ESBD_556289_1788551637516_TXCC Data and AI Standards Exhibit.pdf

OGC approved June 2026 Version 1.0 1 of 6

TXCC DATA AND AI STANDARDS EXHIBIT

This TXCC Data and AI Standards Exhibit is incorporated by reference into the Contract between the Texas Cyber Command (TXCC) and the Vendor.

1. Data Ownership and Unrestricted Access

1.1 Data Ownership.

All data provided to the Vendor by TXCC (regardless of source or origin), or collected, processed, or generated under this Contract, remains the sole property of TXCC (and the original owner if that owner provides data to the Vendor under this Contract). For any data purposes under this Exhibit, the term TXCC data includes all data from any entity or original owner that is shared with TXCC. Vendor may not claim ownership, control, or rights over any TXCC (and original owner’s) data, nor may the Vendor use TXCC data for any reason, including for training AI models, without express, written authorization by the TXCC AI Risk Officer.

1.2 Unrestricted Data Access.

TXCC must have real-time, unrestricted access to all its data, including data stored in Vendor-managed systems, cloud environments, or subcontracted services. The Vendor may not limit or delay access for any reason.

1.3 Data Portability.

The Vendor must ensure that all TXCC data is stored in a non-proprietary, easily transferable format and made accessible through open APIs or standard data extraction methods, such as batch, incremental, or real-time extraction.

2. Data Documentation and Metadata Standards

2.1 Comprehensive Data Documentation.

The Vendor must provide and maintain up-to-date documentation on all data managed under this Contract. Documentation must be submitted at project initiation and updated quarterly if any changes have occurred.

2.2 Data Dictionary Requirements.

The Vendor must deliver a comprehensive Data Dictionary that includes:

2.2.1 Data Field Names: All field names and aliases used.

2.2.2 Field Descriptions: Definitions of each data element.

OGC approved June 2026 Version 1.0 2 of 6

2.2.3 Data Types and Formats: Specification of numeric, text, date, or categorical formats.

2.2.4 Allowed Values and Constraints: Range of acceptable values and validation rules.

2.2.5 Data Lineage: Source and transformation process of each data field.

2.3 Entity Relationship Diagram.

Vendor must provide an Entity Relationship Diagram (ERD) that visually represents:

2.3.1 Data entities (such as records for people, incidents, etc.).

2.3.2 Relationships between entities.

2.3.3 Data dependencies and linkages to TXCC systems.

2.3.4 The ERD must be updated upon any schema changes and provided in a standard diagram format (for example, UML, Crow’s Foot, or Chen Notation).

2.4 Metadata Standards and Version Control.

2.4.1 The Vendor must establish metadata tagging and version control for all datasets.

Any changes to the data schema, structure, or relationships must be logged, documented, and supplied to TXCC prior to implementing changes in production environments.

3. System Integration and Interoperability

3.1 System Integration.

The Vendor must ensure its systems integrate with TXCC’s existing infrastructure.

3.2 Data Interoperability.

All solutions must use open standards and non-proprietary formats to enable integration with current and future TXCC platforms.

3.3 APIs and Data Flow.

The Vendor must provide well-documented APIs that facilitate secure, real-time data exchange between TXCC and third-party platforms.

4. Third-Party Data Sharing and Subcontracting

4.1 Subcontractor Compliance.

OGC approved June 2026 Version 1.0 3 of 6

The Vendor must disclose and obtain TXCC approval on all subcontractors handling TXCC data.

Subcontractor must comply with the same data security, AI ethics, and governance policies as the Vendor.

4.2 Third-Party Data Transfer Restrictions.

The Vendor may not share or sell TXCC data to any third party, including affiliates, without explicit written consent from the TXCC AI Risk Officer.

5. Artificial Intelligence

5.1 Governance and Oversight.

5.1.1 The Vendor must submit AI models, algorithms, and decision-making methodologies for review prior to deployment initially and upon any changes to AI models, algorithms, and decision-making methodologies.

5.1.2 The Vendor must complete the Automated Decision-making Inventory Questionnaire. See Section 8.3 of this Exhibit.

5.2 Human Oversight and Accountability.

5.2.1 AI-driven decisions must not operate autonomously in high-risk areas without human oversight. For all AI-driven decisions, the Vendor must ensure its system develops a numerical confidence score expressed as a percentage between 0 and 1 indicating the AI Service's certainty in its output. After contract signing, the Vendor must calculate, based on its AI system model and the types of information used and decision outputs made, an acceptable numerical confidence threshold percentage for human oversight and review of AI-driven decisions. The Vendor must submit this proposal and its underlying rationale to the TXCC AI Risk Officer for review and approval. Once TXCC and the Vendor have agreed on this numerical confidence threshold, the Vendor must ensure that in instances where an AI-driven decision’s numerical confidence score falls below this threshold, the Vendor will ensure human review and oversight of the AI-driven decision. Vendor must flag any output with a confidence score below this threshold and provide a record to TXCC for review on a regular basis, which TXCC will communicate to Vendor at the same time that TXCC approves Vendor’s numerical confidence score.

5.2.2 TXCC personnel have final authority over AI-assisted decisions, ensuring human judgment supersedes AI recommendation where necessary.

5.3 Ethical and Legal Compliance.

OGC approved June 2026 Version 1.0 4 of 6

5.3.1 AI technologies and data collection, processing, or disclosures must comply with all federal and state laws, including the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), the Texas Department of Information Resource’s AI Code of Ethics and related rules, and the Texas Data Privacy and Security Act. [See H.B. 149 (89 R.S.), 1 Texas Administrative Code Ch. 219, and H.B. 4 (88 R.S.).]

5.4 Transparency and Audit.

5.4.1 The Vendor must provide full visibility into AI decision-making processes and ensure AI systems are explainable, interpretable, and auditable.

5.4.2 All AI decisions must be logged for auditability, and the logs must be retained in compliance with the TXCC records retention requirements.

5.4.3 The Vendor must provide detailed documentation on AI models, including training data sources, feature selection, algorithmic assumptions, and accuracy rates.

5.4.4 The Vendor must provide human-readable explanations for AI-generated decisions that impact TXCC operations.

5.5 Fairness and Non-Discrimination.

The Vendor must ensure AI models:

5.5.1 Do not produce biased outcomes that disproportionately impact any group.

5.5.2 Are trained on representative datasets to avoid bias.

5.5.3 Are adjusted or retrained to maintain reliable performance.

5.5.4 Are monitored for accuracy degradation.

5.6 Privacy and Security.

5.6.1 The Vendor must ensure compliance with TXCC Cybersecurity requirements and policies.

6. Auditing, Compliance, and Liability

6.1 TXCC Audit Rights.

TXCC may audit any data, AI models, systems, or processes used under this Contract at any time.

6.2 Liability for AI Failures.

OGC approved June 2026 Version 1.0 5 of 6

6.2.1 The Vendor will be held liable for any AI-driven errors that lead to wrongful actions, public harm, or law enforcement misjudgments.

6.2.2 The Vendor will fully reimburse TXCC for any damages to TXCC resulting from AI malfunctions.

7. Data Retention, Destruction, and Exit Strategy

7.1 Data Return or Destruction.

Upon contract termination, the Vendor must return or destroy all TXCC data and certify compliance in accordance with NIST Special Publication 800-88, Revision 1 (or any subsequent superseding guidance).

7.2 Exit Strategy and Transition Planning.

The Vendor must ensure no service disruption if TXCC transitions to another Vendor. Data must be fully migrated to TXCC or an alternative platform without additional costs.

8. Amendments and Termination.

8.1 Amendments. Any changes to this Exhibit must be agreed to in writing by both parties.

8.2 Termination for Non-Compliance: TXCC reserves the right to terminate the contract immediately if the Vendor:

8.2.1 Fails to comply with data security, AI governance, or regulatory requirements.

8.2.2 Engages in unauthorized data use or AI misrepresentation.

8.3 Automated Decision-making System Questionnaire

The Vendor must provide and maintain up-to-date documentation on any AI used under this Agreement. Documentation must be submitted with the response, at project initiation, for sign-off prior to implementation, and updated quarterly or upon change if any changes have occurred.

1. Name of Automated Decision System (ADS)

2. Vendor, if applicable

3. What types of data input does the technology use?

4. How is the data used for inputs generated, collected, and processed?

5. What type of data is the ADS likely to generate?

6. Has the ADS been tested for bias?

OGC approved June 2026 Version 1.0 6 of 6

7. Does the ADS have a known bias?

8. How was the ADS tested for bias and what were the results of the testing?

9. How is ADS data securely stored and processed?

10. What type of Algorithm does the system use, if known?