Texas HB 5195: The Website Law That Doesn't Name You, and the Assessment That Will

The Contractor Who Built the Permit Portal

Picture the firm that built an online permit-and-licensing portal for a Texas state agency in 2023. The contract closed, the site went live, the invoices cleared, and the accessibility conversation — such as it was — ended with a VPAT the agency filed and nobody looked at again. In September 2025, a law took effect that will put that portal back on a spreadsheet inside the agency, next to a column labeled "compliance with accessibility standards." The contractor's name is not in the statute. The contractor's deliverable is squarely in what the statute makes the agency assess.

That law is House Bill 5195, passed in the 89th Texas Legislature and effective September 1, 2025. If you build websites, portals, or digital services for Texas state agencies or public institutions of higher education, HB 5195 is the reason your phone is going to ring between now and late 2026 — not because it created a new accessibility duty for you, but because it forced your client to go looking at what you already delivered. This post is the map: what HB 5195 does, what it pointedly does not do, which standard actually governs your Texas work, and what to have ready before the assessment reaches your deliverable.

Editor's note: This is a Texas companion to the state-law map, which surveyed six states whose digital-accessibility obligations the federal extension did not touch. Texas wasn't on that map. HB 5195 is why it belongs there now — with a twist, because HB 5195 is not itself an accessibility standard.

What HB 5195 Actually Does

HB 5195 adds a new Subchapter S — "Modernization of State Agency Internet Websites and Digital Services" — to Chapter 2054 of the Texas Government Code (the state's Information Resources chapter). You can read the enrolled text at capitol.texas.gov. The operative pieces, for a contractor, are these:

• It is a modernization-and-assessment law, not a technical standard. Each state agency — the statute expressly includes institutions of higher education — must assess its websites and digital service portals for a defined list of improvements: simplifying how the public reaches forms, applications, and services; reducing or eliminating paperwork through electronic alternatives; compliance with accessibility standards under Subchapter M; responsive design across desktop, tablet, and phone; and best practices for search, page-load speed, and service integration. HB 5195 tells agencies to look, and to build a plan. It does not, by itself, set a new WCAG version or a new conformance date.
• It puts a reporting clock on the wall. The Department of Information Resources (DIR) must submit a report to the Legislature not later than November 15, 2026, detailing the status of agencies' digital-modernization planning efforts and identifying common priorities and challenges. That reporting section (Government Code § 2054.653) then expires January 1, 2027 — it is a one-time legislative snapshot, not a permanent filing. A separate biennial-review provision (§ 2054.654) carries the recurring evaluation forward and sunsets September 1, 2031. DIR has indicated it will draw on agency responses to the 2026 Information Resources Deployment Review to build the November report, and its website-modernization page is where the operational guidance and the new Texas Design System component library live.
• It never names vendors. Read the statute front to back and you will not find the words "contractor," "vendor," or "supplier." The duties in Subchapter S run to state agencies and to DIR. That is exactly why a contractor can misread HB 5195 as somebody else's problem — and exactly why that reading is a trap.

The trap is the phrase "accessibility standards under Subchapter M." HB 5195 doesn't define the standard; it points to one that already existed. To understand your exposure, you have to follow the pointer.

The Pointer: Subchapter M, 1 TAC 206, and 1 TAC 213

Subchapter M of Chapter 2054 — "Access to Electronic and Information Resources" — is the durable Texas EIR-accessibility law, and it has been binding on state-agency and university technology procurement for years. Subchapter M is implemented through two rule chapters in Title 1 of the Texas Administrative Code: 1 TAC Chapter 206 (state agency and university websites) and 1 TAC Chapter 213 (electronic and information resources generally). DIR's EIR-accessibility program is the front door for both.

Three facts about that framework matter to you:

• The Texas technical standard is WCAG 2.0 Level AA, by way of Section 508. Since April 18, 2020, 1 TAC 213 has required new or changed state-agency web pages and software to meet the standard referenced in the Revised Section 508 rule — WCAG 2.0 Level AA (with a narrow carve-out for the time-based-media guideline). That is the operative state conformance target for EIR you deliver into a Texas agency.
• The framework is a procurement framework, and it reaches vendors. Under Subchapter M and 1 TAC 213, agencies and universities must procure and develop EIR that meets the standard, and vendors are expected to provide accessibility information for their products — in practice, a Voluntary Product Accessibility Template. The completed VPAT (an Accessibility Conformance Report, once filled in) is the artifact procurement expects. If you have ever been asked for a VPAT on a Texas state or university bid, that request came from Subchapter M's machinery, not from HB 5195.
• This standard predates and is independent of the federal Title II rule. The Texas EIR standard did not move when DOJ extended the federal web-accessibility dates. It has been live since 2020 and it is still live today.

So the honest description of HB 5195's accessibility content is: it takes a standard that has quietly governed Texas EIR procurement since 2020 and puts a legislative spotlight — and a November 2026 reporting deadline — on how well agencies are actually meeting it. The forcing function is new. The duty is not.

Three Clocks, One Deliverable

A contractor selling a website or portal into a Texas state agency in 2026 is standing under three clocks at once. Confusing them is how descoping conversations go wrong.

• The federal Title II clock. Under the April 20, 2026 Interim Final Rule amending 28 CFR Part 35, public entities must meet WCAG 2.1 Level AA by April 26, 2027 (entities serving populations of 50,000 or more) and April 26, 2028 (smaller entities and special districts). Texas state agencies and public universities serve the whole state, which puts them in the 2027 bucket. Primary sources: the IFR in the Federal Register and DOJ's web-rule fact sheet. We covered whether that date is really holding in our IFR FAQ.
• The Texas EIR clock. Subchapter M / 1 TAC 213 requires WCAG 2.0 Level AA and has since 2020. There is no future date here — it is already the standard for your Texas state and university deliverables, and it comes with the VPAT expectation at procurement.
• The HB 5195 clock. Assessment and planning obligations effective September 1, 2025, feeding a DIR report due November 15, 2026. Not a technical standard; a spotlight and a deadline for looking.

Here is the practical resolution a contractor can actually act on: WCAG 2.1 AA is a superset of WCAG 2.0 AA. Build and document to WCAG 2.1 Level AA and you clear the Texas state standard and the federal Title II standard with a single conformance target. There is no scenario in which building to the lower Texas 2.0 baseline helps you — the same Texas agency is also a Title II public entity on the 2.1 clock. Pick the higher target once and stop tracking the delta.

What the November 15 Report Actually Triggers for You

The Legislature's report is DIR's to write, not yours. You will never file anything with DIR under HB 5195. But look at how DIR builds a statewide status report on modernization and accessibility: it makes every agency turn around and assess its own web presence — its forms, its portals, its documents, its "compliance with accessibility standards under Subchapter M." An agency cannot answer "how accessible is our permit portal?" without pulling the record on the permit portal. And the permit portal is your deliverable.

That is the mechanism. HB 5195 does not send the contractor a demand. It sends the agency on an inventory, and the inventory surfaces every vendor-built surface that never got a clean accessibility record. When your Texas client asks — sometime between now and the November deadline — for a current VPAT, a scan, or a "confirm this meets Subchapter M" attestation, that request is HB 5195 working exactly as written. The contractor who has the artifact ready answers in an afternoon. The contractor who doesn't is remediating on the agency's timetable, under a legislative deadline, with no leverage.

None of this requires you to have done anything wrong. It requires you to be able to show what you did. That is the entire premise of a defensible paper trail: not a claim that your work is flawless, but a dated, honest record that you assessed it, documented what you found, and tracked what remained.

What to Have Ready Before Your Texas Client Asks

This is the checklist to run against every active Texas state-agency or university deliverable before the assessment reaches it.

• A current, honest ACR for each deliverable. The Subchapter M framework expects vendor accessibility information, and the VPAT is the format procurement recognizes. Fill it in truthfully — "partially supports" with a specific note is a defensible answer; "supports" across the board on a page you never manually tested is the kind of overclaim that ages badly. If you need a refresher on reading and writing these documents, the VPAT/ACR field guide walks through what belongs in each column.
• Build (and re-verify) to WCAG 2.1 AA. One target that clears both the Texas 2.0 standard and the federal 2.1 standard. Document the standard you built to, in writing, in the deliverable record.
• A dated structural scan for each surface. An automated WCAG 2.1 AA structural scan is the fast, repeatable, timestamped starting point — it tells you the machine-testable state of a page on a specific date, which is exactly the kind of dated artifact an assessment wants to see. BidShield's Readiness Scanner produces that structural result, and each deliverable can be logged as its own tracked line in the audit defense log, so when the agency's inventory reaches your surface you are handing over a record, not scrambling to build one. Just be precise about what the scan is and isn't (below).
• Don't lean on an overlay. Texas procurement and the federal enforcement posture have both moved against accessibility overlays and widgets as a means of conformance; the FTC's 2025 accessiBe order made overlay conformance claims a deceptive-practice problem. If your Texas deliverable ships an overlay as its accessibility story, that is a liability to surface now, not to discover during the assessment. Overlays are the fastest way to lose the contract.
• Remember the documents. Subchapter M's definition of electronic and information resources is broad — websites, applications, kiosks, multimedia, and the PDFs an agency posts to serve the public. If your deliverable includes documents, they are inside the assessment too, and an HTML structural scan does not reach them.

The Honesty Line You Cannot Cross

Everything above works only if you are precise about what an automated scan can and cannot do. An automated structural scan reads the machine-testable layer of a page's HTML. It is genuinely useful — it catches missing alt text, unlabeled form fields, empty links, many contrast failures — and it produces a dated record fast. But automated tooling detects only a portion of accessibility barriers; Deque's published research puts axe-core's coverage around 57% of issues by volume, and only about a third of the WCAG 2.1 AA success criteria are even machine-testable at all. Keyboard operability, focus order, meaningful reading sequence, and whether your alt text actually describes the image are manual judgments no scanner renders.

So the line, stated plainly: a scan, a score, or this product does not make your deliverable "WCAG compliant," "ADA compliant," "508 compliant," or "conformant" — and neither does a filed VPAT. What they do is create the honest, dated, defensible record that you assessed the work against the standard, documented what you found, and tracked what remained. In a state that just told every agency to go inventory its accessibility posture, that record is the asset. Overclaiming is the thing that turns a routine assessment into an FTC-shaped problem.

What Does — and Doesn't — Move on the Texas Clock

Strip HB 5195 down and here is what changed and what didn't, for the contractor.

What did not move: the substantive accessibility standard for your Texas state and university work. Subchapter M and 1 TAC 213 have required the Section 508 / WCAG 2.0 AA standard since 2020, with a VPAT expectation at procurement. HB 5195 did not create that duty, did not raise it, and did not delay it. Anyone telling you HB 5195 "gives you until 2026" to worry about accessibility has the law backwards — the standard was already binding, and 2026 is only the date DIR reports on how everyone's doing.

What moved: the visibility. HB 5195 converted a quiet, under-audited procurement standard into a statewide assessment with a legislative deadline. It turned "we filed a VPAT once" into "the agency is actively inventorying whether the thing you built meets the standard, and has to tell the Legislature what it found." For a contractor, that is the difference between a duty that lived in a filing cabinet and a duty that generates a phone call.

The move that protects you is the same one it always is in this work: build to the higher standard once, produce a dated and honest record for every deliverable, and keep it current so that when the assessment reaches your surface you are the vendor who answers in an afternoon. The Texas clock that matters is not November 15, 2026 — that is DIR's deadline. Yours is whenever your client picks up the phone, and the only question that day is whether the record already exists.

---

This post is for informational purposes only and does not constitute legal advice. Consult with qualified legal counsel for guidance specific to your situation.