The Arlington City Council approved a new artificial intelligence policy under its consent agenda on June 23, aligning city operations with the Texas Responsible Artificial Intelligence Governance Act passed in 2025. The move reflects how local governments are moving from voluntary AI principles to enforceable compliance frameworks as state-level rules take shape.
What the Texas law requires
The 2025 legislation, authored by state Rep. Giovanni Capriglione, R-Southlake, sets binding boundaries for governmental bodies. It prohibits using AI to collect biometric data without consent or to create a "social score" based on an individual's behavior. State Sen. Charles Schwertner, R-Georgetown, said the law could benefit the public while ensuring safety. "While AI has immense potential for good, it also poses significant harm if left unchecked," Schwertner said in a 2025 Facebook post.
How Arlington is already using AI
Arlington has been using AI in daily operations for some time, including NoTraffic cameras in the Public Works Department, a public-facing chatbot, and Microsoft Copilot for city employees. A generative AI security policy adopted in 2024 already required human review of AI-generated text or data before it goes into official use, and spelled out who bears responsibility for errors. "We've already had a human in the loop, but it helps a lot with our internal processes that the public may not see," said Chief Information Security Officer Bryce Carter.
New policy mandates evaluation and training
The city's policy creates a system for cataloging all AI systems in use and assessing their risk for unlawful harm or security breaches. Third-party vendors working with the city must also ensure their AI tools comply with state law. Some city employees will be required to complete Texas-certified AI training. Arlington had already created internal AI training and formed a committee last year to evaluate new software and AI systems before they are introduced.
Carter said the law forces the city to look backward as well as forward. "We were still like most other governments, trying to figure out how do we regulate this, or regulate ourselves because it's just changing so quickly," he said. "This new law will require us to go backwards and evaluate everything that we had before."
Vendor oversight remains a challenge. "It's even harder to do when it comes to technology and cybersecurity, because they can tell you they're doing something, but there is about a thousand components to that, and it's impossible for us to evaluate all of them," Carter said. "We've done our best to make sure our vendors are complying with minimum standards, but it's always going to be, and will continue to be, a work in progress."
Carter stressed that the policy must remain flexible. "There's just so many of these AI models out there, and it's changing so quickly," he said. "I can't say what we're adopting is going to work for a year from now, so we'll have to make sure it's agile, and we're keeping it up to date."
Why this matters for government agencies
The Arlington case shows how state AI laws are shifting enforcement from voluntary guidelines to mandatory audits and retroactive reviews. Agencies that already use AI, even with human oversight, will need to inventory every system and prove compliance. The requirement for Texas-certified training means workforce development must be built into the compliance timeline. For IT and legal teams, the message is direct: existing AI implementations, no matter how routine, are now subject to legal scrutiny, and vendor contracts will need specific language around AI governance.
Your membership also unlocks:
