USA – TEXAS Trends and Developments Contributed by: Christina Morgan, Jason Blackstone and Matthew Yarbrough, Buchalter LLP
• HB 149: Financial Abuse Using Artificially Generat - ed Media or Phishing, effective 1 September 2025; • H 878: Unlawful Production or Distribution of Cer - tain Sexually Explicit Material, effective 1 Septem - ber 2025; • SB 1361: Use of Automated Decision System for Adverse Determinations, effective 1 September 2025; • HB 581: Visual Material Appearing to Depict a Child; and • Texas Responsible Artificial Intelligence Govern - ance Act, effective 1 January 2026. These laws are in limbo, however. On 11 December 2025, President Trump issued an executive order, which threatened to pull federal broadband funding from states that enacted “onerous” AI laws. Texas was awarded USD3.3 billion in federal funding to expand broadband access in the state. This has put lawmak - ers on both sides of the aisle in conflict with the fed - eral government. Data-Light AI Lets You Compete With Less Personal Information The legal community and general counsels especially have spent the last decade hearing a single refrain from the business side. More data means better deci - sions. More data means better personalisation. More data means more growth. Privacy and cybersecu - rity teams have been the necessary brakes, asking whether the organisation really needs to keep what it collects and whether it can defend those practices when something goes wrong. The inherent balance of when data goes from an asset to a liability has been a battlefield within many organisations, often without a clear answer. That tension is not going away; it is changing form. AI is accelerating the shift from data as fuel to mod - els as leverage. That shift does not end privacy and cybersecurity risk; it changes what you must govern, what you must document, and what you must be able to explain to regulators, legislators, and fact finders. In a world of AI agents and advanced automation, the most sophisticated organisations will be those that can move quickly with minimal retained personal data, while still proving that their systems are controlled, auditable, and reasonable.
This future does not promise that AI eliminates the need for data, because it does not. It argues that AI changes where data lives, how long it should live there, and what it should be allowed to do. It then offers a flexible approach to privacy and cybersecurity that is designed for unpredictability. Threats evolve faster than policies. Regulations evolve faster than roadmaps. Your governance must be built for change at low cost, without requiring a small army of out - side developers to rewrite core controls every time the world shifts. Texas Biometric Laws Weigh on a Data-Light AI-Driven Approach AI-driven identity and personalisation strategies often drift toward biometric identifiers because they are convenient for authentication, fraud controls, and user experience. In Texas, the Capture or Use of Biometric Identifier Act (CUBI) creates a direct statutory compli - ance hook: a person may not capture an individual’s biometric identifier for a commercial purpose without first informing the individual and obtaining consent, and the statute restricts disclosure, requires reason - able care in storage and transmission, and imposes a destruction requirement tied to the purpose for which the biometric identifier was collected. The Texas Attorney General highlights these requirements and emphasises that enforcement sits with the AG and may include civil penalties per violation. For governance design, this matters because “data light” architectures can unintentionally become “bio - metric heavy” architectures. A defensible programme therefore treats biometric ingestion as a controlled exception with heightened notice, consent, retention limits, and audit logging, rather than as an incidental by-product of modern AI tooling. The New Premise: You Cannot Forecast the Next Threat, Statute, or Theory of Liability Most compliance programmes assume the future will look like the past. That assumption is now the liabil - ity. Cybersecurity threats mutate weekly. AI systems change behaviour as prompts, plugins, tools, and downstream integrations evolve. Meanwhile, lawmak - ers are moving toward risk-based AI rules that require impact assessments, disclosures, and documented
616 CHAMBERS.COM
Powered by FlippingBook