Texas requires local government employees and officials to complete cybersecurity training every year, and the Attorney General has said appraisal districts are covered. Since September 1, 2025, the requirement also includes annual artificial intelligence training. Both must come from programs certified by the Texas Department of Information Resources (DIR).
This post walks through who is covered, what the district has to do, what changed with AI training, and the places districts most often fall short.
Does the law cover appraisal districts?
Yes. The training requirement is in Texas Government Code Section 2054.5191, and it applies to a "local government," which the Information Resources Management Act defines as "a county, municipality, special district, school district, junior college district, or other political subdivision of the state."
In a 2020 opinion (KP-0326), the Attorney General concluded that the statute "applies to an appraisal district, which is 'a political subdivision of the state.'" The same opinion found that appointed board members fell outside the requirement, because the statute at that time named only elected officials. That opinion predates the 2025 changes, so ask your attorney whether the update affects your board.
What does the district have to do?
Under the statute, the local governing body must do these things:
- Identify the employees and officials who must complete training.
- Choose a certified training program.
- Require completion every year.
- Verify that people finished, and report completion to DIR.
- Run periodic compliance audits.
The governing body may also deny system access to anyone who does not comply. Exemptions exist for people on certain kinds of leave, such as military leave, FMLA leave or workers' compensation leave.
The Texas Association of Counties describes the covered group as everyone with access to a local government computer system or database, and says compliance is reported to DIR by August 31 each year. Earlier versions of the statute limited training to staff who use a computer for at least a quarter of their duties, so confirm the current scope with your counsel or DIR rather than relying on an older policy.
What changed with AI training?
House Bill 3512 took effect September 1, 2025. It requires state and local government employees and officials to complete, at least once a year, a certified cybersecurity training program and a certified AI training program. DIR must certify at least five AI programs each year. According to GovTech, the AI training requirement applies starting in fiscal year 2026, and only certified programs count. The Texas Association of Counties listed August 31, 2026 as the completion deadline for both courses for that cycle, so if your district missed it, get everyone through the courses now and document the dates.
The AI course is meant to help staff understand how AI may be used in relation to their duties and teach best practices on AI literacy.
Common ways districts fall short
Training is finished, but nobody can prove it. The statute requires verification and reporting. Keep a list of who is covered, who finished and when, and export completion records before you need them.
New hires and seasonal staff slip through. Appraisal districts add temporary help around notice and protest season. Add the training assignment to onboarding so it happens in the first weeks.
The training happens, but the controls do not. A course about phishing does not stop a phishing email from landing. At least two of the recent Texas appraisal district attacks appear to have started with email, so training works best next to email filtering, multifactor authentication and tested backups.
Nobody owns it. Name one person who tracks completion and reports to DIR. If the answer today is "IT, I think," write it down.
A short checklist
- Confirm who counts as covered under current law.
- Assign both the cybersecurity course and the AI course from DIR's certified list.
- Track completion by name and date.
- Report to DIR by the deadline.
- Add the assignment to new-hire onboarding.
- Pair the training with technical controls.
This post is general information and not legal advice. Your attorney or DIR can confirm how the statute applies to your district.
The bigger lesson
Training is one control, not the whole program. A staff member who spots a phishing email still depends on filtering, multifactor authentication and tested backups behind them. A managed IT provider handles that technical layer so your training records and your defenses tell the same story.
safemode IT is a managed IT and cybersecurity provider based in Kyle, Texas, and we work with local government offices across Central Texas. If you want help with the technical controls that back up your training program, call 512-761-7652 or visit safemodeit.com.
Sources
- Texas Government Code, Section 2054.5191
- Texas Attorney General, Opinion KP-0326 (2020)
- Texas Legislature, HB 3512 (89th Legislature) bill analysis
- GovTech, Texas formalizes certification standards for AI training programs
- Texas Association of Counties, Annual Cybersecurity Compliance Training
Not sure your IT is as solid as it should be? Take 10 minutes and tell us about your setup. No pressure, no obligation.
Book a 10-Minute Discovery Call →Frequently asked questions
Does Texas cybersecurity training law apply to appraisal districts?
Yes. Government Code Section 2054.5191 applies to a local government, and in Opinion KP-0326 the Attorney General concluded it applies to an appraisal district. Confirm the current scope with your attorney or DIR.
What is new about AI training for Texas local government employees?
House Bill 3512 took effect September 1, 2025. It requires a DIR-certified AI training program each year in addition to cybersecurity training. Only certified programs count.
When is the training deadline?
The Texas Association of Counties lists August 31 as the reporting deadline each year. Check DIR for the current cycle, and if a deadline has passed, complete the training as soon as you can and keep the completion records.
Who at the district should own compliance?
Name one person who tracks who is covered, who finished and when, and who reports completion to DIR. Do not leave it as an assumed IT task.
Can safemode IT manage this so we do not have to deal with it?
We can handle the technical controls that back up your training program, including email filtering, multifactor authentication and backups. Learn more about our managed IT services or reach out for a free assessment.
Last updated: October 7, 2026
