TRAIGA: What the Texas Responsible AI Governance Act Actually Requires of a Business (2026)

The short answer

TRAIGA is the Texas Responsible Artificial Intelligence Governance Act (House Bill 149). It took effect January 1, 2026 and covers any business that operates in Texas, with no small-business exemption. For a private company it does three things: it bans building or deploying AI that is meant to manipulate people into harm, to unlawfully discriminate, to violate constitutional rights, or to produce certain sexual content; it makes health care providers disclose AI use to patients; and it lets the attorney general fine you $10,000 to $200,000 per violation after a 60-day chance to fix it.

That is a much smaller law than the one most summaries describe, and I can show you why. I work from Austin, so this is my state's law too. I'm not a lawyer and this is not legal advice. It is the bill text, read line by line, with the parts that touch a normal company pulled out.

Most TRAIGA summaries describe a bill that did not pass

Two bills carried the name "Texas Responsible Artificial Intelligence Governance Act" in the 2025 session. House Bill 1709 was filed on December 23, 2024. The Texas Legislature's site shows its last action as a committee referral on March 14, 2025. It never became law. House Bill 149 is the one that passed: 146 to 3 in the House, 31 to 0 in the Senate, signed June 22, 2025.

I counted the terms in both texts on September 30, 2026:

So if a vendor or a consultant tells you TRAIGA requires annual impact assessments for "high-risk AI systems," they are quoting the bill that stalled. The law on the books has no high-risk category and no assessment duty for private companies. It also has no size exemption, which the stalled bill did have. You are covered at 5 employees. There just isn't much to do.

Who the law covers

Section 551.002 applies the Act to a person who does any one of three things: "promotes, advertises, or conducts business in this state," "produces a product or service used by residents of this state," or "develops or deploys an artificial intelligence system in this state." An out-of-state company with Texas customers is in.

The definition of an AI system is broad: "any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations." ChatGPT, a website chatbot, an AI phone agent and a resume-screening tool all fit.

One definition narrows the disclosure rule. A "consumer" is a Texas resident "acting only in an individual or household context." Someone acting "in a commercial or employment context" is not a consumer under the Act.

What each section says, and who it binds

Read the right-hand column again and look for the word that repeats: intent. Every rule that binds a private business is about what you built the system to do. None of them is a paperwork duty.

Two carve-outs sit inside the discrimination section. It does not apply to insurers already covered by insurance anti-discrimination statutes, and a federally insured bank "is considered to be in compliance" if it follows federal and state banking law.

The Act also amends the existing Texas biometric law (Business and Commerce Code 503.001), which does bind private companies. A photo of someone that exists online is not consent to capture their biometric identifier unless that person made it public themselves. Training an AI model on biometric data is exempt unless the system is used to identify a specific individual.

The fines, and what 30 uncured days costs

Section 552.105 sets three penalty bands:

• $10,000 to $12,000 for each violation the court finds curable.
• $80,000 to $200,000 for each violation the court finds uncurable.
• $2,000 to $40,000 per day for a continued violation.

Here is the arithmetic on one curable violation that a company ignores for 30 days after the cure window closes. The base penalty is $10,000 to $12,000. Thirty days at the daily rate is $60,000 to $1,200,000. Added together that is $70,000 at the statutory floor and $1,212,000 at the ceiling, before attorney's fees, which the state can also recover. Whether a court stacks them that way is a question for your lawyer. The point is that the daily number, not the headline number, is the one that gets large.

If you hold a state license (contractors, real estate, health professions), Section 552.106 lets your licensing agency add a penalty of up to $100,000 and suspend or revoke the license, but only after you have been found in violation and the attorney general recommends it.

How enforcement actually works

1. A complaint. The attorney general had to post an online complaint mechanism by September 1, 2026. It is live: the consumer complaint page now lists an "AI complaint form."
2. A civil investigative demand. After a complaint, the attorney general can demand documents about the AI system.
3. A written notice naming the sections you allegedly violated.
4. 60 days to cure. No action can be filed during those 60 days, or at all if you fix the problem and send a written statement saying how, with documentation and any policy changes.
5. A lawsuit by the state if you don't.

There is no private lawsuit. The text says the chapter "does not provide a basis for, and is not subject to, a private right of action." Cities can't add their own AI rules either: the Act preempts local ordinances on AI use.

The eight things the attorney general can ask for

This is the most useful part of the bill for an owner, and almost nobody writes about it. Section 552.103(b) lists what a civil investigative demand can request. Turn it around and it is the record you want to already have for every AI system you run:

Seven rows per tool. For a company with five AI tools that is a one-page spreadsheet. It is also the inventory step in any AI governance framework, which matters because of the next section.

The defenses, including the NIST one

The Act starts from a "rebuttable presumption that a person used reasonable care." On top of that, a defendant "may not be found liable" in two situations. First, when another person used the defendant's AI system in a prohibited way. Second, when the defendant found the violation itself through one of four routes: feedback from a developer, deployer or other person; testing, "including adversarial testing or red-team testing"; following guidelines set by state agencies; or an internal review process, if the defendant "substantially complies" with NIST's Generative AI Profile "or another nationally or internationally recognized risk management framework."

Plain version: the company that looks for its own problems and writes down what it found is in a far better position than the one that waits for a complaint. A short written AI acceptable use policy, the inventory above and a quarterly check are what "an internal review process" looks like at 30 people.

Three Texas businesses, read against the text

These are made-up companies, to show how the sections land.

• A 25-person HVAC contractor with a website chatbot and an AI phone agent. No disclosure duty under TRAIGA: it is neither a government agency nor a health care provider. The intent prohibitions apply, and none is likely to be triggered by booking service calls. The licensing-agency sanction in 552.106 is the part to know about.
• A dental practice using AI to read X-rays or draft treatment notes. This one has an affirmative duty. When AI is "used in relation to health care service or treatment," the provider must disclose it to the patient no later than the date of service. Add a line to the intake paperwork.
• A staffing firm using AI to rank resumes. The discrimination section applies. It requires intent, and disparate impact alone is not enough under this Act. Federal and state employment law still apply on their own terms, so this is the tool where the monitoring row in the table above should not be blank.

Texas next to Colorado

If you sell in both states, do not assume they match. Colorado's legislature describes its law (Senate Bill 24-205) as requiring a deployer of a "high-risk" system to implement a risk management policy and program, complete an impact assessment, review each deployment annually, notify consumers about consequential decisions and offer an appeal. It also requires any business with consumer-facing AI to disclose it. A 2025 special-session bill (Senate Bill 25B-004) extended the effective date to June 30, 2026. Colorado has moved that date once already, so check the legislature's page before you rely on it.

Texas asks for none of those things from a private business. The same company can be fully fine in Austin and out of compliance in Denver.

What else the Act created

• A regulatory sandbox. The Department of Information Resources can approve a company to test an AI system for up to 36 months with certain licensing rules waived. Participants report quarterly. The prohibitions in the table above cannot be waived.
• The Texas Artificial Intelligence Council. Seven public members appointed by the governor, lieutenant governor and House speaker. It studies and recommends. The Act says it may not "adopt rules or promulgate guidance that is binding for any entity."

What I'd do this week

Open a spreadsheet. List every AI tool your company uses down the left side and the first seven rows of the attorney general's list across the top. Fill in what you can in 30 minutes and mark what you can't. If you run a health care practice, add the AI disclosure line to your intake forms today.

If the blanks in that sheet worry you, that is what an AI audit is for. If you are deciding whether to bring in outside help, read what to ask an AI consultant first. And if you want the inventory, the risk map and a written plan done for you, my AI Readiness Assessment produces exactly that ($2,500, delivered in two weeks).

Sources

• Texas Legislature Online, H.B. 149 enrolled text (89th Regular Session), read September 30, 2026: every section number, quote and penalty amount above.
• Texas Legislature Online, bill history for H.B. 149 (signed June 22, 2025) and for H.B. 1709 (filed December 23, 2024; last action March 14, 2025), plus the introduced text of H.B. 1709, read September 30, 2026.
• Office of the Texas Attorney General, "File a Consumer Complaint" and "Consumer AI Rights" pages, read September 30, 2026: the AI complaint form.
• Colorado General Assembly, bill pages for SB24-205 and SB25B-004, read September 30, 2026. Later Colorado changes were not checked.