TRAIGA Explained

Short Answer

The Texas Responsible Artificial Intelligence Governance Act (TRAIGA) took effect January 1, 2026. It reaches almost anyone connected to Texas: a person who does business or advertises here, offers a product or service Texans use, or develops or deploys an AI system in the state. Its duties are narrower than its reach. Private developers and deployers face a short list of prohibitions, most of which require intent: AI meant to encourage self-harm, violence or crime; AI built solely to infringe constitutional rights; AI used with intent to discriminate unlawfully; and AI built to produce child sexual abuse material or unlawful sexual deepfakes. Governmental entities face additional limits on social scoring and biometric identification, and governmental agencies and health care providers must disclose AI use. Only the Attorney General enforces the Act. There is no private lawsuit, and the Attorney General must give written notice and 60 days to cure before suing.

Which Laws Apply

Texas AI-specific: Business and Commerce Code chapter 551 (definitions and scope), chapter 552 (duties, prohibitions, enforcement), chapter 553 (regulatory sandbox) and chapter 554 (Texas Artificial Intelligence Council); amendments to Business and Commerce Code § 503.001 (biometrics) and Business and Commerce Code § 541.104 (processor duties).

Generally applicable Texas law: the Deceptive Trade Practices-Consumer Protection Act (DTPA), the Texas Data Privacy and Security Act (TDPSA) and the biometric statute continue to apply alongside TRAIGA.

Federal: Executive Order 14365 directs agency action concerning state AI laws. It does not itself repeal TRAIGA or excuse compliance with an otherwise applicable Texas statute.

Key Definitions

An “artificial intelligence system” is any machine-based system that, for any explicit or implicit objective, infers from its inputs how to generate outputs, including content, decisions, predictions or recommendations, that can influence physical or virtual environments (Business and Commerce Code § 551.001). The definition is broad enough to cover predictive models as well as generative tools.

A “consumer” is a Texas resident acting in an individual or household context. It does not include a person acting in a commercial or employment context (Business and Commerce Code § 551.001). That limit matters for the disclosure duty and for complaints: an employee screened by an AI tool at work is not a “consumer” under TRAIGA.

A “developer” develops an AI system offered, sold, leased, given or otherwise provided in Texas. A “deployer” deploys an AI system for use in Texas. A “governmental entity” is a state or local unit exercising governmental functions, but excludes hospital districts and institutions of higher education (Business and Commerce Code § 552.001).

What TRAIGA Prohibits

The prohibitions in Subchapter B of chapter 552 are the core of the Act.

Manipulation (Business and Commerce Code § 552.052). No person may develop or deploy an AI system in a manner that intentionally aims to incite or encourage a person to commit physical self-harm, including suicide, to harm another person, or to engage in criminal activity.

Constitutional rights (Business and Commerce Code § 552.055). No person may develop or deploy an AI system with the sole intent of infringing, restricting or otherwise impairing an individual’s rights under the U.S. Constitution. The section creates no new constitutional right.

Unlawful discrimination (Business and Commerce Code § 552.056). No person may develop or deploy an AI system with the intent to unlawfully discriminate against a protected class in violation of state or federal law. A disparate impact is not sufficient by itself to show intent. Insurance entities subject to insurance anti-discrimination law are excluded, and a federally insured financial institution is considered compliant if it complies with applicable banking laws.

Sexual content and minors (Business and Commerce Code § 552.057). No person may develop or distribute an AI system with the sole intent of producing or distributing child sexual abuse material prohibited by Penal Code § 43.26 or sexually explicit deepfakes prohibited by Penal Code § 21.165, or intentionally develop or distribute an AI system that engages in text-based sexual conversation while impersonating or imitating a child under 18.

Social scoring (Business and Commerce Code § 552.053) and biometric identification (Business and Commerce Code § 552.054). These sections restrict governmental entities. Business and Commerce Code § 552.053 targets specified social scores producing unrelated, unjustified or disproportionate detrimental treatment or infringement of rights. Business and Commerce Code § 552.054(b) addresses unique identification using biometric data or gathering publicly available images without consent where the gathering would infringe constitutional or statutory rights. Business and Commerce Code § 552.054(c) separately makes a violation of the commercial biometric statute, Business and Commerce Code § 503.001, a violation of this section. The biometric-data definition in Business and Commerce Code § 552.054(a), including its exclusions, is not the commercial biometric-identifier definition in Business and Commerce Code § 503.001(a).

HB 149 is the enacted TRAIGA statute. HB 1709, filed November 12, 2024, proposed a different framework with high-risk developer and deployer duties. It did not become law. TRAIGA does not impose that bill’s general risk tiers or impact-assessment program on private businesses. The government assessment requirements in SB 1964 and the TDPSA’s assessments have their own scope and sources.

Disclosure

A governmental agency that makes available an AI system intended to interact with consumers must disclose that the consumer is interacting with AI, before or at the time of interaction, even if a reasonable consumer would find it obvious (Business and Commerce Code § 552.051(b) and (c)). The disclosure must be clear and conspicuous, in plain language, and free of dark patterns; a hyperlink is permitted (Business and Commerce Code § 552.051(d) and (e)).

A provider using AI in relation to a health care service or treatment must disclose that use to the patient or the patient’s personal representative no later than the date the service or treatment is first provided, or as soon as reasonably possible in an emergency (Business and Commerce Code § 552.051(f)).

No section of TRAIGA requires a private retailer, bank or employer to label its chatbot. Other law may: see AI in Customer Communications.

Enforcement

The Attorney General has exclusive authority, except for licensing sanctions under Business and Commerce Code § 552.106, and the Act creates no private right of action (Business and Commerce Code § 552.101). The process runs in a fixed order.

Defenses

Three provisions favor defendants. First, there is a rebuttable presumption that the person used reasonable care (Business and Commerce Code § 552.105(c)). Second, a person who believes in good faith that it has not violated the Act may seek an expedited hearing or a declaratory judgment (Business and Commerce Code § 552.105(d)). Third, a defendant is not liable if another person misused its AI system in a prohibited way, or if the defendant discovers a violation through feedback from a developer, deployer or other person; through testing, including adversarial or red-team testing; by following guidelines set by applicable state agencies; or, if it substantially complies with the National Institute of Standards and Technology (NIST) AI Risk Management Framework: Generative AI Profile or another nationally or internationally recognized AI risk management framework, through an internal review process (Business and Commerce Code § 552.105(e)). No civil penalty action may be brought for a system that has not been deployed (Business and Commerce Code § 552.105(f)).

Read together, these provisions reward businesses that test their systems and keep records of what testing found. AI Governance Programs and the TRAIGA Defenses explains how to build that record.

The Sandbox and the Council

Chapter 553 authorizes a regulatory sandbox administered by the Texas Department of Information Resources (DIR) with applicable state agencies. Participation requires an application and approval identifying the particular requirements to be waived (Business and Commerce Code § 553.051 and Business and Commerce Code § 553.052). The testing period may not exceed 36 months unless extended for good cause (Business and Commerce Code § 553.053). Chapter 552, Subchapter B cannot be waived. Participants must meet the applicable safeguards and report quarterly (Business and Commerce Code § 553.101 and Business and Commerce Code § 553.102); approval is not blanket immunity from federal law or other unwaived requirements. The separate public-sector sandbox created by SB 1964 is a government program, not the Chapter 553 regulatory sandbox. This Guide describes the enacted authority and does not represent that applications to the regulatory sandbox are currently open.

The Texas Artificial Intelligence Council has seven members appointed by the Governor, Lieutenant Governor and Speaker, is attached to DIR, reports to the Legislature and trains state and local government. It may not adopt binding rules or guidance (chapter 554).

Other Changes Made by HB 149

Biometrics: public availability of an image is not by itself the statutory notice and consent, subject to the exception where the individual made it public (Business and Commerce Code § 503.001(b-1)). Business and Commerce Code § 503.001(e)(2) excludes listed AI development, training, processing and storage activities unless the system is used to uniquely identify a specific individual. Subsection (e)(3) is a separate exception for specified security, fraud and other unlawful-activity purposes. Later commercial use outside those exceptions triggers the possession, destruction and enforcement provisions identified in subsection (f).

Privacy: processors under the TDPSA must help controllers with the security of personal data collected, stored or processed by an AI system (Business and Commerce Code § 541.104(a)(2)).

Local preemption: TRAIGA overrides local ordinances and rules regulating the use of AI systems (Business and Commerce Code § 552.003).

State government: agencies must report on AI use and inventory AI systems, and the Sunset Commission must assess agency AI use (Government Code § 2054.068, Government Code § 2054.0965 and Government Code § 325.011).

Illustrative Example (Hypothetical)

A Dallas software company sells a résumé-ranking tool to Texas employers. TRAIGA’s discrimination section applies only if the company developed or deployed the tool with intent to discriminate; a statistical disparity alone would not prove that intent. The tool’s employer customers remain fully exposed to Title VII and Labor Code chapter 21, which recognize disparate impact claims. If the Attorney General opened an investigation, the company’s testing records would be relevant both to the cure process and to the Business and Commerce Code § 552.105(e) defense.

What Is Unsettled

The statute does not define every boundary between a curable and an uncurable violation or give a certification process for substantial compliance with a risk framework. Application of the intent requirements and defenses will depend on the conduct and evidence. Federal litigation or later legislation can change the landscape; an executive order alone does not supply a compliance exemption.

What to Keep for a Complaint or Cure

A complaint does not establish a violation. Preserve the version of the system, its permitted uses and the settings in effect when the event occurred. Business and Commerce Code § 552.103(b) lists information the Attorney General may request: purpose, intended use, deployment context, training-data types, input and output categories, metrics, known limitations, monitoring and safeguards. A deployer should be able to identify its oversight and learning process. A cure record should show the defect, the change, the date the change took effect and the policy changes intended to prevent recurrence. These are practical ways to prepare for the statute’s procedures, not a separate general reporting duty imposed on every private business.

How the Defenses Fit Together

The reasonable-care presumption in Business and Commerce Code § 552.105(c) is rebuttable and does not depend on obtaining a NIST certification. Subsection (e)(2) addresses discovery of a violation through specified feedback, testing, agency guidelines or an internal review. The substantial-compliance condition accompanies the internal-review route. A business should preserve how the violation was found rather than treating a framework name in a policy as immunity. Subsection (f) bars a civil-penalty action under that section for an AI system that has not been deployed. None of these provisions eliminates independently applicable contract, privacy or employment duties. Business and Commerce Code § 552.101(b) also prevents using a TRAIGA violation itself as the basis for a private action under another law; a claimant needs the independent elements of that other cause of action.