Austin Legislative Hub
An owner's doctrine for third-party AI risk. Five questions your vendors will not answer voluntarily. One page. Fifteen minutes. Same rail, same fare, no gate.
No class. No webinar. No slide deck. The Car runs start to finish on its own — four Signals, a pressure door between each one, and the complete signed Car waiting in the Library.
Educational orientation only. Not legal advice — statute reads defer to the Federal Train and to David M. Williams's GRC practice. This Car ends with a blank page and a pen: the decision is yours.
This ride
Ride depth
No account, no form, no sales handoff. The ride starts the moment you board — four Signals, a pressure door between each one, and the Library at the end.
How do you want this — Quick Start or Deep Dive?
The owner orientation. Three bullets per Signal — the punchline of each stop and nothing else. Enough to make the decision this Car asks you to make.
Release 1 delivers Quick Start as four acts at the length on the button — measured in this build, not estimated. About 3 min per act (~12 min end to end) is the Release 2 editorial-depth target.
Every line of this Car's approved text, in order, with the founder's notes as cards beside it. Narrated by Rex, with the read-along measured from his recordings.
Release 1 delivers Deep Dive as the same four acts at the length on the button — measured in this build, not estimated. That length is measured from Rex’s recordings in this build. About 10 min per act at Deep (~40 min end to end) is the Release 2 editorial-depth target, not current delivery.
You are not locked in. The Quick / Deep switch rides with you in the player, so you can cross over at any stop. The complete original Car — worksheet, red lines, correction log and all — is always one tap away under “Full Reading + Sources”.
Now boarding
State Liner · Car 02 — Third-Party Risk · Guided by Rex
Every serious third-party AI risk concern compresses into five sentences an owner can send in an email.
1:31The third-party risk market is organized around a specific fiction: the Trust Center is an answer.
2:18None of these five categories are addressed by the Trust Center. All five are addressed by the five questions.
3:07The doctrine compresses to a single sentence you sign.
3:16Your ride depth
Audio-first rider: Rex narrates this Car, and the transcript highlights sentence by sentence from his recordings.
Car 02 · Third-Party Risk · Rex
No external citation layer exists on this Car in the approved source: Car 02 cites doctrine, not statute. Statute reads live on the SB 2610 Safe Harbor Car and on the Federal Train.
Educational orientation only. Not legal advice — statute reads defer to the Federal Train and to David M. Williams's GRC practice. This Car ends with a blank page and a pen: the decision is yours.
This is Car 02 exactly as it was signed — every word of the approved doctrine, the worksheet, the red lines, the boundaries, and the correction log, unabridged and unedited. The rider above is a second way through the same words, not a replacement for them.
State Liner · Car 02
An owner's doctrine for third-party AI risk. Five questions your vendors will not answer voluntarily. One page. Fifteen minutes. Same rail, same fare, no gate.
v1 doctrine · corrections signed and dated in the log below.
You are an owner. Something like forty of your vendors touch your customer data, your financials, or your employee records. Now those vendors have plugged AI into their own stack. You did not sign that. You cannot see it. And every one of those vendors sends you a Trust Center link when you ask, then charges you extra when you ask again. This Car is the owner's counter-move: five questions you make every vendor answer in writing before their AI touches your data. One page. Fifteen minutes. Same rail, same fare, no gate.
Every serious third-party AI risk concern compresses into five sentences an owner can send in an email:
That is the doctrine. Five questions. Signed answers. Filed. Reviewed fifteen minutes a month against the vendor list. Everything else on this Car is context around those five questions — why they are the right five, what the vendors send you instead, and how the counter-move works.
The third-party risk market is organized around a specific fiction: the Trust Center is an answer. It is not. A Trust Center is a link a vendor sends you when you ask a real question, so you will stop asking. Behind the link is a PDF with a SOC 2 date and a paragraph about "responsible AI" written by the same legal team that authored the MSA you never fully read. Nothing in the Trust Center answers the five questions above. That is by design.
The market has trained owners to accept the Trust Center as the artifact. This Car unlearns you from that. The artifact is not the Trust Center. The artifact is five specific written answers from a named human, filed in your own drive, tied to your own vendor list, reviewed monthly by you.
Your third-party AI exposure looks like this today: forty-plus SaaS tools, most of them added AI features in 2024–2025, none of them notified you specifically, all of them now sit inside a vendor list you have not audited against AI usage. The five categories of hidden exposure:
None of these five categories are addressed by the Trust Center. All five are addressed by the five questions.
Texas SB 2610 established a specific idea for group health plan vendors: the vendor signs a written attestation about their conduct, and the buyer is allowed to rely on that attestation as evidence. The frame is portable. This Car applies it to AI-adjacent SaaS vendors of every kind.
The move is not to audit the vendor. The move is to make the vendor sign a written attestation about their own conduct, filed in your drive, dated, and reviewed on your rhythm. If the vendor refuses to sign, that refusal itself is the answer.
A vendor who signs the five questions in writing has staked their reputation to the answer. A vendor who refuses to sign is telling you something you can price into the renewal decision. Either way, you win. The Trust Center takes neither position and costs you the leverage.
This Car is written for the owner-operator of a 25–100 employee company. You have a vendor list somewhere between twenty and two hundred SaaS tools. You do not have a procurement department. You are the procurement department, on Sundays, while your kids play in the yard. You have six specific Monday moments where third-party AI risk shows up:
The five questions are designed to give you a clean answer to all six moments in fifteen minutes a month, against your existing vendor list, with no auditor and no consultant.
You do not need dollar figures to see the cost. If you cannot answer the five questions across your top vendors today, you are paying for the absence in five categories:
The absence is priced into every one of those five categories every month you do not send the questions.
The doctrine compresses to a single sentence you sign:
I am the person responsible for what my vendors do with my data, and I am willing to send five questions in writing to every vendor whose AI touches my data, file their signed answers, and review them for fifteen minutes once a month.
That sentence is the doctrine. Not "I will trust the Trust Center." Not "I will hire a third-party risk consultant." Not "I will assume the MSA covers it." I send the five questions. I file the answers. I review the vendor list against the answers.
1Does your product use AI on my data?
Which product surfaces, which internal vendors, which named model providers. If the answer is "some AI features are enabled by default and can be disabled per workspace," the follow-up is: show me the exact toggle, name the default state, and confirm the toggle position for our workspace in writing.
2Do you train on my data — or allow sub-processors to?
Named default state, named opt-out mechanism, signed confirmation of the opt-out for your account. Sub-processors are the trap here: many vendors opt themselves out of training and quietly leave the sub-processor default set to opt-in.
3Where does my data physically live and travel when your AI touches it?
Named regions, named borders. "Our infrastructure is global" is not an answer. The answer names the countries where storage sits and the countries where processing happens, and confirms whether either can change without notifying you.
4What receipt do you leave behind for AI-mediated actions on my data?
Format, retention, and whether you can produce twelve months of it on request. If they cannot, the answer is a factual "no," not a hedge. A factual "no" is filable. A hedge is not.
5Who is your named human accountable for AI decisions that touch my company?
Not a role. A name and an email. If the vendor cannot name a specific person, the accountability structure is a marketing narrative, not an operating one.
This Car is doctrine, not execution. When you have signed the five questions and want help operating them across a real vendor list, the rail bridges to the Dynasty stadium at $28 per ride, comped through Sunday after Thanksgiving 2026. Stadium rooms hold the master classes; each room has a name and a coach. See Car 03 for the room list.
Doctrine is what you can do in fifteen minutes a month against your own vendor list. Execution is what happens when you want a running attestation register, board-ready supply-chain reporting, an incident response playbook, or a peer group of owners tracking the same discipline. Doctrine ships free on the rail. Execution lives in the rooms.
Ten commitments this Car makes against its own short-term revenue, so the doctrine stays a doctrine:
Ten boundaries this Car names openly:
For each vendor whose product touches your data:
Five questions. Signed answers. Filed in your drive. Reviewed fifteen minutes a month. That is the doctrine. If a vendor will not sign, that refusal is the answer.
Mr. Nobody, Founder, Dynasty Plays.
Signed 2026-09-02 · v1
Five questions. One page. Your signature. Fifteen minutes a month against your vendor list. If any part of this Car turns out to be wrong, I will sign the correction here. See you on the rail.
Take the next step
Arrival
Everything this Car says lives here. Replay any Signal, read the whole Car unabridged, or take the next step.
Replay depth — same choice you made at the Ticket
Any stop, any time. Start over from the top of Car 02.
Read instead of listen, or replay one stop. The transcript is the Car's own text, word for word, and it follows along.
The complete signed Car — doctrine, worksheet, red lines, boundaries, and the correction log. Nothing abridged.
David M. Williams, GRC Chair at Dynasty Stack, answers questions about this ride. Write if and when you want to: david.m.williams@dynastyplays.com. Nothing is sent unless you write.
Questions about this ride
Optional and up to you. Email David, GRC Chair at Dynasty Stack, at david.m.williams@dynastyplays.com. Nothing is shared and no one contacts you unless you write first.
Take the next step
Meridian Rail · State Liner · Car 02 · v1 · 2026-09-02