Texas AI Regulations
The Texas Responsible Artificial Intelligence Governance Act (HB 149) was signed June 22, 2025 and took effect January 1, 2026 as Chapter 552 of the Business & Commerce Code. It is the third comprehensive state AI law and the least like the other two. Instead of regulating high-risk systems through duties of care and impact assessments, TRAIGA prohibits a short list of uses and requires proof of intent for nearly all of them. The Attorney General enforces it alone, after a mandatory 60-day cure period, and there is no private right of action.
Last reviewed against primary sources: . AI legislation is moving quickly — statutes have been delayed, repealed and replaced mid-cycle. Verify against the linked primary sources before relying on any date here.
Where we work in Texas
TrustEdge serves organizations across Texas, including these markets.
In-Depth Analysis
Texas and Illinois both regulate AI discrimination. They do not regulate the same thing.
Run one resume-screening model against applicants in both states. In Illinois, HB 3773 amended the Human Rights Act effective January 1, 2026 to make it a civil rights violation for an employer to use AI that has the effect of discriminating on the basis of a protected class. Intent is not an element. The Act reaches employers with one or more employees, the charge window is two years, and remedies run to back pay, front pay, emotional distress damages, and attorney's fees. In Texas, Section 552.056 requires intent to unlawfully discriminate, and the statute says in terms that disparate impact alone does not establish it. Enforcement is the Attorney General's alone, after 60 days to cure, with no private plaintiff anywhere in the picture.
Same model. Same measured outcome disparity. In Illinois that is the violation. In Texas it is, standing alone, evidence of nothing.
This has a practical consequence people get backwards. It does not mean Texas deployments need less governance — it means Texas governance is aimed at a different target. Under an effect standard you test for outcome disparity because the disparity is the liability. Under an intent standard your exposure comes from the record: design documents, model cards, prompts, internal messages, and how a system was marketed. What an organization wrote down about what it meant the system to do is the evidence that matters.
The second thing Texas does differently is reward documented process. Discovering a violation through internal review while in substantial compliance with the NIST AI RMF Generative AI Profile, or another recognized framework, is a defense. Discovering the violation yourself through internal adversarial or red-team testing is an affirmative defense. There is a rebuttable presumption of reasonable care. Illinois offers no equivalent. Colorado's NIST rebuttable presumption is removed by SB 26-189, enacted May 14, 2026 and effective January 1, 2027. Plan as if it will not be available after that date. Texas is currently the one state where an AI governance program pays back directly in litigation posture.
The third difference is scope, and it runs the other way from most coverage of this law. TRAIGA imposes no general disclosure duty on private deployers. Its social-scoring and biometric-identification bans bind government entities only. For a large share of private-sector deployments in Texas, the honest answer is that TRAIGA prohibits four categories of deliberate misuse you were not going to engage in, and otherwise leaves you alone.
Where Texas is genuinely demanding is healthcare, and that is not TRAIGA. It is SB 1188 and SB 815, both effective September 1, 2025. A payer using an algorithm as the sole basis for a medical-necessity denial is in violation today. A practitioner using AI for diagnosis owes patient notice and a records review against Texas Medical Board standards. Since January 1, 2026, electronic health records holding Texas patient data must be stored in the United States — a requirement that reaches cloud architecture and offshore support arrangements, not just models.
One note on timing. The Texas Legislature meets biennially and held no regular session in 2026. The 90th Legislature convenes January 12, 2027. TRAIGA will not change before then absent a special session, which makes Texas one of the more stable planning environments in the country right now.
Practical Implications for SMBs & Healthcare
If you operate in both Texas and Illinois, one AI compliance posture will not serve both, and the Texas posture is not simply the lighter one. Illinois asks whether the system produced a disparate outcome. Texas asks what you intended. Those questions are answered with different evidence, and only the Illinois question is answered by a bias audit.
The practical implication for a multi-state deployer is to build to the Illinois effect standard, because it is strictly harder, and then add the Texas-specific artifacts: an intent record for each system and a documented NIST AI RMF mapping you can put in front of the Attorney General inside a 60-day cure window.
For Texas-only organizations outside healthcare and outside government, TRAIGA is a narrow statute. Confirm your CUBI biometric consent practices, confirm no deployment falls into the four prohibited-intent categories, and you are largely done. Spending against a high-risk-AI compliance model that Texas considered and rejected is spending against the wrong law.
For healthcare organizations the priority order inverts. SB 815 and SB 1188 have been in force since September 2025 and carry concrete operational duties: a human reviewer on medical-necessity determinations, AI disclosure on the explanation of benefits, patient notice at the point of AI-assisted diagnosis, practitioner review of AI-generated records, and US-only EHR storage since January 1, 2026. Those are the Texas obligations most likely to be out of compliance right now.
Key Provisions
The intent standard — the defining feature of the statute
Section 552.055 bars developing or deploying an AI system with the sole intent that it infringe, restrict, or otherwise impair constitutional rights. Section 552.056 bars developing or deploying AI with the intent to unlawfully discriminate against a protected class, and states expressly that disparate impact alone is not sufficient to demonstrate that intent. Section 552.052 reaches systems that intentionally aim to incite or encourage self-harm, suicide, harm to others, or criminal activity. Section 552.057 reaches systems developed with the sole intent of producing child pornography or unlawful deepfakes. Every one of these is a mental-state test. A system that produces a discriminatory outcome, without more, does not violate TRAIGA.
Disclosure duties are narrow — and probably do not apply to you
The introduced version of TRAIGA carried a general disclosure duty for private deployers. The enacted version does not. Only two groups must disclose: government agencies, which must tell consumers they are interacting with an AI system before or at the point of interaction, and healthcare providers, who must disclose AI use in treatment in clear and conspicuous plain language without dark patterns, with an emergency exception permitting disclosure as soon as reasonably possible. Private employers have no TRAIGA disclosure obligation. Neither do private-sector deployers generally.
Government-only prohibitions: social scoring and biometric identification
Section 552.053 prohibits government entities from deploying AI that evaluates individuals or groups by social behavior to assign a social score producing detrimental treatment unrelated to the context of collection, disproportionate punishment, or infringement of constitutional rights. Section 552.054 prohibits government entities from using AI to uniquely identify individuals from biometric data gathered from publicly available internet sources without consent where doing so infringes constitutional or statutory rights. Both bind the state, not private business.
Biometric consent — the CUBI amendment that does reach private entities
TRAIGA amends the Capture or Use of Biometric Identifier Act to clarify that an individual has not consented to biometric capture merely because media containing their identifiers is publicly available, unless the individual made it public themselves. It also permits biometric data use in developing or training AI systems where the system does not uniquely identify individuals. This is the provision most likely to change what a Texas-operating organization actually does.
Affirmative defenses: discovery of the violation, and third-party misuse
TRAIGA supplies real defenses rather than a nominal safe harbor. Under Section 552.105(e)(2), the defendant is not liable when it actually discovers the violation through one of these routes: feedback from a developer, deployer, or other person who believes a violation has occurred; testing, including adversarial or red-team testing; following guidelines set by applicable state agencies; or an internal review process while the defendant is otherwise in substantial compliance with the most recent NIST AI RMF Generative AI Profile or another nationally or internationally recognized risk-management framework. No route is satisfied by compliance or process alone. Third-party misuse is separate, under Section 552.105(e)(1): the defendant is not liable if another person uses the affiliated system in a manner the chapter prohibits. The statute also creates a rebuttable presumption of reasonable care. Documented governance is worth something here in a way it is not under a pure effect standard.
Regulatory sandbox and the Texas AI Council
The Department of Information Resources administers a sandbox allowing approved applicants to test AI systems for up to 36 months without obtaining otherwise-required licenses, on submission of a system description, benefit assessment, and risk-mitigation plan. The Attorney General and state agencies cannot pursue enforcement for waived licensing violations during the testing period. Chapter 552's prohibitions still apply to sandbox participants. A seven-member Texas AI Council, administratively attached to DIR, may issue reports, conduct training, and make recommendations. It has no rulemaking authority.
Local AI ordinances are nullified
TRAIGA supersedes and preempts local ordinances, resolutions, and regulations governing AI use. Texas cities and counties cannot build their own regimes. The practical effect is that Texas has one AI rulebook, not the city-by-city layering seen in New York, where NYC Local Law 144 imposes bias-audit duties that state law does not.
Healthcare sits under separate, stricter statutes
The demanding Texas AI rules for healthcare are not in TRAIGA. SB 1188 requires practitioners using AI for diagnosis to review AI-created records against Texas Medical Board standards, to notify the patient, and — from January 1, 2026 — to store electronic health records containing Texas patient data inside the United States. SB 815 bars a utilization review agent from using an AI-based algorithm as the sole basis for denying, delaying, or modifying care on medical-necessity grounds, requires a qualified human reviewer, requires the explanation of benefits to state whether AI was involved, and gives the Texas Department of Insurance authority to audit algorithmic utilization review.
Bills & Statutes
Texas Responsible Artificial Intelligence Governance Act (TRAIGA) — Business & Commerce Code Chapter 552
Signed June 22, 2025; effective January 1, 2026
Read the primary source(opens in a new tab)Electronic health record requirements — AI in diagnosis, practitioner review, patient notice, US data localization
Signed June 20, 2025; effective September 1, 2025; data localization effective January 1, 2026
Read the primary source(opens in a new tab)Automated systems in the health benefit claims process — AI may not be the sole basis of an adverse determination
Signed June 20, 2025; effective September 1, 2025
Read the primary source(opens in a new tab)Applicability & Enforcement
Who It Applies To
Persons and entities that promote, advertise, or conduct business in Texas, that produce products or services used by Texas residents, or that develop or deploy AI systems in Texas. Both developers and deployers are covered. Government entities carry additional obligations that private entities do not. Insurers subject to Texas unfair-discrimination statutes are excluded from the discrimination prohibition. The Act does not reach AI systems that have not been deployed.
Enforcement
Texas Attorney General, exclusive, except for state agency licensing actions. The Attorney General must maintain an online complaint mechanism, and it is live: the office's Consumer AI Rights page carries a "File An AI Complaint Online" route. That matters for planning, because the channel through which a TRAIGA matter reaches you now exists and is open to any consumer. The Attorney General may also issue civil investigative demands, and must give written notice identifying the alleged violation. The recipient then has 60 days to cure and to submit written proof of remediation and of the policy changes preventing recurrence; a successful cure prevents enforcement. There is no private right of action.
Penalties
Curable violations left uncured: $10,000 to $12,000 per violation. Uncurable violations: $80,000 to $200,000 per violation. Continuing violations: $2,000 to $40,000 per day. The Attorney General may also seek injunctive relief, attorney's fees, and court costs. Sandbox participants remain liable for Chapter 552 violations.
Recommended Compliance Actions
Steps organizations should consider to prepare for and comply with Texas's AI regulations.
- 1
Separate your Texas analysis into three buckets before doing anything else: TRAIGA prohibited uses, the government-entity provisions, and the healthcare statutes. Most organizations have real obligations in exactly one of the three.
- 2
For healthcare and payer organizations, audit against SB 815 and SB 1188 first. These have been enforceable since September 1, 2025. Confirm a qualified human reviewer makes every medical-necessity adverse determination, that the explanation of benefits discloses AI involvement, that patients are notified when AI is used in diagnosis, and that EHRs containing Texas patient data are stored in the United States.
- 3
Create and retain an intent record for each AI system: documented purpose, prohibited-use screening against Sections 552.052 through 552.057, and the design decisions behind it. Under an intent standard this record is your defense, and it is the thing most organizations do not have.
- 4
Map your AI governance program to the most recent NIST AI RMF Generative AI Profile and keep evidence of substantial compliance. In Texas the statutory defense is available only if you actually discover the violation through your internal review process while otherwise in substantial compliance with that profile or another recognized framework; maintaining the process alone is not a defense.
- 5
Stand up documented internal adversarial and red-team testing. Self-discovery through such testing is a statutory defense — the only US state AI law that currently offers this.
- 6
Review biometric consent practices against the amended CUBI standard. Publicly available media does not imply consent unless the individual made it public themselves.
- 7
If your systems also touch Illinois workers, run bias testing for outcome disparity anyway. Texas does not require it. Illinois makes the disparity itself the violation, effective January 1, 2026, with no intent element and a two-year charge window.
- 8
Assign an owner and a 60-day response plan for an Attorney General notice. The cure period is the single most valuable feature of this statute and it is worth nothing if the notice sits unrouted for three weeks.
- 9
Evaluate the DIR regulatory sandbox if you are testing an AI system that would otherwise require state licensure. It suspends licensing enforcement for up to 36 months. It does not suspend Chapter 552.
Related TrustEdge Services
As of September 14, 2026. We are not lawyers and this is not legal advice. It is the responsibility of consumers of this data that they verify the applicability and current ratified statutes and legal precedence with a qualified attorney licensed in the state or country they are researching.
Need Help with AI Compliance?
Our team helps organizations build compliance-first AI systems that meet current and emerging regulatory requirements.