Texas adds mandatory AI training to cyber requirements for state, local staff and contractors starting in 2025

Texas legislation now mandates that state agencies, local government entities and their contractors complete annual cybersecurity and artificial intelligence awareness training. According to first-hand research published by Huntress, HB 3834 and the newer HB 3512 impose these compliance obligations on personnel across the Lone Star State. The rules affect employees who use computers for at least 25 per cent of their duties, as well as elected or appointed officials. Contractors with access to state systems must also comply during the term of their agreements and any renewals.

Root cause

The regulatory push follows increased targeting of government infrastructure. In August 2019, ransomware attacks compromised computer systems in 23 Texas municipalities, locking files and disrupting utility payment processing. One mayor reported a ransom demand of $2.5 million. According to Verizon’s 2026 Data Breach Investigations Report, the human element is involved in 62 per cent of breaches. This statistic underscores the legislative intent to strengthen security awareness as a primary defence mechanism against such incidents.

Attack path

The legislation does not describe a specific technical attack vector but addresses the broader risk of human error. By mandating training, the state aims to reduce susceptibility to social engineering and other threats that exploit employee behaviour. The requirement applies to anyone with access to local government computer systems or databases. For school districts, only the cybersecurity coordinator is strictly required to complete the annual training, while other staff participation is determined at the district level in coordination with the coordinator.

Affected versions

The requirements apply to specific categories of personnel within Texas state and local government structures. State agency employees using computers for 25 per cent or more of their duties are in scope. Local government employees and officials with system access meeting the same usage threshold must also train. Contractors are included if they have access to state computer systems or databases. There are no exceptions for state agency contractors. The AI training component becomes mandatory for these same groups from September 1, 2025.

Mitigation

• Identify all employees and contractors who meet the 25 per cent computer usage threshold or hold elected/appointed office.
• Select a Department of Information Resources (DIR) approved cybersecurity awareness training program.
• Implement a DIR-certified artificial intelligence awareness training program for compliance with HB 3512 from September 2025.
• Track completion records and submit certification to DIR by August 31 each year.

What it means for organisations

Organisations should assess their current training programmes against DIR approval standards immediately. Procurement teams need to verify that any third-party training providers hold the necessary certifications for both cybersecurity and AI modules. Internal communications must clearly define who is in scope, particularly for contractors and school district staff where rules vary. Leadership should allocate budget for these mandatory annual courses and establish internal deadlines well before the August 31 certification date. Human resources should integrate compliance tracking into existing performance or onboarding workflows to ensure no staff member is missed.

Background: Social engineering

Isolate the affected device immediately to stop data exfiltration. Change all credentials from a clean device, not the compromised one. Notify your security team and preserve logs. Review access patterns for anomalies. Implement multi-factor authentication to prevent recurrence. Document every action for forensic analysis.

Read the full guide: Social Engineering Response: Containment and Recovery Steps

What to do and how to stay safe: Texas

• Audit current staff lists to identify all individuals meeting the 25 per cent computer usage criteria.
• Confirm that your chosen training provider is approved by the Texas Department of Information Resources.
• Plan for the additional AI awareness module required by HB 3512 starting in September 2025.
• Establish a process to track and certify completion before the annual August 31 deadline.

Step-by-step guide: Prevent Prompt Injection Attacks: Practical Defences for AI Systems

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who must complete the training under HB 3834?

State agency employees, local government employees and officials with computer access, and state agency contractors with system access must complete the training.

When does the AI training requirement start?

The mandatory annual AI awareness training under HB 3512 begins on September 1, 2025.

What is the deadline for certification?

Organisations must certify completion of the training to the Department of Information Resources by August 31 each year.