Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149)

· About Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149)

Key Takeaways

  • TRAIGA applies statewide in Texas to persons developing, deploying, or distributing AI systems, with the strongest obligations on government agencies and specified public-facing uses, while targeted prohibitions also reach private actors.
  • The Act took effect on 1 January 2026 and is enforced exclusively by the Texas Attorney General, with no private right of action and a 60-day cure period before enforcement.
  • Any AI used by a government entity to interact with consumers must be disclosed as AI, and healthcare providers must disclose AI use at or before the point of care except in emergencies.
  • Texas prohibits AI intended for behavioural manipulation, unlawful discrimination, CSAM, unlawful deepfakes, and uses that infringe constitutional rights, with civil penalties that can reach up to $200,000 per uncured violation.
  • The Act also creates a regulatory sandbox and an Artificial Intelligence Council, signaling a compliance model that combines enforcement with controlled experimentation.
  • Local Texas ordinances regulating AI are preempted, so companies should treat TRAIGA as a baseline state law rather than a patchwork of city rules.

What It Is

The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), cited as HB 149, is a Texas state law regulating the use of artificial intelligence systems and providing civil penalties. The enrolled bill states that it takes effect 1 January 2026 and authorizes the Act to be cited by its short title.[2] Legislative analysis materials describe the law as establishing consumer protections, an enforcement mechanism, a regulatory sandbox, and an Artificial Intelligence Council.[1]

The Texas Legislature adopted the bill in 2025, and the official bill text reflects the operative effective date of 1 January 2026.[2] A 2025 committee analysis likewise states the effective date as 1 January 2026.[1] A separate statutory implementation milestone requires the Attorney General to post the online complaint mechanism by 1 September 2026.[3]

Who Must Comply

TRAIGA’s scope is broad enough to cover persons developing, deploying, or distributing AI systems in Texas, and commentary from Texas legal analyses reads the jurisdiction to extend to AI-related products or services consumed by Texas residents. That said, the law’s most concrete affirmative duties are directed at government entities and healthcare settings, while the main prohibition provisions can apply to private businesses and other persons engaging in covered AI conduct.[1][2][7]

The law does not create a general company-size threshold in the materials reviewed; applicability turns on conduct and context, not employee count or revenue.[1][2] Texas also preempts local government AI ordinances, so a covered entity should not expect municipal carveouts to reduce state-law exposure.[12]

The law contains targeted exemptions and carveouts in the final text, including use cases tied to narrow operational or research contexts, but the available materials do not support a single blanket exemption for small entities or ordinary commercial users.[1][2] Entities should treat any reliance on an exemption as fact-specific and document it carefully.

Core Requirements

  1. Do not use AI for prohibited purposes. TRAIGA prohibits AI intended for behavioural manipulation, unlawful discrimination, CSAM, unlawful deepfakes, and infringement of constitutional rights, so the key compliance test is both the use case and the intent behind the system’s design and deployment.[1][2]
  1. Disclose AI when consumers interact with government systems. Government entities must disclose when a consumer is interacting with AI, which means the notice obligation attaches at the point of interaction rather than after the fact.[7][12]
  1. Disclose AI use in healthcare settings. In healthcare, AI use must be disclosed at or before the point of care, except in emergencies, so clinics, hospitals, and related providers should build disclosure into intake and treatment workflows.[7]
  1. Avoid prohibited biometric and deceptive practices. Legislative materials and practitioner analyses indicate the statute also interacts with Texas biometric rules and deceptive or harmful AI practices, so organizations should review downstream data, identity, and disclosure impacts alongside model use itself.[7]
  1. Prepare for Attorney General oversight and complaint intake. The Attorney General has exclusive enforcement authority and must operate an online complaint mechanism, so internal incident response should assume regulator-driven scrutiny rather than private litigation.[6][11][12]
  1. Observe the cure process before any monetary exposure escalates. The Attorney General must give notice and a 60-day cure period before enforcement action, but failure to cure or false certification of cure can increase penalty exposure substantially.[12]

Deadlines and Penalties

| milestone | date | what applies | |---|---|---| | Act takes effect | 1 January 2026 | TRAIGA becomes operative statewide.[1][2] | | AG complaint mechanism due | 1 September 2026 | Attorney General must post the online consumer complaint mechanism.[3][6] | | Continuing compliance | ongoing | Prohibited AI uses, government disclosure, and healthcare disclosure obligations apply from effectiveness onward.[1][2][7] |

The Attorney General has exclusive enforcement authority, and there is no private right of action in the reviewed materials.[6][12] The statute provides civil penalties that practitioners summarize as $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for continuing violations.[12] Practitioners also note the Act’s 60-day cure period before enforcement, which is the main procedural buffer for remediation.[12]

How to Comply

  1. Inventory AI use cases and classify them by legal risk. Map each system to use case, users, data inputs, outputs, and decision impact, then flag any use involving manipulation, discrimination, deepfakes, or constitutional-rights sensitivity.
  1. Build a governance register and approval workflow. Use ISO 42001 as the management-system backbone for policy, risk ownership, controls, and continual improvement, because TRAIGA is governance-heavy rather than purely technical.
  1. Align technical controls to ISO 27001 and NIST CSF 2.0. Use ISO 27001 for access control, logging, change management, vendor security, and incident handling; use NIST CSF 2.0 to organize identify-protect-detect-respond-recover activities for AI-enabled systems.
  1. Implement disclosure triggers in product and clinical workflows. Add consumer-facing and patient-facing notices where AI interactions occur, and test them in the same release and validation cycle as the underlying model or workflow.
  1. Document intent, training data, testing, and human oversight. Because some prohibitions turn on intended use, keep evidence of product requirements, risk reviews, red-team testing, and controls showing the system was not designed for banned uses.
  1. Create a 60-day regulator-response playbook. Assign legal, technical, and executive owners for notice review, remediation, evidence preservation, and cure certification so the team can act quickly if the Attorney General contacts the company.
  1. Review vendor and procurement terms. Require AI suppliers to contractually support disclosures, audit rights, incident notification, and cooperation on prohibited-use screening, especially where the company is a deployer rather than the model developer.

Related Regulations

  • Texas Biometric Identifier law (Business & Commerce Code § 503.001) overlaps because TRAIGA-related analyses note clarifications on biometric consent and internet-sourced biometric identifiers.
  • Texas Deceptive Trade Practices Act can overlap when AI outputs or disclosures become misleading, unfair, or deceptive in consumer-facing contexts.
  • Colorado AI Act is a useful comparator because both regulate high-risk AI uses, but Texas relies more heavily on prohibition and disclosure while Colorado is risk-management oriented.
  • EU AI Act may conflict in multinational programs because it uses a broader risk-tier system and can impose different documentation and conformity obligations.
  • NIST AI RMF / NIST CSF 2.0 are not laws, but they are useful control frameworks that can reduce compliance fragmentation across jurisdictions.

Does TRAIGA apply to companies outside Texas?

Yes, if the company develops, deploys, or distributes AI systems in Texas or offers AI-related products or services consumed by Texas residents. The reviewed materials indicate the law is not limited to Texas-incorporated companies or in-state headquarters. Cross-border businesses should therefore assess nexus through users, deployments, and market access, not just corporate domicile.[1][7]

Does TRAIGA require disclosure every time AI is used?

No, the clearest disclosure obligations in the reviewed materials attach to government consumer interactions and healthcare point-of-care settings. Outside those settings, the statute’s main focus is on prohibited uses rather than universal labeling. Companies should still consider whether their use cases create misleading or deceptive impressions even when no explicit label is required.[1][2][7]

What penalties can the Texas Attorney General seek?

Practitioner summaries of the Act report civil penalties ranging from $10,000 to $12,000 for curable violations, $80,000 to $200,000 for uncurable violations, and $2,000 to $40,000 per day for continuing violations.[12] The Attorney General must first provide notice and a 60-day cure period before enforcement action, so remediation can materially reduce exposure if handled promptly.[12]

Is there a private right of action under TRAIGA?

No private right of action is identified in the official bill materials and enforcement summaries reviewed.[6][12] Enforcement is described as exclusively vested in the Texas Attorney General, which means plaintiffs generally cannot sue under TRAIGA itself. That does not eliminate exposure under other laws, such as consumer protection, privacy, employment, or discrimination statutes.[6][12]

Has TRAIGA been amended or delayed since enactment?

The reviewed materials do not show a 2025–2026 delay of the operative effective date; the official bill text still states 1 January 2026. The main post-enactment milestone identified is the Attorney General’s complaint mechanism posting deadline of 1 September 2026.[2][3] Any further amendment claim should be checked against later session law or codified updates before relying on it.

Sources

Put it into practice

More compliance guides