DIR Advances Statewide Artificial Intelligence Governance Work

The Department of Information Resources (DIR) is moving ahead with several statewide artificial intelligence initiatives as agencies begin working under a governance framework adopted earlier this year.

The update, presented during DIR’s May 21 board meeting, follows the board’s February adoption of a new Texas Administrative Code Chapter 219 subchapter governing AI. Those rules established a statewide AI code of ethics and minimum standards for agencies that procure, develop, deploy or use AI systems, including systems subject to heightened scrutiny.

David Escamilla, presenting on behalf of DIR’s Chief Technology Office, told the board that the agency has published standards for AI training programs and has begun certifying courses that meet those standards.

Government Code Section 2054.5191 requires certain state and local government employees to annually complete a certified AI awareness training program. DIR, in consultation with the Public Sector AI Systems Advisory Board, is required to certify at least five AI training programs for state and local government employees.

To be certified, training programs must focus on building an understanding of how AI technology may be used in relation to an employee’s responsibilities and duties. They also must teach best practices on literacy in deploying and operating AI technologies.

As of early May, DIR had received 87 training applications, certified 57 programs and declined to certify 21 that did not meet the state’s standard, according to Escamilla.

For fiscal years 2026 and 2027, DIR is not changing the certification criteria and is extending FY 2025-26 training program certifications through Aug. 31, 2027. Entities with an approved certification do not need to resubmit their programs.

DIR published its own certified AI training program April 7. The course is available at no cost and is included with cybersecurity training that state workers and board members will be asked to complete.

DIR has also published AI System Facts, a standardized notice template for agencies and local governments using public-facing AI systems or systems that play a controlling role in consequential decisions. The notice is intended to appear wherever those systems are made available to the public, including related applications, websites and public computer systems. DIR said completed notices do not need to be submitted back to the agency for review.

Separate from the statewide code of ethics, DIR has also adopted an internal acceptable use policy for AI and is making it available as a resource for state and local government entities. Escamilla said the policy is focused on DIR, but the agency expects other state agencies to use it as a template or starting point when developing their own policies.

The statewide code of ethics is broader. During the board discussion, Escamilla said the code applies across generative AI, agentic AI and other forms of intelligent automation. He said state agencies are expected to adopt AI ethics policies by August.

DIR’s AI user group now has more than 1,000 members. The group meets about every two months and holds in-person conferences about twice a year. Escamilla said DIR is considering whether to divide the group into more targeted sections, such as public safety or regulatory work, as participation grows.

The agency is also using the Information Resources Deployment Review to collect more information about how agencies are using AI. DIR added questions to the 2026 review asking whether reported business applications use AI, whether they involve heightened-scrutiny AI and what risk mitigation measures are in place.

Escamilla said agencies had from January to March to complete the review, with 100 percent agency participation. Agencies had until May to respond to DIR’s analysis, and a final report is expected in the fall.

The AI update comes as DIR’s statewide role continues to shift in other areas. Sauerhoff told the board that statewide cybersecurity employees and functions have moved to Texas Cyber Command, while DIR is retaining internal cybersecurity responsibilities and vendor-focused security oversight within Shared Technology Services.