ESBD_538559_1784141627512_SOL_EXH_F.9_DATA_AI.pdf

v.1 Approved 10/17/2025

DATA AND AI STANDARDS EXHIBIT

This Data and AI Standards Exhibit (the “Exhibit”) is made and entered into as of [Insert Date], by and between the Texas Department of Public Safety (“DPS” or “Agency”) and [Contractor Name] (the

“Contractor”) as an Exhibit to the [Contract Name] (the “Agreement”).

1. Data Ownership and Unrestricted Access

1.1 Data Ownership: All data provided to the Contractor by DPS, or collected, processed, or generated under this Agreement, shall remain the sole property of DPS. The Contractor shall not claim ownership, control, or rights over any DPS data, nor may the Contractor use DPS data for any reason, including but not limited to training AI models, without express, written authorization by the DPS Chief Information Officer or their designee.

1.2 Unrestricted Data Access: DPS shall have real-time, unrestricted access to all its data, including data stored in Contractor-managed systems, cloud environments, or subcontracted services. The Contractor shall not limit or delay access for any reason.

1.3 Data Portability: Contractor shall ensure that all DPS data is stored in a non-proprietary, easily transferable format and made accessible through open APIs or standard data extraction methods, such as batch, incremental, or real-time extraction.

2. Data Documentation and Metadata Standards

2.1 Comprehensive Data Documentation: The Contractor must provide and maintain up-to-date documentation on all data managed under this Agreement. Documentation must be submitted at project initiation and updated quarterly if any changes have occurred.

2.2 Data Dictionary Requirements: The Contractor shall deliver a comprehensive Data Dictionary that includes:

2.2.1 Data Field Names: All field names and aliases used.

2.2.2 Field Descriptions: Definitions of each data element.

2.2.3 Data Types and Formats: Specification of numeric, text, date, or categorical formats.

2.2.4 Allowed Values and Constraints: Range of acceptable values and validation rules.

2.2.5 Data Lineage: Source and transformation process of each data field.

2.3 Entity Relationship Diagram:

The Contractor shall provide an Entity Relationship Diagram (ERD) that visually represents:

2.3.1 Data entities (e.g., records for people, vehicles, incidents, etc.).

2.3.2 Relationships between entities.

2.3.3 Data dependencies and linkages to DPS systems.

2.3.4 The ERD must be updated upon any schema changes and provided in a standard diagram format (e.g., UML, Crow’s Foot, or Chen Notation).

2.4 Metadata Standards and Version Control:

2.4.1 The Contractor must establish metadata tagging and version control for all datasets.

Any changes to the data schema, structure, or relationships must be logged, documented, and supplied to DPS prior to implementing changes in production environments.

3. System Integration and Interoperability

3.1 System Integration: The Contractor must ensure its systems integrate with DPS’s existing infrastructure, including:

3.1.1 Texas DPS Case Management Systems

3.1.2 Criminal Justice Information Services (CJIS) systems

3.1.3 Investigative and Business Intelligence Platforms

3.1.4 Real-time Analytics and Monitoring Systems

3.1.5 Texas DPS IT Service Management Platforms

3.1.6 Texas DPS Data Management Platforms

3.2 Data Interoperability: All solutions must use open standards and non-proprietary formats to enable integration with current and future DPS platforms.

3.3 APIs and Data Flow: Contractor must provide well-documented APIs that facilitate secure, real-time data exchange between DPS and third-party platforms.

4. Third-Party Data Sharing and Subcontracting

4.1 Subcontractor Compliance: The Contractor must disclose and obtain DPS approval on all subcontractors handling DPS data. Subcontractor must comply with the same data security, AI ethics, and governance policies as the primary Contractor.

4.2 Third-Party Data Transfer Restrictions: The Contractor shall not share or sell DPS data to any third party, including affiliates, without explicit written consent.

5. Artificial Intelligence

5.1 Governance and Oversight:

5.1.1 The Contractor must submit AI models, algorithms, and decision-making methodologies for review prior to deployment initially and upon any changes to AI models, algorithms, and decision-making methodologies.

5.1.2 The Contractor must complete the Automated Decision-making Inventory questionnaire. See Attachment A for the questionnaire.

5.2 Human Oversight and Accountability:

5.2.1 AI-driven decisions must not operate autonomously in high-risk areas, such as criminal investigations or public safety operations, without human oversight. For all AI-driven decisions, Contractor must ensure its system develops a numerical confidence score expressed as a percentage between 0 and 1 indicating the AI Service's certainty in its output. After contract signing, Contractor must calculate, based on its AI system model and the types of information used and decision outputs made, an acceptable numerical confidence threshold percentage for human oversight and review of AI-driven decisions. Contractor must submit this proposal and its underlying rationale to

DPS for review and approval. Once DPS and Contractor have agreed on this numerical confidence threshold, Contractor will ensure that in instances where an AI-driven decision’s numerical confidence score falls below this threshold, Contractor will ensure human review and oversight of the AI-driven decision. Contractor must flag any output with a confidence score below this threshold and provide a record to DPS for review on a regular basis, which DPS will communicate to Contractor at the same time DPS approves Contractor’s numerical confidence score.

5.2.2 DPS personnel shall have final authority over AI-assisted decisions, ensuring human judgment supersedes AI recommendation where necessary.

5.3 Ethical and Legal Compliance:

5.3.1 AI technologies must comply with all federal and state laws.

5.4 Transparency and Audit:

5.4.1 The Contractor must provide full visibility into AI decision-making processes and ensure AI systems are explainable, interpretable, and auditable.

5.4.2 All AI decisions impacting public safety must be logged for auditability, and the logs must be retained in compliance with the Texas DPS records retention schedule.

5.4.3 The Contractor must provide detailed documentation on AI models, including training data sources, feature selection, algorithmic assumptions, and accuracy rates.

5.4.4 The Contractor must provide human-readable explanations for AI-generated decisions that impact Agency operations.

5.5 Fairness and Non-Discrimination: The Contractor shall ensure AI models:

5.5.1 Do not produce biased outcomes that disproportionately impact any group.

5.5.2 Are trained on representative datasets to avoid bias.

5.5.3 Are adjusted or retrained to maintain reliable performance.

5.5.4 Are monitored for accuracy degradation.

5.6 Privacy and Security:

5.6.1 The Contractor shall ensure compliance with Texas DPS Cybersecurity policies.

6. Auditing, Compliance, and Liability

6.1 DPS Audit Rights: DPS may audit any data, AI models, systems, or processes used under this

Agreement at any time.

6.2 Liability for AI Failures:

6.2.1 The Contractor shall be held liable for any AI-driven errors that lead to wrongful actions, public harm, or law enforcement misjudgments.

6.2.2 Any DPS damages resulting from AI malfunctions shall be fully reimbursed by the

Contractor.

7. Data Retention, Destruction and Exit Strategy

7.1 Data Return or Destruction: Upon contract termination, the Contractor must return or destroy all DPS data and certify compliance in accordance with NIST Special Publication 800-

88, Revision 1 (or any subsequent superseding guidance).

7.2 Exit Strategy and Transition Planning: The Contractor must ensure no service disruption if

DPS transitions to another Contractor. Data must be fully migrated to DPS or an alternative platform without additional costs.

8. Amendments and Termination

8.1 Amendments: Any modifications to this Exhibit must be agreed to in writing by both parties.

8.2 Termination for Non-Compliance: DPS reserves the right to terminate the contract immediately if the Contractor:

8.2.1 Fails to comply with data security, AI governance, or regulatory requirements.

8.2.2 Engages in unauthorized data use or AI misrepresentation.

Attachment A

Automated Decision-making System Questionnaire

The Contractor must provide and maintain up-to-date documentation on any AI used under this

Agreement. Documentation must be submitted with the response, at project initiation, for sign-off prior to implementation, and updated quarterly or upon change if any changes have occurred.

1. Name of Automated Decision System (ADS)

2. Contractor, if applicable

3. What types of data input does the technology use?

4. How is the data used for inputs generated, collected, and processed?

5. What type of data is the ADS likely to generate?

6. Has the ADS been tested for bias?

7. Does the ADS have a known bias?

8. How was the ADS tested for bias and what were the results of the testing?

9. How is ADS data securely stored and processed?

10. What type of Algorithm does the system use, if known?