AI governance in Austin

The Texas Responsible Artificial Intelligence Governance Act, HB 149, was signed June 22, 2025 and took effect January 1, 2026 as Chapter 552 of the Business & Commerce Code. It has been in force since that date. Our Texas regulation page’s overview states the design in one sentence: instead of regulating high-risk systems through duties of care and impact assessments, TRAIGA prohibits a short list of uses and requires proof of intent for nearly all of them. The Attorney General enforces it alone, after a mandatory 60-day cure period, and there is no private right of action.

Section 552.055 bars developing or deploying an AI system with the sole intent that it infringe, restrict, or otherwise impair constitutional rights. Section 552.056 bars developing or deploying AI with the intent to unlawfully discriminate against a protected class, and states expressly that disparate impact alone is not sufficient to demonstrate that intent. Section 552.052 reaches systems that intentionally aim to incite or encourage self-harm, suicide, harm to others, or criminal activity. Section 552.057 reaches systems developed with the sole intent of producing child pornography or unlawful deepfakes. Every one of these is a mental-state test. A system that produces a discriminatory outcome, without more, does not violate TRAIGA.

The Act reaches persons and entities that promote, advertise, or conduct business in Texas, that produce products or services used by Texas residents, or that develop or deploy AI systems in Texas. Developers and deployers are both covered. Government entities carry additional obligations that private entities do not. The Act does not reach an AI system that has not been deployed. Insurers subject to Texas unfair-discrimination statutes are excluded from the discrimination prohibition.

Enforcement is the Texas Attorney General, exclusive, except for state agency licensing actions. The Attorney General must give written notice identifying the alleged violation. The recipient then has 60 days to cure and to submit written proof of remediation and of the policy changes preventing recurrence. A successful cure prevents enforcement. The office’s complaint mechanism is live. Curable violations left uncured run $10,000 to $12,000 per violation. Uncurable violations run $80,000 to $200,000 per violation. Continuing violations run $2,000 to $40,000 per day. The Attorney General may also seek injunctive relief, attorney’s fees, and court costs. The Texas Legislature held no regular session in 2026. The 90th Legislature convenes January 12, 2027. Our Texas regulation page states that TRAIGA will not change before then absent a special session.

TRAIGA supersedes and preempts local ordinances, resolutions, and regulations governing AI use. Texas cities and counties cannot build their own regimes. Austin is a Texas city, so the practical effect our Texas regulation page states applies here: Texas has one AI rulebook, not a city layer on top of the statute. This page will not describe an Austin AI ordinance. The statute preempts one.

The biometric-consent amendment does reach private entities, and our Texas regulation page calls it the provision most likely to change what a Texas-operating organization actually does. TRAIGA amends the Capture or Use of Biometric Identifier Act so that an individual has not consented to biometric capture merely because media containing the identifier is publicly available, unless the individual made it public themselves. It also permits biometric data use in developing or training AI systems where the system does not uniquely identify individuals. Public availability is not consent unless the individual made the media public themselves. The training permission stops where the system uniquely identifies a person.

TRAIGA supplies defenses, and our Texas regulation page is explicit that no route is satisfied by compliance or process alone. Under section 552.105(e)(2), the defendant is not liable when it actually discovers the violation through one of these routes: feedback from a developer, deployer, or other person who believes a violation has occurred; testing, including adversarial or red-team testing; following guidelines set by applicable state agencies; or an internal review process while the defendant is otherwise in substantial compliance with the most recent NIST AI RMF Generative AI Profile, or another nationally or internationally recognized risk-management framework. Maintaining the process, without that discovery, is not the defense. Third-party misuse is separate, under section 552.105(e)(1): the defendant is not liable if another person uses the affiliated system in a manner the chapter prohibits. The statute also creates a rebuttable presumption of reasonable care. Our Texas regulation page’s point is that documented governance has a role here that it does not have under a pure effect standard. Naming the profile is naming the statute’s defense. It is not a certification, and TrustEdge does not award one.

The Department of Information Resources administers a sandbox that lets approved applicants test AI systems for up to 36 months without obtaining otherwise-required licenses, on submission of a system description, a benefit assessment, and a risk-mitigation plan. The Attorney General and state agencies cannot pursue enforcement for waived licensing violations during the testing period. Chapter 552’s prohibitions still apply to sandbox participants, and sandbox participants remain liable for Chapter 552 violations. A seven-member Texas AI Council, administratively attached to the department, may issue reports, conduct training, and make recommendations. It has no rulemaking authority.