TRAIGA, the Texas Responsible Artificial Intelligence Governance Act, is House Bill 149 from the 89th Legislature. It took effect January 1, 2026. For most private businesses it’s narrower than the headlines suggest: it bans a short list of intentionally harmful AI uses, puts most of its disclosure duties on government, and gives the Texas Attorney General sole enforcement power with a 60 day chance to fix a problem before any lawsuit.
So it’s not a compliance program in a box. But it does reward one specific habit: knowing which AI tools you use and being able to show how you oversee them. That’s also the core of managing shadow AI, which is why I think the two belong in the same conversation.
Everything below comes from the enrolled bill text. This isn’t legal advice.
Who it covers
The scope is wide on paper. The law applies to anyone who promotes, advertises, or does business in Texas, produces a product or service Texans use, or develops or deploys an AI system in Texas. That’s most companies with a Texas footprint.
Two definitions narrow things in practice.
• Consumer means a Texas resident acting in an individual or household context. It expressly excludes someone acting in a commercial or employment context.
• Governmental entity covers state and local agencies, but not hospital districts or public universities.
The law also preempts local rules. Cities and counties can’t layer their own AI ordinances on top.
What’s prohibited for everyone
These apply to any person, public or private. Notice how much of the language turns on intent.
| Prohibition | What it says, in plain terms | Section |
|---|---|---|
| Manipulation | Don’t develop or deploy AI that intentionally aims to push someone toward self-harm, harming others, or crime | 552.052 |
| Constitutional rights | Don’t build or deploy AI with the sole intent to infringe someone’s federal constitutional rights | 552.055 |
| Unlawful discrimination | Don’t build or deploy AI with the intent to unlawfully discriminate against a protected class. Disparate impact alone doesn’t prove intent | 552.056 |
| Sexual content involving minors and deepfakes | Don’t build or distribute AI with the sole intent of producing illegal child sexual material or unlawful sexual deepfakes, or chat systems that impersonate a minor in sexual conversation | 552.057 |
Insurance entities already subject to insurance laws on unfair discrimination and deceptive practices are carved out of the discrimination section. Federally insured financial institutions are treated as compliant with it if they follow banking law.
For a normal law firm, energy company, or manufacturer using Copilot or Claude for everyday work, none of this is likely to bite. The bigger practical risk, I think, is a tool someone adopted on their own that does something nobody reviewed.
What applies only to government
Several of the provisions people talk about most only bind government:
• Disclosure. A governmental agency that offers AI meant to interact with consumers has to tell them they’re dealing with AI, clearly and in plain language, even if it seems obvious.
• Social scoring. Government can’t use AI to assign social scores that lead to unjustified or unrelated harm.
• Biometric identification. Government can’t use AI to uniquely identify people from biometric data or scraped images without consent where that would infringe their rights.
If you sell AI tools or services to Texas agencies, your customers carry these duties, and they’ll likely ask you to help them meet them.
TRAIGA also amended the state’s biometric identifier law. An image on the public internet doesn’t count as consent to capture someone’s biometrics for a commercial purpose, unless that person made it public. Training AI on biometric data is generally exempt, unless the system is used to identify specific people.
The health care disclosure rule
Here’s one private businesses can’t skip. If AI is used in relation to a health care service or treatment, the licensed provider must disclose that to the patient or their representative no later than the date the service is first provided. In an emergency, it’s as soon as reasonably possible.
That reaches clinics, practices, and other licensed providers, not just public hospitals. The disclosure has to be clear, in plain language, and free of dark patterns, and a hyperlink to a separate page is allowed.
Enforcement and penalties
The Attorney General has exclusive authority to enforce the law, and there’s no private right of action. Here’s how a case would move:
- Complaint. The AG must offer an online complaint mechanism. The law set a September 1, 2026 deadline to post it, and the AG’s site now has a Consumer AI Rights page with an online AI complaint form.
- Civil investigative demand. The AG can ask for a description of the system’s purpose and use, the data used to train it, its inputs and outputs, performance metrics, known limits, and your post deployment monitoring and safeguards.
- Written notice. The AG has to identify the specific provisions allegedly violated.
- 60 day cure. No lawsuit can be filed before day 60. If you fix the issue in that window and send a written statement showing the cure, the supporting documents, and the policy changes you made to prevent a repeat, the AG can’t sue.
- Penalties if you don’t cure.
Violation
Civil penalty
Curable, or breaking a cure statement you gave the AG
$10,000 to $12,000 per violation
Uncurable
$80,000 to $200,000 per violation
Continuing
$2,000 to $40,000 per day
The AG can also seek an injunction and recover attorney’s fees and investigation costs. And for licensed professionals, a state licensing agency can add sanctions, including a license action and a fine of up to $100,000, but only after a court finds a violation and the AG recommends it.
Look at that investigative demand list again. It’s basically a checklist of the documentation you’d want anyway.
The defenses worth knowing
The statute gives defendants more room than many state laws do.
• Presumption of reasonable care. There’s a rebuttable presumption that you used reasonable care.
• Misuse by someone else. You aren’t liable if another person uses your AI system in a prohibited way.
• You found it yourself. You aren’t liable if you discovered the violation through feedback, adversarial or red team testing, following state agency guidelines, or an internal review process while substantially complying with the NIST AI Risk Management Framework Generative AI Profile or a similar recognized framework.
• Not deployed. No civil penalty for a system that was never deployed.
That NIST point is the practical takeaway. If you already align your AI governance to the NIST AI Risk Management Framework, you’re building the defense the law describes. If you don’t, it’s a good reason to start.
The sandbox and the AI Council
The Texas Department of Information Resources runs a regulatory sandbox. Approved participants can test an AI system for up to 36 months, extendable for good cause, while certain licensing rules are waived. Participants file quarterly reports. The four prohibitions in section 3 can’t be waived, sandbox or not.
The law also created a seven member Texas Artificial Intelligence Council. It studies, reports, and trains agencies, but it can’t adopt binding rules.
What it means for law, energy, PE-backed, and medical device companies
Law firms. Your exposure as a user is modest. Your clients’ exposure may not be, and they’ll ask you about it. Keep your own AI inventory and policy tidy, partly because it’s good practice under ABA Formal Opinion 512, and partly because it’s hard to advise on governance you don’t practice. This isn’t legal advice.
Oil and gas. Texas operators are squarely in scope. The prohibitions won’t likely touch normal operations, but field teams using consumer AI apps on their own is exactly the gap that makes an investigative demand hard to answer.
PE-backed companies. For portfolio companies with Texas operations, a short TRAIGA section in the AI inventory and policy makes diligence easier. Sponsors increasingly ask.
Medical device manufacturers. Device makers usually aren’t the licensed provider, so the disclosure duty typically sits with your provider customers. Expect them to ask what your AI does and how they should describe it to patients.
What TRAIGA means for Houston law firms
If you run a Houston law firm, TRAIGA almost certainly applies to you, because the Texas Responsible Artificial Intelligence Governance Act covers anyone who conducts business in Texas or deploys an AI system here (Sec. 551.002). That sounds bigger than it is. Its core prohibitions turn on intent: manipulation toward harm, infringing constitutional rights, unlawful discrimination, and illegal sexual content. Lawyers drafting and researching with Copilot or Claude aren’t the target.
Where TRAIGA does touch a firm is evidence. If a complaint reaches the Attorney General, a civil investigative demand can ask for each AI system’s purpose, training data, inputs, outputs, known limits, and post-deployment monitoring (Sec. 552.103). The 60 day cure period (Sec. 552.104) only helps if you can show what you fixed and which internal policy you changed. Our free AI acceptable use policy template is a good place to start that policy.
Your heavier duties come from ethics rules. ABA Formal Opinion 512 (July 2024) and the State Bar of Texas Professional Ethics Committee’s Opinion 705 (February 2025) both start with competence and confidentiality. Understand how a tool handles client information before you use it, and verify what it produces. Opinion 705 says that if you aren’t reasonably satisfied a tool won’t reveal confidential information, don’t put that information in without client consultation and consent.
Oversharing is where this gets practical. Copilot answers from whatever the signed-in user can already open. Claude works with whatever its connectors reach. A matter folder open to the whole firm can be surfaced across an ethical wall.
We’re Houston-based and work with firms on exactly this. See AI governance for law firms. This isn’t legal advice.
What to do now
- Inventory your AI. Include the tools people adopted on their own. Our guide to shadow AI covers how to find them.
- Write it down. A policy, an approved tool list, and an owner. Our free AI acceptable use policy template is a starting point, and our guide on how to roll out an AI acceptable use policy covers the rest.
- Pre-answer the investigative demand. For each AI system you deploy, keep a one page record: purpose, data, inputs, outputs, known limits, monitoring.
- Align to NIST. Use the AI RMF and its Generative AI Profile as your review framework, and keep evidence that you follow it.
- Health care providers: add the disclosure to intake now.
- Plan for a 60 day response. Know who would draft the cure statement and the policy changes if a notice ever arrives.
If you’re tracking more than Texas, our post on three AI laws law firms should track puts TRAIGA next to the others.
Where this leaves your firm
TRAIGA isn’t the sweeping AI regime some people expected. For most businesses it’s a handful of intent based prohibitions, a firm but forgiving enforcement process, and a strong nudge toward documented governance. The firms that will find it easy are the ones that already know what AI their people use. That’s the same work as getting shadow AI under control.
If you’d like a quick read on which AI tools are already in use across your environment, that’s what our AI Readiness Snapshot is for. This isn’t legal advice, and your counsel should confirm how TRAIGA applies to you.
Quick answers
What is TRAIGA?
The Texas Responsible Artificial Intelligence Governance Act, House Bill 149. It bans certain intentionally harmful AI uses, sets disclosure duties mostly for government and health care providers, and is enforced by the Texas Attorney General.
When does TRAIGA take effect?
January 1, 2026.
Does TRAIGA apply to private companies?
Yes, partly. The manipulation, constitutional rights, discrimination, and sexual content prohibitions apply to any person, and health care providers must disclose AI use to patients. Social scoring, biometric identification limits, and the general consumer disclosure duty apply only to government.
Who enforces TRAIGA?
Only the Texas Attorney General. There’s no private right of action. State licensing agencies can add sanctions for licensees after a court finds a violation and the AG recommends it.
What are the penalties under TRAIGA?
After a 60 day chance to cure, $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for continuing violations, plus injunctions and fees.
Does following the NIST AI RMF help under TRAIGA?
Yes. A defendant isn’t liable for a violation it finds through an internal review while substantially complying with the NIST AI RMF Generative AI Profile or a similar recognized framework. This isn’t legal advice.
Does TRAIGA apply to private law firms?
Yes, in part. TRAIGA applies to anyone who conducts business in Texas or deploys AI here, so a private firm is covered by the prohibitions on intentionally harmful AI uses. Most disclosure duties, social scoring limits, and biometric limits bind government only. Enforcement belongs to the Attorney General, and there’s no private right of action.
How does TRAIGA interact with ABA 512 and Texas Opinion 705?
They work side by side. TRAIGA is a statute the Texas Attorney General enforces. ABA Formal Opinion 512 and Texas Opinion 705 are ethics guidance on your professional duties: competence, confidentiality, supervision, and fees. One AI inventory, an approved tool list, and a written policy help you answer all three.
What should a Houston firm do before rolling out Copilot or Claude?
Inventory the AI tools people already use, including unapproved ones. Then fix matter permissions so ethical walls hold, label client-confidential content, and write an AI acceptable use policy. Keep a one page record per tool. Our free AI Readiness Snapshot is a quick way to see where you stand.
