{"resourceId":"texas-prohibited-technologies-list-moonshot-ai-20260126","versions":[{"version":"external-68342420a81c71ffacec2dc3f16dca75a5abb78c99a08b31a6ab3dc78c9986fb","resource":{"id":"texas-prohibited-technologies-list-moonshot-ai-20260126","title":"Texas adds Moonshot AI and other PRC-affiliated AI vendors to its prohibited technologies list for state employees and devices","organization":"Office of the Texas Governor / Texas Cyber Command","sector":"State government / cybersecurity policy","geography":"Texas, United States","publishedAt":"2026-01-26","publicationDate":"2026-01-26","eventDate":"2026-01-26","sourceName":"Office of the Texas Governor","sourceLabel":"Governor Abbott Updates Texas' Prohibited Technologies List","sourceUrl":"https://gov.texas.gov/news/post/governor-abbott-updates-texas-prohibited-technologies-list","evidenceClass":"standards-guidance","outcomeClass":"cautionary","topics":["governance-procurement","data-security"],"finding":"On January 26, 2026 the Texas Governor updated the state's prohibited technologies list for state employees and devices after a threat assessment by Texas Cyber Command (TXCC). The 26 added names include AI developers Moonshot AI, Zhipu (Z.ai), MiniMax, StepFun, Baichuan, Baidu, Alibaba and BAAI. The release names TXCC as lead agency for identifying further threatening technology. Why now: AWS's November 10 post promotes Moonshot AI's Kimi K3.1 Pro on Amazon Bedrock, so Texas agencies and universities using Bedrock face a live question about how this list applies to a cloud-hosted model.","sledRelevance":"Directly affects Texas state agencies and, through state policy, public universities that use AWS Bedrock. Other states with similar PRC-vendor restrictions face the same question. Cross-tagged to state-government because it is a state cybersecurity policy action.","evidence":"Official state press release listing added technologies. It does not say whether the prohibition applies to models hosted by third-party cloud providers.","architectureImplications":"No architecture content; implementation falls to agency device and network controls and, by extension, cloud model allow-lists.","governanceImplications":"Creates a state-level vendor prohibition that cloud governance must map to model catalogs. Ambiguity about hosted open-weight models should be resolved with state counsel or DIR guidance.","securityPrivacyImplications":"Framed as protection against data harvesting by PRC-affiliated technology. Hosted open-weight models change the data-flow risk but not necessarily the policy scope.","caveats":"Published January 2026, filed now because of the November 2026 Bedrock availability of a Moonshot model. The release does not address cloud-hosted models; any application to Bedrock is interpretation.","streamIds":["aws","state-government"],"roles":{"sales":"Interpretation: this is a compliance item for every Texas public-sector AWS conversation. The customer problem is uncertainty over whether a Bedrock-hosted model from a listed vendor is prohibited. Stakeholders are the agency ISO, DIR liaison, general counsel and procurement. Discovery should ask whether the agency has guidance on cloud-hosted models from listed vendors. Do not advise on legal scope; offer help documenting and enforcing whatever position counsel takes.","engineering":"Interpretation: engineers should translate the list into technical controls. For Bedrock that means a deny policy on model IDs from listed vendors, applied at the organization level, plus Marketplace subscription controls. Prerequisites are a maintained mapping from vendor names to model IDs. The constraint is that the list names companies, not model identifiers, so mapping requires judgment. Proof of value is an audit showing no listed-vendor models were invoked.","delivery":"Interpretation: delivery work is continuous compliance mapping. Dependencies are counsel's interpretation, the cloud governance team and a source of list updates. Ownership sits with the agency ISO. Governance checkpoints include reviewing list changes and new cloud catalog entries together. Proposed acceptance criteria are a current vendor-to-model mapping and a periodic CloudTrail audit with zero listed-vendor invocations. Risks include stale mappings and inconsistent interpretation across agencies."},"roleDetails":{"sales":{"customerProblem":"Texas public-sector AI teams lack clarity on whether a cloud-hosted model from a listed vendor is prohibited.","stakeholders":["Agency information security officer","General counsel","DIR liaison","Procurement lead"],"discoveryQuestions":["Has counsel addressed cloud-hosted models from listed vendors?","Who tracks updates to the prohibited list?","How are AI services screened against it today?"],"valueHypothesis":"Clear mapping from the list to cloud controls lowers compliance risk; it does not settle legal scope.","potentialEngagement":"A compliance-mapping workshop translating the list into Bedrock and Marketplace controls.","unsupportedClaims":["Legal conclusions about scope","That hosted models are or are not covered","Any security benefit beyond policy compliance"]},"engineering":{"fit":"Texas agencies and public universities using any cloud AI catalog.","architectureIntegration":"Organization-level deny policies on model IDs; Marketplace subscription controls.","prerequisites":["Vendor-to-model-ID mapping","Counsel position on hosted models","Organization SCP access"],"constraints":["List names companies, not models","Applies to state employees and devices; cloud scope unstated"],"security":"Enforce with deny-by-default model allow-lists and log all model invocations.","proofOfValue":["Audit CloudTrail for listed-vendor model calls","Test deny policy on a sandbox account"]},"delivery":{"work":"Maintain a vendor-to-model mapping and enforce it in cloud controls.","dependencies":["Counsel interpretation","TXCC/DIR list updates","Cloud governance team"],"ownership":"Agency ISO with cloud governance support.","skillsAdoption":"Staff need to recognize vendor provenance of open-weight models.","governanceCheckpoints":["Quarterly list review","New-model intake check","Counsel sign-off"],"acceptanceCriteria":["Proposed: mapping updated within an agreed period of any list change","Proposed: zero listed-vendor invocations in audits"],"risks":["Inconsistent interpretation across agencies","Stale mappings","Open-weight models re-hosted under other names"]}},"retrievedAt":"2026-11-11T03:59:56Z","enrichedAt":"2026-11-11T04:05:52Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"No accessibility content.","procurementImplications":"Procurement and IT teams must screen AI services, including marketplace and cloud-catalog models, against the list.","operatingModelImplications":"Requires an owner who tracks list updates and maps them to cloud services.","sourceVerification":{"openedUrl":"https://gov.texas.gov/news/post/governor-abbott-updates-texas-prohibited-technologies-list","referenceExcerpt":"At the direction of Governor Abbott, the following technologies were added to the prohibited technology list after a threat assessment executed by TXCC:","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}