AI governance in San Antonio

Chapter 552 of the Business and Commerce Code is TRAIGA as enacted. Signature was June 22, 2025, on HB 149, and the chapter has applied since January 1, 2026. Coverage reaches anyone promoting, advertising, or conducting business in Texas, anyone whose product or service is used by a Texas resident, and anyone who develops or deploys an AI system in the state, whether that organization built the system or only put it into use. Leave a system undeployed and the chapter does not reach it. Extra obligations land on government entities and stay off private entities.

City councils and county commissions cannot add their own AI ordinances, resolutions, or rules. Chapter 552 preempts them. San Antonio therefore cannot layer a municipal AI code on top of the state statute.

Government entities, and only government entities, are who section 552.053 addresses. A city or county department that deploys AI to give residents a social score based on social behavior, where the score produces detrimental treatment unrelated to the context of collection, disproportionate punishment, or infringement of constitutional rights, is inside section 552.053. The forbidden use treats a person or a group worse in a way unrelated to the context in which the information was collected, or punishes out of proportion, or infringes a constitutional right. A private hospital is outside this section. A private lender is outside it. Their biometric question is the consent amendment above.

Section 552.054 is the companion limit, and again the addressee is a government entity. The inputs are biometric data taken from internet sources anyone can already open. The step the section forbids is running AI over those inputs to uniquely identify a particular person, without that person’s consent, when doing so infringes a constitutional right or a right some other statute already gives. A company that is not a government entity sits outside both sections.

Disclosure splits the same way, and a private employer is often the buyer who expects a duty the chapter does not impose. A government agency has to tell a consumer, before or at the interaction, that the consumer is interacting with an AI system. Treatment disclosure sits on the provider, in language a patient can read, and an emergency only postpones it until notice is reasonably possible. Private employers, and private-sector deployers generally, have no disclosure obligation under this chapter. A San Antonio company that is neither a government agency nor a provider using AI in treatment should not fund a disclosure program this statute does not require.

Mark which systems capture a biometric identifier, which ones a government entity deploys, and which contracts have started to name a framework. The inventory is taken with the people who run those systems, in the place the system is used. The four artifacts, an inventory, a boundary note, a contract reading, and a gap list against ISO/IEC 42001 and the NIST AI Risk Management Framework, are what the governance readiness assessment’s service page means by the engagement. Buyers who want a diagnostic and a scorecard, and do not want the inventory, use the Academy offer, which is free.

Hospitals and payers have a separate pair of bills, SB 1188 and SB 815, and those bills are not Chapter 552. Their operational duties are set out on the Texas regulation page. An insurer that is already under a Texas statute aimed at unfair discrimination is outside Chapter 552’s discrimination prohibition. Impact that is disparate, and nothing more, does not establish the intent that prohibition is built on. The intent sections are the lead on the Austin page, and the Texas regulation page states them in full.

For assessment work the credential is HITRUST Authorized External Assessor. Holding that credential does not certify TrustEdge and does not certify the organization whose systems were reviewed.