Texas Data Law

Texas Data, Privacy & AI

Critical Infrastructure, ERCOT, and Foreign-Connected Vendors

Texas bars businesses from giving companies tied to China, Iran, North Korea, or Russia access to or control of the state's critical infrastructure. For the electric grid, ERCOT now requires market participants to attest to compliance, and the Public Utility Commission can impose penalties of up to $1 million per violation. This guide covers the law, its amendments, and vendor diligence.

What the law requires

The Lone Star Infrastructure Protection Act (LSIPA) was enacted in 2021 as SB 2116 and is codified at Business and Commerce Code chapter 117; a parallel provision for government contracts is at Government Code chapter 2275. A business entity may not enter into an agreement relating to critical infrastructure in Texas that would give a company direct or remote access to or control of that infrastructure, if the business entity knows the company is (§117.002):

  • owned by, or majority-held or controlled by, citizens of China, Iran, North Korea, Russia, or a country the governor designates;
  • owned or controlled by an entity, including a government entity, that is owned or controlled by such citizens or directly controlled by the government of such a country; or
  • headquartered in one of those countries.

The ban applies whether or not the company or its parent is publicly traded. Critical infrastructure means a communication infrastructure system, cybersecurity system, electric grid, hazardous waste treatment system, or water treatment facility (§117.001(2)). The governor may designate additional countries as threats (§117.003). Access that the business entity specifically allows for product warranty and support purposes is not prohibited (§117.002), so access design and contract language matter.

The 2023 and 2025 amendments

SB 2013 (2023) strengthened the Act. SB 2368 (2025), effective September 1, 2025, added enforcement aimed at the grid:

  • the Public Utility Commission (PUC) may impose administrative penalties of up to $1 million per violation on a regulated entity that gives a covered company access to or control of critical electric grid equipment or critical infrastructure (Bus. & Com. Code §117.004);
  • ERCOT may not register or keep registered a market participant that does not attest to compliance with chapter 117, may require information to verify an attestation, and may suspend registration or system access on reasonable suspicion that an entity is a covered company (Utilities Code §39.360); and
  • the Attorney General may, at ERCOT's request, investigate whether submitted information is accurate.

Registered bulk electric system entities also remain subject to the NERC Critical Infrastructure Protection (CIP) standards. LSIPA and NERC CIP impose different duties, and compliance with one does not satisfy the other.

Related topics

Sources and legal update

Current through October 12, 2026.

This material is for general information and is not legal advice. Law and enforcement practice change. Consult counsel about specific facts.