Texas Responsible AI Governance Act (TRAIGA): An Owner's Guide

The Texas Responsible AI Governance Act (TRAIGA), passed as House Bill 149, took effect January 1, 2026, and it reaches almost any business that operates in Texas or serves Texans. For most private businesses, it asks for less than the headlines suggest: don't develop or deploy AI with the intent to cause specific harms, tell patients when AI is part of their care if you provide health care, and follow the updated biometric consent rules.

The heavier duties, such as telling consumers they're talking to an AI and the ban on social scoring, fall on government. Only the Texas Attorney General can enforce the law, and after written notice you get 60 days to fix a problem before the AG can sue.

Most coverage of this Texas AI law is written for lawyers. We're a Texas AI consulting and software firm, so this guide is written for owners: what applies to you, what doesn't, how enforcement works, and a checklist you can finish in an afternoon.

What is the Texas Responsible AI Governance Act?

The Texas Responsible AI Governance Act is a state law that sets ground rules for developing and using AI in Texas. Most of its duties fall on government, plus a short list of prohibitions that apply to everyone. You'll also see it called TRAIGA, HB 149, or simply the Texas AI law. Rep. Capriglione and Sen. Schwertner carried it, according to the enrolled bill summary.

What counts as an "AI system"?

In plain English: if software takes in information and produces text, a score, a decision, or a recommendation, it likely counts. That includes generative AI tools like ChatGPT, Claude, Gemini, and Microsoft Copilot. It also includes AI note-takers, AI phone receptionists, and the lead-scoring or candidate-ranking features inside software you already pay for.

Who does TRAIGA apply to?

Under Section 551.002, the law reaches anyone who does any of the following:

• Promotes, advertises, or conducts business in Texas.
• Produces a product or service Texas residents use.
• Develops or deploys an AI system in Texas.

Company size doesn't matter.

The law distinguishes developers, who build AI systems, from deployers, who put them to use. If you use off-the-shelf tools, you're most likely a deployer. If you build AI features into your own product, you may also be a developer. If you paid someone to build custom AI for you, the line is less clear, so ask your attorney.

One more definition matters. A consumer is a Texas resident acting in an individual or household context. People acting in a commercial or employment context aren't consumers under TRAIGA.

What TRAIGA requires of private businesses vs. state agencies

Private businesses have three sets of obligations: avoid four intentional misuses of AI, disclose AI use to patients if you provide health care, and follow the amended consent rules if you collect biometric data. The broader disclosure and surveillance rules bind government.

Four things no business may do with AI

Each prohibition turns on intent, not on outcomes alone.

1. Harmful manipulation (552.052): AI that intentionally aims to incite self-harm (including suicide), harm to others, or criminal activity.
2. Constitutional rights (552.055): AI developed or deployed with the sole intent to infringe rights under the U.S. Constitution.
3. Discrimination (552.056): AI developed or deployed with the intent to unlawfully discriminate against a protected class. Under this section, disparate impact alone isn't enough. Insurers get a carve-out, and federally insured financial institutions are treated as compliant if they follow banking laws.
4. Sexual content and minors (552.057): AI built with the sole intent to produce certain sexually explicit material, including unlawful deepfakes and child sexual abuse material. It also covers a chatbot that intentionally impersonates a minor in sexual conversations.

Rules that apply only to government

The general AI-interaction disclosure (552.051(b)), the social scoring ban (552.053), and the biometric identification ban (552.054(b)) bind government entities only. They may still matter if you sell to Texas agencies, and they signal what the state expects of AI.

The one disclosure rule for private businesses: health care

If you provide health care, you must tell the patient or their representative when AI is used "in relation to" a health care service or treatment (552.051(f)). The deadline is the date the service is first provided. In an emergency, disclose as soon as reasonably possible.

The statute's disclosure standards (clear and conspicuous, plain language, no dark patterns, hyperlink allowed) are written for government disclosures under subsection (b). Applying them to health care is a reasonable reading, not settled law, but following them is the safe choice. Our page on AI for medical practices shows where AI fits into clinic workflows.

Biometrics, voiceprints, and vendor contracts

HB 149 amended Texas's biometric identifier law (Business & Commerce Code 503.001):

• A photo or recording online isn't consent unless the person made it public themselves.
• Training AI on biometric identifiers is exempt, unless the system is used to uniquely identify someone.
• Security, fraud prevention, and illegal-activity prevention uses are exempt.
• Biometrics captured for training and later used commercially fall back under the law.

A 503.001 violation is also a TRAIGA violation (552.054(c)).

HB 149 also updated the Texas Data Privacy and Security Act. Processors must now help controllers secure personal data "collected, stored, and processed by an artificial intelligence system" (541.104(a)(2)). Check that your AI vendor contracts reflect this.

Myth vs. statute

Does TRAIGA affect my business? Scenarios by industry

For most Texas businesses, the answer comes down to three questions. Do you provide health care? Do you touch biometrics? Does AI make decisions about people?

All of the scenarios below are hypothetical.

Example: a Lubbock family clinic adds an AI scribe. The scribe is used in relation to treatment, so 552.051(f) applies. Add a plain-language line to intake forms, and have staff mention it at check-in.

Example: a Dallas HVAC company runs a website chatbot. TRAIGA's general disclosure duty is written for government, but say "You're chatting with our AI assistant" anyway. Set guardrails and test for prompt injection so the bot can't be steered into harmful replies. There's more in AI for home services.

Example: an Austin accounting firm screens resumes with AI. Section 552.056 turns on intent, and disparate impact alone isn't enough under that section. Federal and other Texas employment laws still apply on their own terms. Keep a human in the loop on rejections. See AI for professional services.

Example: a Corpus Christi property manager uses AI tenant screening. The TRAIGA analysis is the same as for hiring, and housing laws apply separately. Document what the tool weighs, and review declines by hand. See AI for real estate.

Example: a roofer's AI voice agent recognizes repeat callers by voice. Voiceprints are biometric identifiers. Confirm consent under 503.001, or switch voice recognition off. Our guide to AI agents for business covers where these tools fit.

How is TRAIGA enforced? Complaint, investigation, notice, cure

Enforcement follows a fixed sequence, and only the Attorney General can bring an action.

Step 1: A consumer files a complaint

The AG had to set up an online complaint mechanism by September 1, 2026 (552.102). As of October 18, 2026, the AG's Consumer AI Rights page links to a "File An AI Complaint" form.

Step 2: A civil investigative demand

After a complaint, the AG can issue a civil investigative demand (CID) for information about your AI system (552.103). In summary, it can ask for:

1. The system's purpose, intended use, deployment context, and benefits.
2. The type of data used to program or train it.
3. The categories of data it takes in.
4. The outputs it produces.
5. The metrics you use to evaluate performance.
6. Known limitations.
7. Post-deployment monitoring and user safeguards.
8. Other documentation reasonably necessary for the investigation.

Keep a one-page fact sheet for each tool that answers these. For off-the-shelf tools, the vendor's documentation covers much of it.

Step 3: Written notice and the 60-day cure window

Before suing, the AG must send written notice naming the specific provisions at issue (552.104). The AG can't sue before day 60, and can't sue at all if you cure the violation within 60 days and send a written statement that does three things:

1. Says you cured the violation.
2. Includes supporting documentation.
3. Describes changes to your internal policies.

Step 4: Penalties if you don't cure

The AG can also seek an injunction, attorney's fees, and investigative costs. A court decides whether a violation was curable.

Statutory-range arithmetic, not a likely fine: a continuing violation that lasts 30 days could add $60,000 (30 × $2,000) to $1,200,000 (30 × $40,000) on top of the base penalty. That spread is why curing inside the window matters.

No penalty action can be based on AI you haven't deployed (552.105(f)).

Licensed professionals, such as physicians, CPAs, and real estate agents, face extra exposure. If a violation is found and the AG recommends it, your licensing agency can suspend, probate, or revoke your license and fine you up to $100,000 (552.106).

Does following the NIST framework protect you?

Following NIST helps, but it isn't a blanket safe harbor. Section 552.105 contains several defenses, and the statute ties NIST to just one of them:

• Presumed reasonable care. You're presumed to have used reasonable care, though the presumption can be rebutted (552.105(c)).
• Someone else's misuse. You're not liable if another person misused your AI system (552.105(e)(1)).
• You found it yourself. You're not liable if you discovered the violation in any of these ways (552.105(e)(2)):
  • through feedback
  • through testing, including adversarial or red-team testing
  • by following state agency guidelines
  • through an internal review process, if you substantially comply with the most recent version of NIST's AI Risk Management Framework: Generative Artificial Intelligence Profile, or another nationally or internationally recognized AI risk framework
• A fast track. If you believe you're compliant, you can ask for an expedited hearing or a declaratory judgment (552.105(d)).

The pattern is clear: the law rewards businesses that look for problems and fix them. Records you create before a complaint carry more weight than records you scramble to create after one.

What NIST-aligned practice looks like for a 25-person company

When we help clients with AI governance, we keep it proportional. A 25-person company typically needs:

• An inventory of AI tools, with a named owner for each.
• A written intended use and known limits for each tool.
• Testing before launch, using evals plus red-team prompts.
• Monthly spot checks and an incident log.
• A dated annual review against the framework you've chosen.

Whether that adds up to "substantial compliance" is a question for counsel, so read NIST's own documents before claiming alignment. Our AI readiness assessment framework scores Governance & Risk as one of its five pillars, and our AI strategy and governance consulting builds this documentation alongside your AI roadmap.

What else is in HB 149: the sandbox, the Council, and one statewide rule

The regulatory sandbox (Chapter 553). The Department of Information Resources (DIR), in consultation with the AI Council, runs a program where approved companies can test AI products for up to 36 months, with extensions for good cause. Applicants need approval from DIR and any relevant licensing agency, and the application must cover the system, its benefits, a mitigation plan, and federal compliance. Participants report quarterly, and the four prohibitions can't be waived. If you're building AI for a licensed field, our custom AI development team can plan the build and the paperwork together.

The Texas Artificial Intelligence Council (Chapter 554). The Council is attached to DIR and has seven members: three appointed by the governor, two by the lieutenant governor, and two by the speaker, serving staggered four-year terms. It reports to the legislature and trains state and local agencies, but it can't issue binding rules or guidance.

Local preemption (552.003). TRAIGA overrides city and county AI ordinances, so the same standard applies in Dallas, Austin, Lubbock, and Corpus Christi. If you operate in several cities, you follow one set of rules. See our AI consulting across Texas.

One-page TRAIGA compliance checklist

You can work through this list in an afternoon. Each item notes the HB 149 section it supports.

For the policy, start with our guide on how to write a company AI policy, and roll it out with AI training for employees. For the inventory, watch for shadow AI. When we map a client's workflows, we often find AI features in the CRM, phone system, or scheduling tool that nobody listed.

If a notice arrives: your 60-day cure plan

Treat the 60 days as a project with a hard deadline, and confirm the exact date with your attorney.

Promise only what you'll actually do. Breaching your cure statement carries its own penalty of $10,000–$12,000 per violation.

What's changed since January 1, 2026

Next steps

Start with the checklist. Then take the free 5-minute AI Readiness Assessment to see where your Governance & Risk pillar stands. If you want help building the inventory, policy, testing, and review records, talk to us about AI consulting services or book a free consultation.

This guide is a plain-English summary, not legal advice. Talk to a Texas attorney before making legal decisions about your AI tools.