Texas officials must finish annual security and AI training by August 31

Texas state agencies, local governments, and their contractors must now complete annual cybersecurity and artificial intelligence awareness training to comply with new legislative mandates. These requirements apply to a broad range of personnel, including elected officials and those with system access, creating a significant administrative burden for organizations that have not yet established formal security education programs.

In plain English

The legislation targets the human element of security. According to Verizon’s 2026 Data Breach Investigations Report, humans are involved in 62 percent of breaches. The state aims to reduce this risk by ensuring that employees who interact with computers regularly understand basic security hygiene. This includes recognizing threats and understanding the implications of using artificial intelligence tools within government workflows.

The background

Texas passed HB 3834 in June 2019, requiring annual cybersecurity awareness training for state and local employees. This law came after a series of high-profile attacks, including an August 2019 ransomware incident that hit 23 Texas municipalities. In one case, hackers locked computer files and prevented utility payments. A mayor reported a ransom demand of $2.5 million. The source notes that hackers are officially messing with Texas.

What changes now

As of September 1, 2025, HB 3512 adds a second requirement. In-scope employees must now complete both cybersecurity and AI awareness training annually. The Department of Information Resources (DIR) approves the training programs. Organizations must certify completion to DIR by August 31 each year. There are no exceptions for state agency contractors who access state systems or databases.

Key terms explained

Security awareness training teaches employees how to identify and respond to digital threats, such as phishing emails or weak passwords. It focuses on behavior rather than technical tools. Artificial intelligence awareness training covers the risks associated with using AI tools, such as data privacy concerns or misinformation. Teams usually start by auditing current knowledge gaps. They then select approved courses that address these specific areas. This helps ensure staff understand their role in protecting organizational data.

What to do and how to stay safe: Texas

• Determine if your organization falls under state agency, local government, or contractor categories in Texas.
• Identify employees who use computers for at least 25 percent of their duties or have system access.
• Select a DIR-approved training program that covers both cybersecurity and AI awareness.
• Certify completion to the Department of Information Resources before the August 31 deadline.

Step-by-step guide: Stop AI Chatbots Leaking Sensitive Business Data

General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who specifically needs to complete the training under HB 3834?

State agency employees using computers for 25 percent or more of their duties, local government employees with system access, and state agency contractors with database access.

Are school district employees required to take the training?

Only the district’s cybersecurity coordinator is mandated to complete the annual training; other employees follow the coordinator’s determination.

When must organizations certify their training completion?

Organizations must certify completion to the Department of Information Resources by August 31 of each year.