Does TRAIGA apply to employers?

Yes, but lightly. An employer may not deploy an AI system with the intent to unlawfully discriminate against a protected class, and disparate impact alone doesn't prove intent. Unlike the Colorado and Connecticut laws, TRAIGA has no duty to notify applicants or employees, explain decisions or run bias audits. The act's definition of a consumer excludes people acting in an employment context.

Does TRAIGA require businesses to disclose that they use AI?

Not in general. The duty to tell consumers they're interacting with AI applies to government agencies. The exception is health care: a provider using AI in relation to a health care service or treatment must disclose it to the patient or their representative by the date the service is first provided, or as soon as reasonably possible in an emergency.

Can employees or customers sue under TRAIGA?

No. The act says it doesn't create a private right of action. Only the attorney general can enforce it. People can file a complaint through the attorney general's online AI complaint portal, and a complaint can lead to a civil investigative demand.

Does following the NIST AI Risk Management Framework protect you under TRAIGA?

It helps. A business can't be found liable if it discovers a violation through an internal review process while substantially complying with NIST's Generative AI Profile or another recognized AI risk framework. The act also presumes a business used reasonable care, and it protects violations found through testing, red-teaming or feedback. None of this replaces fixing the problem within the 60-day cure period.

What are the laws governing AI in Texas?

The main one is TRAIGA (HB 149), in force since January 1, 2026. It also amended the state's biometric identifier law and made a breach of that law a TRAIGA violation. Health care has a second rule: Senate Bill 1188, in effect since September 1, 2025, lets practitioners use AI for diagnostic purposes only if they review the AI-created records and disclose the use to patients. TRAIGA also preempts any city or county AI ordinance.

Texas Responsible AI Governance Act (TRAIGA) Explained

Q: What is TRAIGA?

TRAIGA is the Texas Responsible Artificial Intelligence Governance Act, passed as House Bill 149 and signed on June 22, 2025. It took effect on January 1, 2026. It bans a short list of intentional misuses of AI by anyone doing business in Texas, puts extra limits on government agencies, requires health care providers to disclose AI use to patients, and gives the Texas attorney general sole power to enforce it.

Q: Who does TRAIGA apply to?

Anyone who promotes, advertises or conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an AI system in Texas. There's no size threshold. Most of its duties, though, apply only to government agencies, and nearly all the prohibitions that reach private businesses turn on intent. The exception is biometric data, where a breach of the state's biometric identifier law also counts as a TRAIGA violation.

Q: What are the penalties under TRAIGA?

If a violation isn't cured within the 60-day notice period, a court can impose $10,000 to $12,000 for each curable violation, $80,000 to $200,000 for each uncurable one, and $2,000 to $40,000 for each day a violation continues. The attorney general can also seek an injunction and its costs. State licensing agencies can add sanctions of up to $100,000 and act on a license once a violation is found, if the attorney general recommends it.

The Texas AI law has been in force since January 1, 2026. Much of what's written about it calls it comprehensive, and for a company it mostly isn't. TRAIGA asks a private business for no impact assessments, no notices to job applicants and no bias audits. What it does give the attorney general is a complaint portal and the power to demand a written account of any AI system you run. The companies that will find TRAIGA hard are the ones that can't produce that account.

What is the Texas Responsible AI Governance Act?

The Texas Responsible Artificial Intelligence Governance Act (TRAIGA, House Bill 149) is the Texas AI law in force since January 1, 2026: it bans a short list of intentional misuses of AI by anyone doing business in Texas, limits how government agencies use AI, requires health care providers to tell patients about AI, and lets only the attorney general enforce it, with fines of up to $200,000 per violation. It was signed on June 22, 2025.

This guide is for the people at a company who own its AI tools: operations, HR, IT and compliance leads. It covers what the act asks of a business that uses AI, which is most of them, rather than one that builds AI models. It's based on the enrolled bill and the attorney general's TRAIGA page. It isn't legal advice.

Who does TRAIGA apply to?

TRAIGA applies to anyone who promotes, advertises or conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an AI system in Texas. There's no size threshold and no revenue test. If you have customers or staff in Texas, assume you're in scope.

The act's definition of an AI system is broad: "any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments." Chatbots, résumé screeners, fraud models and the AI features inside your existing software all qualify.

It sorts businesses into two roles:

A developer builds an AI system that is offered, sold, leased, given or otherwise provided in Texas.
A deployer deploys an AI system for use in Texas. A company that rolls out ChatGPT, Copilot or an AI hiring tool is a deployer.

Being in scope doesn't mean much is required of you. Most of the act's duties fall on government. Nearly all the rest turn on what you intended.

Fig. 1Who each part of TRAIGA reaches. An open circle means it applies through the state biometric law, which TRAIGA makes part of the act. Source: HB 149, Sections 551.002 to 552.057.

What does TRAIGA require of a private business?

For a private business, TRAIGA is mostly a list of things you may not intend to do with AI, plus one disclosure duty for health care. The table shows who each part reaches.

Part of the act	Government agencies	Health care providers	Every business
Tell consumers they're dealing with AI	Required	Required, for AI used in care	Not required
No AI meant to incite self-harm, harm to others or crime	Yes	Yes	Yes
No AI with the sole intent to infringe constitutional rights	Yes	Yes	Yes
No AI with intent to unlawfully discriminate	Yes	Yes	Yes
No AI built to produce illegal sexual content	Yes	Yes	Yes
No social scoring	Banned	Not covered	Not covered
No biometric identification without consent	Banned	Through the state biometric law	Through the state biometric law

The prohibitions that reach every business

A person may not develop or deploy an AI system:

"in a manner that intentionally aims to incite or encourage a person to" commit physical self-harm, including suicide, harm another person, or engage in criminal activity;
"with the sole intent" for it to infringe, restrict or impair someone's rights under the US Constitution;
"with the intent to unlawfully discriminate against a protected class in violation of state or federal law";
with the sole intent of producing or distributing child sexual abuse material or unlawful deepfakes, or to hold sexual conversations while imitating a child.

Every one of these turns on intent. That's the main thing to understand about TRAIGA, and the main way it differs from the Colorado law.

Disparate impact is not enough

The discrimination ban comes with a sentence that matters to every HR team: "a disparate impact is not sufficient by itself to demonstrate an intent to discriminate." A screening tool that happens to reject more applicants from one group doesn't, on that evidence alone, break TRAIGA.

That doesn't make the outcome safe. The ban only applies to discrimination that is already unlawful "in violation of state or federal law", and those laws still apply in full. TRAIGA adds a state enforcer for intentional cases. It takes nothing away from the existing ones.

Two sectors get carve-outs. Insurers subject to the insurance code's unfair-discrimination rules are exempt for insurance services, and a federally insured financial institution is treated as compliant if it follows federal and state banking law.

Health care providers must tell patients

If an AI system is used in relation to a health care service or treatment, the provider must disclose it to the patient or their personal representative no later than the date the service or treatment is first provided. In an emergency, it's as soon as reasonably possible. The disclosure must be "clear and conspicuous", in plain language, and free of dark patterns. A hyperlink to a separate web page is allowed.

A second Texas law already applies to clinical AI. Senate Bill 1188, in effect since September 1, 2025, lets a practitioner use AI for diagnostic purposes, including treatment recommendations based on a patient's record, only if they act within their license, the use isn't otherwise restricted, and they review "all records created with artificial intelligence" against Texas Medical Board standards. They must also disclose that use to their patients. If you're working out which AI tools can touch patient data in the first place, our guide to HIPAA compliant AI covers the agreements you need.

What TRAIGA doesn't require

For a private business outside health care, the act has no duty to:

tell job applicants or employees that AI is used in decisions about them;
explain a rejection or offer a human review;
run an impact assessment or a bias audit;
register AI systems or report to the state.

That's the opposite of the Colorado AI law and the Connecticut AI law, which both require notices before software helps decide someone's job. If you hire in those states as well as Texas, their rules set the standard for your process, not TRAIGA's. The act also defines a "consumer" as a Texas resident acting "only in an individual or household context", which excludes "an individual acting in a commercial or employment context."

How is TRAIGA enforced?

Only the Texas attorney general can enforce TRAIGA, and an investigation can start with one complaint through the attorney general's online portal. The act says it creates no private right of action, so employees and customers can't sue under it.

The act required the attorney general to post an online complaint mechanism by September 1, 2026. Its TRAIGA page now links to a "File An AI Complaint" form on its consumer complaint portal. After that, the process runs in four stages.

A complaint arrives through the portal, alleging a violation.
The attorney general may issue a civil investigative demand to find out whether a violation occurred.
If it finds one, it sends a written notice naming the provisions it says you broke.
You get 60 days. It can't sue before the 60th day, or at all if within that time you cure the violation and send a written statement that you cured it, with supporting documentation, and that you changed your internal policies "to reasonably prevent further violation."

Fig. 2How a TRAIGA case runs. The attorney general can't sue before the 60th day after its notice, or at all if you cure the violation and say so in writing. Source: HB 149, Sections 552.102 to 552.104.

What the attorney general can ask you for

This is the part of the act that creates real work. In a civil investigative demand, the attorney general may ask the business reported through the portal for:

a high-level description of the system's purpose, intended use, deployment context and benefits;
a description of the type of data used to program or train it;
a high-level description of the categories of data it takes as inputs;
a high-level description of its outputs;
any metrics you use to evaluate its performance;
any known limitations;
a high-level description of post-deployment monitoring and user safeguards, including, for a deployer, "the oversight, use, and learning process" you set up to deal with issues from its deployment;
any other documentation reasonably necessary for the investigation.

Items 5 to 7 are the hard ones for a company that switched an AI feature on without a plan for it. A vendor can usually help with items 2 and 6. Only you can describe how you use the system and who watches it.

What are the penalties under TRAIGA?

A business that doesn't cure a violation within the 60 days faces $10,000 to $12,000 for each curable violation, $80,000 to $200,000 for each uncurable one, and $2,000 to $40,000 for each day a violation continues. Breaking a written cure statement you sent the attorney general counts in the first band. The attorney general can also seek an injunction and recover its legal fees and investigation costs.

Fig. 3TRAIGA's civil penalties for a violation that isn't cured, on one scale. The daily band applies for each day a violation continues. Source: HB 149, Section 552.105.

There's a second layer for licensed professionals. Once a court finds a violation and the attorney general recommends it, the state agency that licenses a person can suspend, put on probation or revoke the license, and impose a penalty of up to $100,000. Doctors, nurses, accountants and other licensed professionals in Texas should read the prohibitions with that in mind.

What protects you under TRAIGA?

TRAIGA presumes you used reasonable care, and it rules out liability where you found a problem through your own testing, through feedback, or through an internal review process run under a recognized AI risk framework. The act names the framework: NIST's "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile" (NIST AI 600-1, published July 26, 2024), "or another nationally or internationally recognized risk management framework."

In full, a defendant may not be found liable if:

someone else used the AI system in a way the act prohibits; or
the defendant discovered the violation through feedback from a developer, deployer or other person, through testing (including adversarial or red-team testing), by following guidelines set by state agencies, or through an internal review process while substantially complying with the NIST profile or a similar framework.

The attorney general also can't collect a penalty for a system that hasn't been deployed, and a business that believes in good faith it hasn't broken the act can ask for an expedited hearing or a declaratory judgment.

Read together, the defenses describe a habit, not a document. They reward the company that tests its AI, gives people a way to report problems, and acts on what it hears. A policy written once and filed doesn't do that.

The defenses describe a way of running AI

Look at what the act protects: testing that finds a problem, feedback that reports one, and a review process that catches one. In each case someone was watching and could act. That's what our framework asks of every AI tool a company runs: an owner, a way to stop it, and a date to look at it again.

Two lessons in our free course do this job directly. Stop, tell, fix, learn sets up the reporting route that turns staff and customer feedback into a record of problems found and fixed, which is exactly the feedback defense. Review dates puts each tool on a schedule so the internal review actually happens. Between them they also produce most of what item 7 of a civil investigative demand asks for.

What else changed under TRAIGA?

Cities can't add their own AI rules

TRAIGA "supersedes and preempts any ordinance, resolution, rule, or other regulation adopted by a political subdivision regarding the use of artificial intelligence systems." For a company with offices in Austin, Dallas or Houston, there's one Texas AI rulebook, not several.

Biometric data: a public photo isn't consent

TRAIGA amended the state's existing biometric identifier law, and it made a breach of that law a TRAIGA violation too: "A violation of Section 503.001 is a violation of this section." So while the act's own ban on AI biometric identification applies to government, a business that captures biometric identifiers without the consent the state law requires can face the attorney general under TRAIGA as well. Under the amendment, a person isn't treated as having consented to the capture of their biometric identifiers just because an image of them is online or publicly available, unless they made it public themselves. Training AI on biometric identifiers is exempt, unless the system is used or deployed to uniquely identify a specific person. If you use face or voice identification, for security or time clocks, check it against that law.

A sandbox and a council

The act set up a regulatory sandbox run by the Texas Department of Information Resources. An approved participant can test an AI system for up to 36 months without certain state licenses, filing quarterly reports. The prohibitions themselves can't be waived. It also created a seven-member Texas Artificial Intelligence Council, which advises the legislature and can't adopt binding rules or guidance.

How to get ready for TRAIGA

There are six steps. Each produces something the next one uses, and together they produce the account the attorney general can ask for.

01 · List every AI system that touches Texas

Include the obvious tools (chatbots, copilots, AI hiring software) and the AI features vendors have switched on in software you already pay for. Note which ones customers, patients or applicants interact with. The free Shadow AI Audit finds the built-in features, and Your AI list in our course turns them into a register with an owner on every row.

02 · Check each use against the prohibited list

For each system, ask whether anything about how it's configured or used could be read as intent to discriminate, to manipulate, or to restrict someone's rights. The highest-risk uses are those that score or sort people (hiring, lending, pricing, eligibility) and chatbots that talk to the public. For a public chatbot, check that it has guardrails against encouraging self-harm, violence or crime, and keep the evidence that you checked.

03 · Write a one-page file for each system

Use the attorney general's eight items as the headings: purpose and context, training data, inputs, outputs, performance metrics, known limitations, monitoring and safeguards, and the owner. Ask each vendor for what only they know, usually training data and known limitations. Keep the file current when the vendor ships an update.

04 · Pick a framework and run the review

Adopt the NIST Generative AI Profile, or another recognized framework, as the basis for an internal review, and run it on the systems from step 02 first. Test the riskiest ones, including adversarial prompts for anything public-facing. Record what you tested, what you found and what you changed. The record is what makes the defense usable.

05 · Open a feedback route and a 60-day plan

Give staff, customers and vendors one place to report an AI problem, and log every report and its outcome. Then write down what happens if a notice arrives: who owns the response, who your counsel is, how you'll cure the problem, and who signs the written statement. Sixty days goes quickly if you start by finding out who's responsible. Your AI usage policy should carry the reporting rule, so staff know it exists.

06 · If you provide health care, add the patient disclosure

Add a plain-language AI disclosure to intake or consent paperwork, given no later than the first date of service. If clinicians use AI for diagnosis or treatment recommendations, make sure they review the AI-created records and tell patients, as SB 1188 requires.

For a company that wants help putting the register, reviews and owners in place across more than one state's rules, that's what our AI governance work does.

What's still open

Enforcement. The complaint portal is new, and we haven't found any public record of an enforcement action under TRAIGA. How the attorney general uses civil investigative demands will show what "high-level" means in practice.
Federal pressure. On December 11, 2025, the president signed Executive Order 14365, which told the US attorney general to set up an AI Litigation Task Force within 30 days whose "sole responsibility" is to challenge state AI laws that conflict with federal policy. As of this update, TRAIGA remains in force.
The sandbox. The Department of Information Resources is to set the sandbox application by rule. Check its site for the current process if you build AI systems and want to apply.

We'll update this article when the attorney general brings its first action, or when the law changes. The date at the top of the page shows when we last checked.

Sources

House Bill 149, enrolled version, Texas Legislature, 2025: the full text of TRAIGA, used for scope, definitions, prohibitions, the civil investigative demand, the cure period, penalties, defenses, preemption, the biometric amendment, the sandbox, the council and the September 1, 2026, portal deadline.
HB 149 bill history, Texas Legislature Online: the signing date (June 22, 2025) and the effective date (January 1, 2026).
Consumer AI Rights, Office of the Texas Attorney General, October 2026: the attorney general's overview of TRAIGA and its link to the AI complaint form.
Consumer Complaint Portal, Office of the Texas Attorney General, October 2026: the portal the "File An AI Complaint" link opens.
Senate Bill 1188, enrolled version, Texas Legislature, 2025: the rules on AI in electronic health records, effective September 1, 2025.
Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST, July 2024: the framework TRAIGA names (NIST AI 600-1).
Ensuring a National Policy Framework for Artificial Intelligence, The White House, December 2025: Executive Order 14365 and the AI Litigation Task Force.

Texas Responsible AI Governance Act (TRAIGA): What Businesses Must Do