Texas Responsible AI Governance Act (TRAIGA / HB 149): AI Compliance Requirements

Ensure no AI system you develop or deploy is intentionally designed to: incite or encourage a person to commit physical self-harm (including suicide), to harm another, or to engage in criminal activity (§ 552.052 reaches a system that "intentionally aims to incite or encourage" those acts); infringe, restrict, or otherwise impair an individual's rights guaranteed under the United States Constitution where that is the system's SOLE intent (§ 552.055(a); § 552.055(b) makes the section remedial only and creates or expands no constitutional right); UNLAWFULLY discriminate against a protected class (§ 552.056(b) requires INTENT to unlawfully discriminate in violation of state or federal law, and § 552.056(c) states that "a disparate impact is not sufficient by itself to demonstrate an intent to discriminate"; "protected class" is defined at § 552.056(a)(3) and includes race, color, national origin, sex, age, religion, or disability); produce visual material in violation of Penal Code § 43.26 or deep fake videos or images in violation of Penal Code § 21.165 — where that is the system's sole intent — or intentionally develop or distribute a system that engages in text-based conversations simulating or describing sexual conduct while impersonating or imitating a child younger than 18 (§ 552.057). GOVERNMENTAL ENTITIES ONLY: assigning social scores based on social behavior or personal characteristics that cause detrimental treatment, disproportionate consequences, or infringement of constitutional rights (§ 552.053), and developing or deploying an AI system to uniquely identify a specific individual using biometric data, or to gather images or other media from the Internet or any other publicly available source (targeted or untargeted) without consent, where the gathering would infringe a right under the U.S. Constitution, the Texas Constitution, or state or federal law (§ 552.054(b)) — and § 552.054(c) provides that "a violation of Section 503.001 is a violation of this section."

Health care providers using AI in a patient's diagnosis or treatment must disclose that use to the patient (or the patient's personal representative) no later than the date the service or treatment is first provided — except in an emergency, where the disclosure must be made as soon as reasonably possible (§ 552.051(f)). The disclosure must be clear and conspicuous, written in plain language, and must not use a dark pattern (§ 552.051(d)); it may be provided by hyperlink (§ 552.051(e)).

Governmental agencies that make available an AI system intended to interact with consumers must disclose to each consumer, before or at the time of interaction, that the consumer is interacting with an AI system (§ 552.051(b)) — regardless of whether it would be obvious to a reasonable consumer (§ 552.051(c)). The disclosure must be clear and conspicuous, in plain language, and free of dark patterns (§ 552.051(d)).

TRAIGA (HB 149) also amended the Texas Capture or Use of Biometric Identifier Act (CUBI, Tex. Bus. & Com. Code §503.001), effective January 1, 2026. New §503.001(e)(2) exempts the training, processing, or storage of biometric identifiers involved in developing, training, evaluating, disseminating, or otherwise offering an AI model or system from CUBI's notice-and-consent and retention requirements — UNLESS the AI system is used or deployed for the purpose of uniquely identifying a specific individual, which revives full CUBI coverage. A parallel exemption (§503.001(e)(3)) covers developing or deploying an AI system to prevent, detect, protect against, or respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or other illegal activity. SNAP-BACK: if a biometric identifier captured under the AI-training exemption is later used for a commercial purpose, the possessor becomes subject to CUBI's existing possession-and-destruction duties and civil penalties (enforced exclusively by the Texas Attorney General; no private right of action). CONSENT CLARIFICATION: an individual is not deemed to have consented to the capture or storage of their biometric identifiers merely because an image or other media containing them is on the internet or otherwise publicly available, unless that individual themselves made it publicly available. Action: if you train or operate AI on biometric data (faces, voice, fingerprints) touching Texans, document whether each system is within the (e)(2)/(e)(3) exemptions or is used for unique identification, and apply CUBI possession/destruction controls to any biometric data repurposed for a commercial use.

Document your AI governance practices demonstrating that deployed AI systems comply with TRAIGA prohibitions, and maintain an internal review process. This is not a free-standing statutory mandate — its value is the statutory SAFE HARBOR: a defendant is not liable if it discovers a violation through feedback, adversarial/red-team testing, following applicable state-agency guidelines, or — where it substantially complies with the most recent NIST "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile" or another nationally/internationally recognized AI risk framework — an internal review process (§ 552.105(e)(2)). A separate limb of the same subsection bars liability where ANOTHER person uses the AI system affiliated with the defendant in a manner prohibited by the chapter (§ 552.105(e)(1)) — so contractual and technical controls over downstream use are themselves safe-harbor evidence. A defendant who believes in good faith it has not violated the chapter may also seek an expedited hearing or declaratory judgment (§ 552.105(d)). Keep the framework mapping and review records as safe-harbor evidence.

TRAIGA gives every alleged violator written AG notice and a 60-day cure window before any enforcement action (§ 552.104). To stop the action, within the 60 days you must BOTH cure the identified violation AND provide the AG a written statement that you cured it, with supporting documentation showing how, plus any internal-policy changes made to reasonably prevent recurrence (§ 552.104(b)). Establish that response workflow now: a designated owner, a documented complaint-response process, and evidence of AI system review. Note the statute does not pre-classify violations as curable or uncurable — a court makes that determination at the penalty stage (§ 552.105(a)).

TRAIGA gives the Texas Attorney General a civil investigative demand (CID) power that fires on a consumer complaint: if the AG receives a complaint through the online mechanism it must maintain under § 552.102, it may issue a CID to determine whether a violation has occurred (§ 552.103(a)). § 552.103(b) names exactly what the AG may request, and it is the practical documentation spec for any AI system touching Texans: (1) a high-level description of the purpose, intended use, deployment context, and associated benefits; (2) a description of the type of data used to program or train the system; (3) a high-level description of the categories of data processed as inputs; (4) a high-level description of the outputs produced; (5) any metrics used to evaluate performance; (6) any known limitations of the system; (7) a high-level description of post-deployment monitoring and user safeguards; and (8) any other relevant documentation reasonably necessary. Assemble and version these eight items per AI system now — the CID arrives on a complaint, and § 552.104's 60-day cure clock is a separate, later step that does not buy time to author them.