Texas mandates annual cybersecurity and AI training for state and local staff

Texas state agencies, local government entities, and their contractors must complete annual cybersecurity and artificial intelligence awareness training under new legislative mandates. According to analysis published by Huntress, HB 3834 and HB 3512 impose these requirements on a broad range of public-sector personnel across the Lone Star State.

The cybersecurity mandate, established by HB 3834, has been in force since the Texas Legislature passed it in June 2019. This bill requires covered employees to finish a security awareness program approved by the Department of Information Resources every year. Organizations must certify that their staff have completed the training by August 31 each year, creating a recurring compliance deadline for public-sector employers.

Legislative Context and Scope

A second requirement was added by HB 3512, which takes effect on September 1, 2025. This legislation mandates that the same in-scope employees complete an annual artificial intelligence awareness training course certified by DIR. Consequently, affected personnel must now undergo two separate training modules annually: one for general cybersecurity and another specifically focused on AI risks and awareness.

Huntress notes that these regulations emerged as government systems became prime targets for cyberattacks. In August 2019, ransomware attacks compromised the computer systems of 23 Texas municipalities, locking files and disrupting utility payment processing in some cases. One mayor reported that attackers demanded $2.5 million in ransom during that incident.

Who Must Comply

The scope of HB 3834 covers specific groups within the Texas public sector. State agency employees who use computers for at least 25 percent of their duties, along with elected or appointed officers, must participate. Local government employees and officials with access to government computer systems or databases who also use computers for at least 25 percent of their work are included.

Contractors working for state agencies face strict requirements. Any contractor with access to a state computer system or database must complete the training during the contract term and any renewal periods. Huntress states there are no exceptions for state agency contractors. School districts have a narrower requirement: only the district’s cybersecurity coordinator must complete the annual training, while other employees follow rules determined by the district coordinator.

What should you do?

Organizations should immediately determine if they fall within the scope of HB 3834 and HB 3512. If you employ state or local government staff, or contract with state agencies, you must ensure your training program is DIR-approved. You need to track completion records carefully to meet the August 31 certification deadline. With the AI training requirement starting in 2025, planners should begin integrating AI-specific modules into their existing awareness curricula.

What to do and how to stay safe: Texas

• Verify whether your organization is a state agency, local government entity, or state contractor to determine if HB 3834 applies to your staff.
• Ensure your current security awareness training program is approved by the Texas Department of Information Resources to meet compliance standards.
• Track employee completion records meticulously to ensure you can certify compliance to DIR by the August 31 annual deadline.
• Prepare for the September 1, 2025 implementation of HB 3512 by planning to add DIR-certified artificial intelligence awareness training to your annual curriculum.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When does the AI training requirement take effect?

The artificial intelligence awareness training requirement under HB 3512 begins on September 1, 2025.

Who is required to complete the training under HB 3834?

State agency employees, local government employees with system access, and state agency contractors with database access must complete the training.

What is the annual deadline for certifying training completion?

Organizations must certify completion of the training to the Department of Information Resources by August 31 each year.