From the AWS edition of November 10, 2026
Texas adds Moonshot AI and other PRC-affiliated AI vendors to its prohibited technologies list for state employees and devices
Office of the Texas Governor / Texas Cyber Command · State government / cybersecurity policy · Texas, United States
- Publisher
- Office of the Texas Governor
- Original publication
- 2026-01-26
- Source retrieved
- 2026-11-11
- Event date
- 2026-01-26
What happened
On January 26, 2026 the Texas Governor updated the state's prohibited technologies list for state employees and devices after a threat assessment by Texas Cyber Command (TXCC). The 26 added names include AI developers Moonshot AI, Zhipu (Z.ai), MiniMax, StepFun, Baichuan, Baidu, Alibaba and BAAI. The release names TXCC as lead agency for identifying further threatening technology. Why now: AWS's November 10 post promotes Moonshot AI's Kimi K3.1 Pro on Amazon Bedrock, so Texas agencies and universities using Bedrock face a live question about how this list applies to a cloud-hosted model.
Why it matters
Directly affects Texas state agencies and, through state policy, public universities that use AWS Bedrock. Other states with similar PRC-vendor restrictions face the same question. Cross-tagged to state-government because it is a state cybersecurity policy action.
Evidence and measured results
Official state press release listing added technologies. It does not say whether the prohibition applies to models hosted by third-party cloud providers.
Limitations and uncertainty
Published January 2026, filed now because of the November 2026 Bedrock availability of a Moonshot model. The release does not address cloud-hosted models; any application to Bedrock is interpretation.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-11; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Texas public-sector AI teams lack clarity on whether a cloud-hosted model from a listed vendor is prohibited.
- Stakeholders
- Agency information security officer
- General counsel
- DIR liaison
- Procurement lead
- Discovery questions
- Has counsel addressed cloud-hosted models from listed vendors?
- Who tracks updates to the prohibited list?
- How are AI services screened against it today?
- Value hypothesis
- Clear mapping from the list to cloud controls lowers compliance risk; it does not settle legal scope.
- Potential engagement
- A compliance-mapping workshop translating the list into Bedrock and Marketplace controls.
- Unsupported claims
- Legal conclusions about scope
- That hosted models are or are not covered
- Any security benefit beyond policy compliance
Pre-sales engineering
Role takeaway
- Fit
- Texas agencies and public universities using any cloud AI catalog.
- Architecture and integration
- Organization-level deny policies on model IDs; Marketplace subscription controls.
- Prerequisites
- Vendor-to-model-ID mapping
- Counsel position on hosted models
- Organization SCP access
- Constraints
- List names companies, not models
- Applies to state employees and devices; cloud scope unstated
- Security
- Enforce with deny-by-default model allow-lists and log all model invocations.
- Proof of value
- Audit CloudTrail for listed-vendor model calls
- Test deny policy on a sandbox account
Delivery
Role takeaway
- Work
- Maintain a vendor-to-model mapping and enforce it in cloud controls.
- Dependencies
- Counsel interpretation
- TXCC/DIR list updates
- Cloud governance team
- Ownership
- Agency ISO with cloud governance support.
- Skills and adoption
- Staff need to recognize vendor provenance of open-weight models.
- Governance checkpoints
- Quarterly list review
- New-model intake check
- Counsel sign-off
- Acceptance criteria
- Proposed: mapping updated within an agreed period of any list change
- Proposed: zero listed-vendor invocations in audits
- Risks
- Inconsistent interpretation across agencies
- Stale mappings
- Open-weight models re-hosted under other names
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
No architecture content; implementation falls to agency device and network controls and, by extension, cloud model allow-lists.
Governance
Who approves, reviews and stays accountable for outcomes?
Creates a state-level vendor prohibition that cloud governance must map to model catalogs. Ambiguity about hosted open-weight models should be resolved with state counsel or DIR guidance.
Security and privacy
What data, permissions and controls need testing?
Framed as protection against data harvesting by PRC-affiliated technology. Hosted open-weight models change the data-flow risk but not necessarily the policy scope.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
No accessibility content.
Procurement
What should contracts, pricing and exit terms secure?
Procurement and IT teams must screen AI services, including marketplace and cloud-catalog models, against the list.
Operating model
Which teams own the service once it runs?
Requires an owner who tracks list updates and maps them to cloud services.
Publication history
- 2026-11-10AWS · Issue 128 resources
Stable resource ID: texas-prohibited-technologies-list-moonshot-ai-20260126