. 1, eff. September 1, 2025.

Sec. 551.001. DEFINITIONS. In this subtitle: (1) "Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recomme…

Sec. 551.002. APPLICABILITY OF SUBTITLE. This subtitle applies only to a person who: (1) promotes, advertises, or conducts business in this state; (2) produces a product or service used by residents of this state; or (3) develops or deploys an artificial intelligence system in th…

Sec. 551.003. CONSTRUCTION AND APPLICATION OF SUBTITLE. This subtitle shall be broadly construed and applied to promote its underlying purposes, which are to: (1) facilitate and advance the responsible development and use of artificial intelligence systems; (2) protect individual…

Sec. 552.001. DEFINITIONS. In this chapter: (1) "Deployer" means a person who deploys an artificial intelligence system for use in this state. (2) "Developer" means a person who develops an artificial intelligence system that is offered, sold, leased, given, or otherwise provided…

Sec. 552.002. CONSTRUCTION OF CHAPTER. This chapter may not be construed to: (1) impose a requirement on a person that adversely affects the rights or freedoms of any person, including the right of free speech; or (2) authorize any department or agency other than the Department o…

Sec. 552.003. LOCAL PREEMPTION. This chapter supersedes and preempts any ordinance, resolution, rule, or other regulation adopted by a political subdivision regarding the use of artificial intelligence systems. Added by Acts 2025, 89th Leg., R.S., Ch. 1174 (H.B. 149), Sec. 4, eff…

Sec. 552.051. DISCLOSURE TO CONSUMERS. (a) In this section, "health care services" means services related to human health or to the diagnosis, prevention, or treatment of a human disease or impairment provided by an individual licensed, registered, or certified under applicable s…

Sec. 552.052. MANIPULATION OF HUMAN BEHAVIOR. A person may not develop or deploy an artificial intelligence system in a manner that intentionally aims to incite or encourage a person to: (1) commit physical self-harm, including suicide; (2) harm another person; or (3) engage in c…

Sec. 552.053. SOCIAL SCORING. A governmental entity may not use or deploy an artificial intelligence system that evaluates or classifies a natural person or group of natural persons based on social behavior or personal characteristics, whether known, inferred, or predicted, with …

Sec. 552.054. CAPTURE OF BIOMETRIC DATA. (a) In this section, "biometric data" means data generated by automatic measurements of an individual's biological characteristics. The term includes a fingerprint, voiceprint, eye retina or iris, or other unique biological pattern or char…

Sec. 552.055. CONSTITUTIONAL PROTECTION. (a) A person may not develop or deploy an artificial intelligence system with the sole intent for the artificial intelligence system to infringe, restrict, or otherwise impair an individual's rights guaranteed under the United States Const…

Sec. 552.056. UNLAWFUL DISCRIMINATION. (a) In this section: (1) "Financial institution" has the meaning assigned by Section 201.101, Finance Code. (2) "Insurance entity" means: (A) an entity described by Section 82.002(a), Insurance Code; (B) a fraternal benefit society regulated…

Sec. 552.057. CERTAIN SEXUALLY EXPLICIT CONTENT AND CHILD PORNOGRAPHY. A person may not: (1) develop or distribute an artificial intelligence system with the sole intent of producing, assisting or aiding in producing, or distributing: (A) visual material in violation of Section 4…

Sec. 552.101. ENFORCEMENT AUTHORITY. (a) The attorney general has exclusive authority to enforce this chapter, except to the extent provided by Section 552.106. (b) This chapter does not provide a basis for, and is not subject to, a private right of action for a violation of this…

Sec. 552.102. INFORMATION AND COMPLAINTS. The attorney general shall create and maintain an online mechanism on the attorney general's Internet website through which a consumer may submit a complaint under this chapter to the attorney general. Added by Acts 2025, 89th Leg., R.S.,…

Sec. 552.103. INVESTIGATIVE AUTHORITY. (a) If the attorney general receives a complaint through the online mechanism under Section 552.102 alleging a violation of this chapter, the attorney general may issue a civil investigative demand to determine if a violation has occurred. T…

Sec. 552.104. NOTICE OF VIOLATION; OPPORTUNITY TO CURE. (a) If the attorney general determines that a person has violated or is violating this chapter, the attorney general shall notify the person in writing of the determination, identifying the specific provisions of this chapte…

Sec. 552.105. CIVIL PENALTY; INJUNCTION. (a) A person who violates this chapter and does not cure the violation under Section 552.104 is liable to this state for a civil penalty in an amount of: (1) for each violation the court determines to be curable or a breach of a statement …

Sec. 552.106. ENFORCEMENT ACTIONS BY STATE AGENCIES. (a) A state agency may impose sanctions against a person licensed, registered, or certified by that agency for a violation of Subchapter B if: (1) the person has been found in violation of this chapter under Section 552.105; an…

Sec. 553.001. DEFINITIONS. In this chapter: (1) "Applicable agency" means a department of this state established by law to regulate certain types of business activity in this state and the people engaging in that business, including the issuance of licenses and registrations, tha…

Sec. 553.051. ESTABLISHMENT OF SANDBOX PROGRAM. (a) The department, in consultation with the council, shall create a regulatory sandbox program that enables a person to obtain legal protection and limited access to the market in this state to test innovative artificial intelligen…

Sec. 553.052. APPLICATION FOR PROGRAM PARTICIPATION. (a) A person must obtain approval from the department and any applicable agency before testing an artificial intelligence system under the program. (b) The department by rule shall prescribe the application form. The form must …

Sec. 553.053. DURATION AND SCOPE OF PARTICIPATION. (a) A program participant approved by the department and each applicable agency may test and deploy an artificial intelligence system under the program for a period of not more than 36 months. (b) The department may extend a test…

Sec. 553.054. EFFICIENT USE OF RESOURCES. The department shall coordinate the activities under this subchapter and any other law relating to artificial intelligence systems to ensure efficient system implementation and to streamline the use of department resources, including info…

Sec. 553.101. COORDINATION WITH APPLICABLE AGENCY. (a) The department shall coordinate with all applicable agencies to oversee the operation of a program participant. (b) The council or an applicable agency may recommend to the department that a program participant be removed fro…

Sec. 553.102. PERIODIC REPORT BY PROGRAM PARTICIPANT. (a) A program participant shall provide a quarterly report to the department. (b) The report shall include: (1) metrics for the artificial intelligence system's performance; (2) updates on how the artificial intelligence syste…

Sec. 553.103. ANNUAL REPORT BY DEPARTMENT. (a) The department shall submit an annual report to the legislature. (b) The report shall include: (1) the number of program participants testing an artificial intelligence system in the program; (2) the overall performance and impact of…

Sec. 554.001. CREATION OF COUNCIL. (a) The Texas Artificial Intelligence Council is created to: (1) ensure artificial intelligence systems in this state are ethical and developed in the public's best interest; (2) ensure artificial intelligence systems in this state do not harm p…

Sec. 554.002. COUNCIL MEMBERSHIP. (a) The council is composed of seven members as follows: (1) three members of the public appointed by the governor; (2) two members of the public appointed by the lieutenant governor; and (3) two members of the public appointed by the speaker of …