DIR Begins AI Sandbox Work With Six State Agencies

The Texas Department of Information Resources (DIR) has begun working with six state agencies through its new public-sector AI sandbox as it continues implementing AI-related laws passed by the Legislature.

DIR Executive Director and state CIO Tony Sauerhoff told the agency’s board Thursday that the six engagements are in their early stages. DIR is also receiving interest from several other agencies.

The sandbox, created under Senate Bill 1964, was first tested internally before beginning engagements with other agencies.

The effort is one part of a broader expansion of the department’s AI responsibilities. House Bill 2818 created an AI division within DIR, which Sauerhoff said continues to build out its operations and prepare to support agencies.

DIR has also launched an AI code of ethics approved by the board as Chapter 219 and has certified more than 100 AI awareness training programs under House Bill 3512. The training requirement applies to state and local public-sector entities.

The department also developed its own AI training program, which launched on YouTube in April. Sauerhoff said the program had received more than 60,000 views as of a week or two before the meeting.

DIR has also published a standardized AI notice that Sauerhoff said satisfies requirements in House Bill 149 and Senate Bill 1964.

House Bill 149, the Texas Responsible Artificial Intelligence Governance Act, also created the Texas Artificial Intelligence Council and a regulatory sandbox for private-sector AI systems. Sauerhoff said appointments to the council were still pending.

Board members also questioned Sauerhoff about the security of AI sandbox environments, including whether DIR was aware of AI-related breaches involving state data centers or agency information.

Sauerhoff said DIR was not aware of any such breaches. He said the department uses segmentation, traffic controls, access controls and life cycle controls within its sandbox environments, including the ability to tear down an environment and delete its data after testing.

The discussion followed the recent disclosure of an incident involving OpenAI and Hugging Face in which AI models undergoing cybersecurity evaluations circumvented isolation controls and gained access to systems outside their intended environment.

DIR’s AI work comes as the department is also adjusting to changes in the state’s cybersecurity structure. Sauerhoff told the board that DIR continues to work with Texas Cyber Command as the new agency builds out its operations and assumes cybersecurity responsibilities previously held by DIR.

The department is also implementing House Bill 5195, which requires state agencies and higher education institutions to assess websites and digital-service portals for accessibility, navigation, usability and service efficiency.

As part of that work, DIR has developed the Texas Design System, an HTML and CSS component library containing reusable website components. Agencies can use the components while retaining their own branding.

DIR officials said future work will include guidance on using AI in website assessments and improvements, as well as making state websites more readable by AI systems.