Status at a glance
HB 149 passed the Texas House 146 to 3 on April 23, 2025, and the Senate 31 to 0 on May 23, 2025, according to the certification on the enrolled bill. The House concurred in Senate amendments 121 to 17 on May 30, 2025. The bill history records that Governor Greg Abbott signed it on June 22, 2025, and that it took effect on January 1, 2026.
As of November 9, 2026, TRAIGA is in force and no amendment to it has been enacted. The statute required the attorney general to post a consumer complaint mechanism online by September 1, 2026 (Section 8 of the enrolled text). A September 2026 research note from the Cloud Security Alliance reports that the attorney general activated that mechanism on September 1, 2026. We have not found a reported enforcement action under TRAIGA as of this date.
What is TRAIGA?
TRAIGA adds new chapters to the Texas Business and Commerce Code: Chapter 551 (definitions and scope), Chapter 552 (prohibited uses and enforcement), Chapter 553 (a regulatory sandbox) and Chapter 554 (the Texas Artificial Intelligence Council). The enrolled text defines an artificial intelligence system as any machine-based system that infers from its inputs how to generate outputs, including content, decisions, predictions or recommendations, that can influence physical or virtual environments.
The law is narrower than Colorado's 2024 AI Act. It does not require impact assessments, risk management programs or developer disclosures to deployers. Instead it names specific practices that are unlawful, and most of them turn on intent. Section 552.056 states that disparate impact is not enough on its own to show an intent to discriminate, a choice that separates TRAIGA from the reasonable-care duty against algorithmic discrimination that Colorado wrote into SB 24-205.
Section 552.003 also preempts local rules: the chapter supersedes any ordinance, resolution, rule or other regulation adopted by a political subdivision on the use of AI systems. Cities and counties in Texas therefore cannot add their own AI rules on top of the state framework.
What TRAIGA bans
Subchapter B of Chapter 552 sets out the duties and prohibitions. Read from the enrolled text, they are:
- Manipulation of human behavior (Sec. 552.052). No person may develop or deploy an AI system in a manner that intentionally aims to incite or encourage a person to commit physical self-harm, including suicide, to harm another person, or to engage in criminal activity.
- Social scoring by government (Sec. 552.053). A governmental entity may not use AI to assign a social score to people based on behavior or personal characteristics where the result is detrimental or disproportionate treatment or the infringement of a legal right.
- Biometric identification by government (Sec. 552.054). A governmental entity may not use AI to uniquely identify a person from biometric data, or from images scraped from public sources, without consent where doing so would infringe that person's legal rights.
- Constitutional rights (Sec. 552.055). No person may develop or deploy an AI system with the sole intent of infringing, restricting or impairing rights guaranteed by the U.S. Constitution.
- Unlawful discrimination (Sec. 552.056). No person may develop or deploy an AI system with the intent to unlawfully discriminate against a protected class. Disparate impact alone does not prove intent. Regulated insurers and federally insured financial institutions that comply with their own regimes are treated separately.
- Sexual content involving minors and deepfakes (Sec. 552.057). No person may develop or distribute an AI system with the sole intent of producing child sexual abuse material or deepfake material that violates Penal Code Section 21.165, or intentionally build a system that engages in sexual text conversations while impersonating a child under 18.
Disclosure duties
Section 552.051 requires a governmental agency that offers an AI system intended to interact with consumers to disclose, before or at the time of interaction, that the consumer is dealing with AI. The disclosure must be clear, conspicuous and in plain language, may not use a dark pattern, and is required even if the AI nature would be obvious. A licensed health care provider using AI in a patient's service or treatment must give the same disclosure no later than the date care is first provided, except in emergencies. Private businesses outside health care carry no general AI disclosure duty under TRAIGA.
Who TRAIGA applies to
Section 551.002 of the enrolled text makes the subtitle apply to any person who promotes, advertises or conducts business in Texas; produces a product or service used by Texas residents; or develops or deploys an AI system in Texas. A developer is a person who develops an AI system offered or provided in Texas; a deployer is a person who deploys one for use in Texas. There is no revenue, user count or compute threshold.
The consumer protections are limited by definition. A consumer is a Texas resident acting in an individual or household context, and the definition excludes people acting in a commercial or employment context. Several prohibitions (social scoring, biometric identification, the AI disclosure duty) bind only governmental entities, while the incitement, constitutional rights, discrimination and sexual content bans apply to any person.
Effective date
Section 10 of HB 149 states that the Act takes effect January 1, 2026, and the Texas Legislature bill history lists the same date. Two later deadlines run from the statute itself: the attorney general had until September 1, 2026, to post the complaint mechanism and related information online, and sandbox participants may test for up to 36 months once admitted.
Unlike California's SB 53 or the Colorado replacement law, TRAIGA has no phase-in for particular duties after January 1, 2026. Every prohibition in Chapter 552 has applied since that date.
Enforcement and penalties
The attorney general has exclusive authority to enforce Chapter 552, and the chapter expressly creates no private right of action (Sec. 552.101 of the enrolled text). Consumers file complaints through the attorney general's online mechanism. A complaint allows, but does not require, the attorney general to issue a civil investigative demand, which can seek a description of the system's purpose, training data categories, inputs and outputs, performance metrics, known limitations and post-deployment safeguards.
Notice and cure
Before suing, the attorney general must give written notice identifying the provisions allegedly violated. No action may be filed before the 60th day after notice, or at all if within that window the person cures the violation and submits a written statement with supporting documentation and any policy changes (Sec. 552.104).
Civil penalties
Section 552.105 sets three bands: not less than $10,000 and not more than $12,000 for each violation a court finds curable or for breach of a cure statement; not less than $80,000 and not more than $200,000 for each uncurable violation; and not less than $2,000 and not more than $40,000 for each day a violation continues. The attorney general may also seek an injunction and recover fees and investigative costs. The statute creates a rebuttable presumption that a person used reasonable care, and offers defenses for violations found through red-team testing or internal review processes, including substantial compliance with NIST's Generative AI Profile of the AI Risk Management Framework. No penalty action may be brought over a system that has not been deployed.
Licensing agencies may add sanctions, including license suspension or revocation and a monetary penalty of up to $100,000, but only after a court finding under Section 552.105 and on the attorney general's recommendation (Sec. 552.106).
The sandbox and the council
Chapter 553 directs the Texas Department of Information Resources, with the council, to run a regulatory sandbox in which an approved participant may test an AI system for up to 36 months without a state license otherwise required, and the attorney general may not pursue charges for waived laws during the test. Participants file quarterly reports. Chapter 554 creates a seven-member Texas Artificial Intelligence Council (three members appointed by the governor, two by the lieutenant governor and two by the speaker) that can report to the legislature and train state agencies, but has no rulemaking power over private parties.
Other Texas AI laws
TRAIGA was one of several AI measures from the 89th Legislature. A Jackson Walker summary of the session lists, among others, SB 1964, which sets an AI code of ethics and minimum standards for state agencies and local governments using AI in decisions that affect people's rights or benefits, and SB 441, which targets sexually explicit deepfakes. TRAIGA's deepfake prohibition cross-references Penal Code Section 21.165, so the criminal deepfake statute and the AI-system ban operate together.
For how Texas compares with other states, the legislation hub tracks state and federal measures, and our analysis of detection mandates covers disclosure and labeling duties that Texas largely chose not to impose on private companies.
TRAIGA has applied in Texas since January 1, 2026, but it bans only a short list of intentional AI uses, such as inciting self-harm or crime, unlawful discrimination and producing child sexual abuse material or unlawful sexual deepfakes. Only the attorney general can enforce it, after a 60-day cure notice, and there is no private right of action. Uncurable violations cost $80,000 to $200,000 each.
What changed
- 2026-09-01: Statutory deadline for the attorney general to post the TRAIGA complaint mechanism; the Cloud Security Alliance reports it went live that day.
- 2026-01-01: TRAIGA took effect.
- 2025-06-22: Gov. Greg Abbott signed HB 149.
- 2025-05-30: House concurred in Senate amendments, 121 to 17.
- 2025-05-23: Senate passed HB 149 with amendments, 31 to 0.
Frequently asked questions
What is the Texas Responsible AI Governance Act?
TRAIGA (HB 149) is a Texas statute that bans a short list of intentional harmful AI uses, limits government use of AI for social scoring and biometric identification, requires government agencies and health care providers to disclose AI interactions, and creates a regulatory sandbox and an AI council.
When does TRAIGA take effect?
TRAIGA took effect on January 1, 2026, under Section 10 of HB 149, and every prohibition has applied since that date. The attorney general had until September 1, 2026, to put the online consumer complaint mechanism in place, and sandbox tests can run up to 36 months.
What are the penalties under TRAIGA?
After a 60-day notice and cure period, courts may impose $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for continuing violations, plus injunctions and costs.
Who enforces the Texas AI law?
The Texas Attorney General has exclusive enforcement authority. There is no private right of action. Licensing agencies can add sanctions only after a court finding and an attorney general recommendation.
Sources
- Texas Legislature Online: HB 149 enrolled text
- Texas Legislature Online: HB 149 bill history
- Cloud Security Alliance: TRAIGA complaint portal research note (Sept. 13, 2026)
- Jackson Walker: Texas 89th Legislature key AI legislation
This page is journalism and commentary, not legal advice. AI law changes quickly; check the primary sources above and consult qualified counsel for your situation.