Texas TRAIGA: what enterprises operating in Texas need to know

The Texas Responsible Artificial Intelligence Governance Act, usually shortened to TRAIGA, is now in force. It was enacted as House Bill 149, signed in June 2025 and took effect on January 1, 2026. For any enterprise that builds, buys or uses AI in ways that touch people in Texas, it belongs on the compliance agenda.

As a firm headquartered in Dallas, we hear two opposite reactions to it. Some executives assume it is a Texas version of the EU AI Act and brace for heavy new obligations. Others assume it only applies to state agencies and set it aside. Neither is right. TRAIGA is narrower than many people expect for private companies, but it still creates real exposure, and the way you prepare for it is the same discipline that good AI governance requires anyway.

What the law does, in brief

TRAIGA takes an intent-based approach. Rather than sorting AI systems into risk categories with a long list of obligations for each, it focuses on prohibiting specific harmful uses and places additional duties on government. The main elements are:

• Prohibited purposes. It prohibits developing or deploying AI with the intent to cause certain harms. Examples include manipulating people to harm themselves or others or to engage in criminal activity, unlawfully discriminating against protected classes, and producing certain unlawful sexual content.
• Duties on government entities. State and local government bodies carry additional obligations, such as disclosing to people when they are interacting with AI, and a ban on using AI for social scoring.
• Healthcare disclosure. Where AI is used in connection with healthcare services, there is a duty to disclose that use to patients.
• A regulatory sandbox. Qualifying organizations can test AI systems under a state-run program with some relief from certain requirements during the test period.
• A Texas AI council. The law creates a council to advise the state on AI policy, ethics and oversight.

The emphasis on intent matters. For most private enterprises, the core question is not whether a system falls into a regulated category, but whether you can show what a system was designed and deployed to do, and that you took reasonable steps to prevent it from doing harm.

Who it affects

TRAIGA applies broadly to organizations that develop or deploy AI systems in Texas, offer products or services used by Texas residents, or conduct business in the state. In practice, that captures most national enterprises, not only those with a Texas headquarters or office.

The heaviest specific duties, such as general disclosure of AI interactions and the social scoring ban, fall on government entities. Private companies are mainly affected in three ways:

1. The prohibitions on intentionally harmful uses apply to them.
2. Healthcare providers and others delivering healthcare services have a disclosure duty.
3. Companies that sell AI to Texas public-sector clients will find those clients passing their own obligations down through contracts and procurement requirements.

Financial services firms should pay particular attention to the discrimination provisions. Credit, underwriting, fraud and collections models already sit under federal fair lending and consumer protection rules. TRAIGA adds a state enforcement angle, and the quality of your documentation will shape how any inquiry goes. Whether a specific use case is covered is a legal question, so consult counsel on the specifics.

How enforcement works

Enforcement is the part of TRAIGA that most shapes how you should prepare.

• The Attorney General only. The Texas Attorney General has exclusive enforcement authority. There is no private right of action, so individuals cannot sue under the Act itself.
• Notice and cure. Before bringing an enforcement action, the Attorney General must give notice of the alleged violation, followed by a 60-day period in which the organization can cure it.
• Scaled penalties. Civil penalties are higher for violations that cannot be cured, or that continue after the cure period, than for those that can be.
• Recognized frameworks count. Substantially complying with a recognized AI risk management framework, such as the NIST AI Risk Management Framework, is relevant to the defenses available to an organization.

Taken together, these features reward organizations that can respond quickly and credibly. If a notice arrives, you have a limited window to understand the system in question, show what it was intended to do, fix any problem and document the fix. That is very hard to do from a standing start.

Practical steps to prepare

None of the following is exotic. It is the foundation of a sound AI governance program, pointed at the specific shape of TRAIGA.

1. Inventory AI uses that touch Texans. Build or update a register of AI systems, including vendor tools and embedded AI features in business software, and flag those that affect Texas residents, customers or employees. Without an inventory, a 60-day cure period is not realistic.
2. Document intent and testing. For each material system, record its intended purpose, the decisions it supports and the limits on its use. Keep records of pre-deployment testing, including bias and misuse testing. Under an intent-based law, contemporaneous documentation is your best evidence.
3. Align to the NIST AI RMF. Map your policies and controls to the framework’s Govern, Map, Measure and Manage functions. This supports the defenses the law recognizes and gives you a structure that other regulators and auditors understand.
4. Make disclosures where required. Confirm whether any of your activities trigger a disclosure duty, particularly in healthcare or in work for government clients, and put clear, consistent notices in place.
5. Monitor systems in production. Models drift and uses expand. Set up monitoring for performance, outcomes across groups and signs of misuse, with named owners who review the results.
6. Build a cure-ready incident process. Define who receives a regulator notice, how the affected system is identified and assessed, who can authorize a fix, and how the remediation is documented. Rehearse it once before you need it.
7. Track other state laws. Texas is one of several states legislating on AI. Colorado’s AI Act takes a different, risk-based approach, and other states are active. Build a single multi-state program with a common control set rather than a separate project for each law.

Where TRAIGA fits in a broader program

It would be a mistake to treat TRAIGA as a standalone compliance project. The inventory, documentation, testing and monitoring it rewards are the same capabilities you need for sector regulators, customer due diligence, the EU AI Act if you operate in Europe, and certification against ISO/IEC 42001 if you choose to pursue it.

The most efficient path is to anchor your program on one framework, typically the NIST AI RMF for US-first enterprises, and map each new law to it. When a new requirement appears, you then assess the gap against controls you already operate, rather than starting again.

The sandbox is also worth a look for organizations developing novel AI products. It is not a substitute for governance, but it can provide room to test responsibly while engaging with the state.

This article is general information, not legal or regulatory advice.