Direct answer: the Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149) was signed on 22 June 2025 and took effect on 1 January 2026. It applies to entities that promote/advertise or conduct business in Texas, produce products or services used by Texas residents, or develop/deploy AI in Texas. It is not an AI licensing regime: it combines intent-based prohibitions + Attorney General (AG) enforcement + a 60-day cure. Prohibited conduct includes intentionally using AI to incite self-harm, harm or crime; governmental social scoring; governmental biometric identification without consent; sole-intent infringement of constitutional rights; intentional unlawful discrimination; and illegal sexual content/deepfakes. Disclosure duties fall mainly on governmental agencies interacting with consumers and health care providers, not all businesses. Penalties: $10,000–$12,000 per curable violation; $80,000–$200,000 per uncurable violation; $2,000–$40,000 per day for continuing violations; state agencies may add up to $100,000 against licensees. The AG has exclusive enforcement, there is no private right of action, and a business that cures within 60 days with a written statement, evidence and policy changes can avoid suit.
This guide is for legal, compliance, security and product teams at companies selling or serving in the US, especially those using AI for customer service, content generation, hiring, credit, healthcare or biometrics. It breaks down TRAIGA's scope, six prohibited-conduct sections, disclosure duties, enforcement and penalties, defenses, and compares it with the EU AI Act and California SB 53, followed by a 90-day checklist. Facts come from the Texas Legislature's enrolled HB 149 text and bill history, the California Governor's press release and the European Commission's AI Act page (all accessed 9 November 2026). This is not legal advice.
(1) TRAIGA targets intentional/sole-intent harmful uses, not all AI through licensing or high-risk approval. (2) Most enterprises should start with an AI use-case inventory, intent evidence and vendor terms—not one blanket disclosure on every chatbot. (3) The 60-day cure is a real buffer, but only if you can locate, fix and document the issue.
Scope: who TRAIGA covers
TRAIGA applies to three categories: persons who promote, advertise or conduct business in Texas; persons who produce a product or service used by Texas residents; and persons who develop or deploy AI in Texas. Roles are split between a developer (develops AI offered, sold, leased, given or otherwise provided in Texas) and a deployer (deploys AI for use in Texas); a governmental entity means state or local administrative units, excluding hospital districts and higher-education institutions. TRAIGA preempts local AI ordinances, but cannot be construed to weaken free-speech or other rights, and does not authorize non-insurance agencies to regulate insurance.
| Dimension | TRAIGA rule | What to check |
|---|---|---|
| Covered persons | Business/advertising in Texas; products/services used by Texas residents; developing/deploying AI in Texas | Texas customers, employees, servers, training or inference |
| Roles | Developer: develops and provides AI in Texas; Deployer: deploys AI in Texas | In-house, purchased, API, white-label roles |
| Governmental entity | State/local administrative units; excludes hospital districts and higher education | Public-sector customers may have separate disclosure/scoring rules |
| State preemption | Preempts local AI ordinances | Do not treat local rules as the only standard |
| Boundaries | Cannot weaken free speech etc.; insurance regulation reserved | Financial/insurance/health have other federal/state rules |
Sources: Texas HB 149 (89R) enrolled text, Sec. 551.001–551.003 and 552.001–552.003; bill history shows signed 22 June 2025, effective 1 January 2026. Editorial summary; not legal advice.
Six prohibitions: most require intent/sole intent
The prohibitions sit in Sec. 552.052–552.057: intentionally using AI to incite self-harm, harm to others or crime; governmental social scoring; governmental biometric/public-image identification without consent; sole-intent infringement of US constitutional rights; intentional unlawful discrimination against a protected class; and illegal sexual content/deepfakes or child-impersonating sexual chat. Intent is the hinge: Sec. 552.056 states that disparate impact alone is not enough to show discriminatory intent, and insurance entities and federally insured financial institutions have compliance carve-outs.
| Section | Prohibited conduct | Intent/actor | Note |
|---|---|---|---|
| 552.052 | Manipulating AI to incite self-harm, harm or crime | Intentionally aims to incite/encourage; any person | Harmful output alone is not enough; must target incitement |
| 552.053 | Social scoring causing detrimental/disproportionate/rights-infringing treatment | Governmental entity | Commercial credit scoring is not this section |
| 552.054 | Biometric/public-image unique identification without consent | Governmental entity; CUBI violations also count | Private entities still face Texas 503.001 |
| 552.055 | Sole intent to infringe US constitutional rights | Any person; sole intent | Does not expand constitutional rights |
| 552.056 | Intentional unlawful discrimination against a protected class | Any person; intent | Disparate impact insufficient; insurance/bank carve-outs |
| 552.057 | Illegal sexual content/deepfakes; child-impersonating sexual chat | Sole intent or intentional; any person | Links to criminal provisions |
Source: Texas HB 149 Sec. 552.052–552.057. “Any person/governmental entity” is an editorial summary of the provision's actor scope; application depends on definitions and facts.
Disclosure: government agencies and health care, not all businesses
Sec. 552.051 is easy to misread. It requires a governmental agency whose AI interacts with consumers to disclose, before or at the time of interaction, that the consumer is interacting with AI—even if it would be obvious; the disclosure must be clear and conspicuous, in plain language, without dark patterns, and may use a hyperlink. Health care providers must disclose to the patient or representative by the first service/treatment, and in emergencies as soon as reasonably possible. TRAIGA itself does not impose a general “AI chatbot disclosure” duty on all private businesses, though other state/federal laws and platform policies may.
| Actor | Trigger | Timing/form |
|---|---|---|
| Governmental agency | AI system interacts with consumers | Before/at interaction; clear, conspicuous, plain language, no dark patterns; hyperlink allowed |
| Health care provider | AI used for health care service/treatment | At first service/treatment; emergencies as soon as reasonably possible |
| General private business | No general TRAIGA disclosure duty | Still check other laws, sector rules and contracts |
Source: Texas HB 149 Sec. 552.051. The “general private business” row is editorial interpretation, not statutory text; consult counsel.
Enforcement, penalties and the 60-day cure
The AG has exclusive enforcement (except state-agency discipline of licensees); consumers can complain via the AG's website. The AG may issue a civil investigative demand for the system's purpose, training data, inputs/outputs, evaluation metrics, known limitations and post-deployment monitoring. The AG must give written notice and may not sue before day 60; if the business cures within 60 days, submits a written statement, supporting evidence and policy changes, no action follows. Penalties are per violation: $10,000–$12,000 for curable violations or breach of a submitted statement; $80,000–$200,000 for uncurable violations; $2,000–$40,000 per day for continuing violations; the AG can also seek injunctions, attorney's fees and investigative costs. State agencies may suspend/revoke licenses or impose up to $100,000.
| Stage | Rule | Business action |
|---|---|---|
| Enforcer | AG exclusive; no private right; state agencies may discipline licensees | Name one regulatory owner and complaint-response process |
| Investigation | CID may require purpose, data, inputs/outputs, metrics, limits, monitoring | Keep AI inventory, model cards, evaluations, monitoring logs |
| 60-day cure | No suit before day 60; cure + statement + evidence + policy changes | Build locate–fix–document–reply workflow |
| Penalties | $10k–$12k curable/statement breach; $80k–$200k uncurable; $2k–$40k/day continuing | Estimate per-violation exposure; prioritize uncurable scenarios |
| State agencies | License suspension/probation/revocation + up to $100k | Regulated sectors should check sector law too |
| Defenses | Another person's misuse; discovery via feedback/testing/guidance/framework internal review; not deployed; reasonable-care presumption | Make testing, feedback and internal review provable |
Source: Texas HB 149 Sec. 552.101–552.106. Penalty ranges are per violation/day and subject to court/agency discretion; editorial summary.
How it differs from the EU AI Act and California SB 53
The three regimes use different levers. TRAIGA is intent-based prohibitions + AG enforcement + 60-day cure: broad reach, narrow provisions. The EU AI Act is risk-based (unacceptable/high/limited/minimal), with prohibited practices, GPAI rules, high-risk conformity and transparency duties; prohibitions applied from February 2025, GPAI from August 2025, main application/enforcement from August 2026. California SB 53 (TFAIA) focuses on frontier developers: large frontier developers must publish a framework, report critical safety incidents, protect whistleblowers, with AG civil enforcement. For many Chinese companies, TRAIGA's “doing business in Texas/serving Texas residents” trigger may be more direct than the EU AI Act, but the obligations are narrower and turn more on intent evidence.
| Dimension | Texas TRAIGA | EU AI Act | California SB 53 |
|---|---|---|---|
| Approach | Intent-based prohibitions + AG enforcement | Risk tiers + high-risk/GPAI duties | Frontier-developer transparency + incident reporting |
| Main subjects | Business in Texas/serving residents/developing or deploying AI | Providers/deployers in the EU market, with extraterritorial effect | Large frontier developers |
| Disclosure | Government agencies, health care | Chatbots, AI content, high-risk | Public frontier framework |
| Enforcement | AG; no private right; 60-day cure | AI Office/member authorities; fines/corrective orders | AG civil penalties |
| Timing | Effective 1 January 2026 | Prohibitions Feb 2025; GPAI Aug 2025; main application Aug 2026 | Signed 29 September 2025 |
Sources: Texas HB 149; European Commission AI Act page (9 November 2026); California Governor press release (29 September 2025). EU/California rows are editorial summaries; specific duties follow statutes and official guidance; SB 53 phase-in dates are not elaborated in the press release.
Compliance cost drivers: where the budget goes
TRAIGA does not charge per AI system, but compliance is real and resembles “evidence engineering,” not a licence application. Main drivers: (1) legal/external counsel for use-case mapping and interpretation; (2) an AI inventory and data flow (models, vendors, inputs/outputs, deployment locations); (3) vendor contracts and responsibility allocation (who is developer/deployer, indemnity, audit rights); (4) disclosure UI/copy for government/health-care customers; (5) testing/red-teaming and alignment with the NIST AI RMF Generative AI Profile; (6) training, recordkeeping, complaint/CID response and a 60-day cure drill; (7) monitoring and annual review. There is no public uniform “TRAIGA certification fee”; do not budget around a certification program.
90-day checklist
Work the loop “inventory → classify → contracts → test → drill → review.” Weeks 1-2: inventory AI systems, vendors and Texas touchpoints; weeks 2-4: classify against Sec. 552.052–057 and flag government/health-care disclosures; weeks 4-6: update vendor terms, DPAs, liability and audit rights; weeks 6-8: testing/red-teaming, NIST framework gap assessment and evidence archiving; weeks 8-10: training, complaint/CID/60-day cure playbook; weeks 10-12: internal audit, management sign-off and monitoring. The goal is not to buy an “AI compliance tool,” but to prove you knew the risks, took reasonable steps and fix issues when found.
| Phase | Action | Output |
|---|---|---|
| Weeks 1-2 | Inventory AI systems/vendors/Texas touchpoints | AI inventory, data flow, role map |
| Weeks 2-4 | Classify against six prohibitions; flag disclosures | Risk tiers, disclosure list |
| Weeks 4-6 | Vendor contracts, DPAs, indemnity/audit rights | Contract remediation list |
| Weeks 6-8 | Testing/red team, NIST gap, evidence archive | Test report, gap list |
| Weeks 8-10 | Training, complaint/CID/60-day cure drill | Response playbook, drill record |
| Weeks 10-12 | Internal audit, management sign-off, metrics | Compliance memo, monitoring dashboard |
Editorial readiness advice, not legal advice or an official template; scope/evidence follow counsel and AG practice.
FAQ
When did TRAIGA take effect?
Signed by the Texas Governor on 22 June 2025 and effective 1 January 2026 (HB 149 Sec. 10; the bill history shows “Effective on 1/1/26”).
Which companies are covered?
Those promoting/advertising or conducting business in Texas, producing products/services used by Texas residents, or developing/deploying AI in Texas. Serving Texas residents with an AI product can fall in scope even if the company is not based in Texas.
Must every AI chatbot disclose?
No. The general disclosure provision targets governmental agencies interacting with consumers and health care providers; private businesses do not have the same general duty under TRAIGA, though other laws, sector rules and contracts may require disclosure.
What are the penalties?
$10,000–$12,000 per curable violation or breach of a submitted statement; $80,000–$200,000 per uncurable violation; $2,000–$40,000 per day for continuing violations; state agencies may add up to $100,000 against licensees. Courts/agencies have discretion.
Is there a private right of action?
No. TRAIGA expressly provides no private right of action; the AG has exclusive enforcement, except state-agency discipline of licensees. Other laws (consumer protection, civil rights, privacy) may still create claims.
How does the 60-day cure work?
The AG gives written notice identifying the provisions; no suit before day 60. If the business cures, submits a written statement, supporting evidence and policy changes, no action follows. Speed of locating, fixing and documenting is the point.
Does using the NIST AI RMF create immunity?
No blanket immunity. The statute provides a defense where the defendant discovers the violation through feedback, testing, guidance, or an internal review process conducted in substantial compliance with the NIST Generative AI Profile or another recognized framework. Facts and evidence still matter.
How is it different from the EU AI Act?
TRAIGA is narrow intent-based prohibitions + AG enforcement + cure; the EU AI Act is risk-based with high-risk/GPAI documentation, conformity, transparency and market surveillance. The EU regime is broader and more prescriptive.
Research method and limitations
This article relies primarily on the Texas Legislature's enrolled HB 149 (89R), checking scope, prohibitions, disclosure, enforcement, penalties and defenses section by section; the effective date follows the bill history (“Effective on 1/1/26”) and Sec. 10. California SB 53 information comes from the California Governor's 29 September 2025 press release and was not checked against the bill text. EU AI Act timing and risk tiers come from the European Commission's official page (9 November 2026). This is not legal advice, and it does not assess specific enforcement cases, court interpretations or AG priorities; overlapping state/federal/sector laws require counsel and facts.
Sources and basis
- Texas Legislature, HB 149 (89R) enrolled text: capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm. Sec. 551–552, penalties and effective-date clause. Accessed 9 November 2026.
- Texas Legislature, HB 149 History: capitol.texas.gov/BillLookup/History.aspx?LegSess=89R&Bill=HB149. Signed 22 June 2025; Effective on 1/1/26. Accessed 9 November 2026.
- Office of the Governor of California, “Governor Newsom signs SB 53…”: gov.ca.gov/2025/09/29/.... Frontier developers, framework, incident reporting, whistleblowers, AG enforcement. Accessed 9 November 2026.
- European Commission, AI Act regulatory framework: digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai. Risk tiers, GPAI, timeline, enforcement. Accessed 9 November 2026.
Data cut-off 9 November 2026; legal application follows statutes, court interpretations and counsel; this is not legal, compliance or commercial advice.