AI Regulation Guide · Texas
Texas TRAIGA: who's covered, what it requires
Texas TRAIGA carries 5 tracked obligations for companies in scope. This guide lists who is covered, the duty tiers, and every obligation with its deadline and statutory citation — all from Shieldra's versioned regulation pack, verified 2026-07-29.
By the Shieldra Compliance Team · Last updated 2026-07-29
Who does Texas TRAIGA apply to?
Out of scope only if: No Texas nexus reported. TRAIGA applies to persons who promote, advertise, or conduct business in Texas, produce a product or service used by Texas residents, or develop or deploy an AI system in Texas (Sec. 551.002).
- What is your role for this AI system?
- Do you promote, advertise, or conduct business in Texas; produce a product or service used by Texas residents; or develop or deploy an AI system in Texas?
- Are you a Texas governmental agency or acting on behalf of one?
- Does the system interact directly with consumers?
- Are you a health care provider or practitioner using the AI system in a patient's care or treatment?
- Is the system developed or deployed with the intent to unlawfully discriminate against a protected class?
- Is it developed or deployed in a manner that intentionally aims to incite or encourage a person to commit physical self-harm (including suicide), harm another person, or engage in criminal activity?
- Is the system developed or distributed with the sole intent of producing, or assisting or aiding in producing or distributing, child sexual abuse material (Penal Code §43.26) or unlawful sexually explicit deepfakes (Penal Code §21.165)?
- Is the system intentionally developed or distributed to engage in text-based conversations that simulate or describe sexual conduct while impersonating or imitating a child under 18?
- Is the system developed or deployed with the sole intent to infringe, restrict, or otherwise impair rights guaranteed under the United States Constitution?
- Is the system used to evaluate or classify people based on social behaviour or personal characteristics with the intent to assign a social score that leads to detrimental or disproportionate treatment?
- Does it identify individuals using biometric data gathered from publicly available sources without their consent?
- Do you run a documented internal review process AND substantially comply with the NIST AI Risk Management Framework: Generative AI Profile (or another nationally or internationally recognised risk framework)?
What are the duty tiers under Texas TRAIGA?
Prohibited practice (Bus. & Com. Code §§552.052–.057 (TRAIGA, HB 149))
Citation: Bus. & Com. Code §§552.052–.057 (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm
Social scoring and public-source biometric identification are prohibited for GOVERNMENT entities; the private sector is not covered by those two prohibitions. Every private-sector prohibition carries an intent element — 'intent' for discrimination and manipulation, 'intentionally' for text-based minor impersonation, and 'sole intent' (stricter still) for the CSAM/deepfake and constitutional-rights prohibitions. Flag for legal review, never auto-concluded. Insurers subject to unfair-discrimination statutes and federally insured financial institutions complying with banking laws have express carve-outs from the discrimination prohibition (§552.056).
Disclosure duties (Bus. & Com. Code §552.051 (TRAIGA, HB 149))
Citation: Bus. & Com. Code §552.051 (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm
In scope — general duties (TRAIGA (HB 149), Bus. & Com. Code chs. 551–552)
Citation: TRAIGA (HB 149), Bus. & Com. Code chs. 551–552 — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm
What are the obligations and deadlines under Texas TRAIGA?
| Obligation | Who | Deadline | Citation |
|---|
| Cease or redesign the prohibited practice | developer, deployer | in force since 1 January 2026 | Bus. & Com. Code §§552.052–.057, .105 (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm |
| Government agency: disclose AI interaction to consumers | deployer | in force since 1 January 2026 | Bus. & Com. Code §552.051(b) (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm |
| Health care provider: disclose AI use in care or treatment | deployer | in force since 1 January 2026 | Bus. & Com. Code §552.051(c) (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm |
| Run a documented internal review and red-team program (TRAIGA defense readiness) | developer, deployer | in force since 1 January 2026 | Bus. & Com. Code §552.105(e)(2) (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm |
| Maintain records to answer the AG and cure within 60 days | developer, deployer | in force since 1 January 2026 | Bus. & Com. Code §§552.104–.106 (TRAIGA, HB 149) — https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm |
What should you do about each obligation?
Cease or redesign the prohibited practice (Bus. & Com. Code §§552.052–.057, .105 (TRAIGA, HB 149))
The flagged use is prohibited. Stop, redesign, or obtain a documented legal opinion before Texas exposure. Penalty ranges (Sec. 552.105): $10,000–$12,000 per curable violation, $80,000–$200,000 per uncurable violation, and $2,000–$40,000 per day for continuing violations, plus injunctive relief and the AG's attorney's fees. The Texas Attorney General enforces (no private right of action), and on the AG's recommendation a state licensing agency may additionally suspend, probate, or revoke licences and impose penalties up to $100,000 (Sec. 552.106).
Government agency: disclose AI interaction to consumers (Bus. & Com. Code §552.051(b) (TRAIGA, HB 149))
Provide a clear and conspicuous disclosure that the consumer is interacting with an AI system, before or at the time of interaction.
Health care provider: disclose AI use in care or treatment (Bus. & Com. Code §552.051(c) (TRAIGA, HB 149))
Disclose to the patient (or their representative) that an AI system is used in relation to their health care service or treatment, no later than the date of the service, or as soon as reasonably possible in an emergency.
Run a documented internal review and red-team program (TRAIGA defense readiness) (Bus. & Com. Code §552.105(e)(2) (TRAIGA, HB 149))
The Sec. 552.105(e)(2) defense applies only if YOU discover a violation through a qualifying channel: user feedback, testing (including adversarial or red-team testing), applicable state-agency guidelines, or an internal review process — the last of which qualifies only if you substantially comply with the NIST AI Risk Management Framework: Generative AI Profile or another nationally or internationally recognised framework. Substantial NIST compliance alone is NOT a defense: if the AG finds the violation first, there is no (e)(2) shield. Run and document ongoing internal reviews and red-team exercises so violations are discovered through a qualifying channel, and keep the framework-compliance evidence current.
Maintain records to answer the AG and cure within 60 days (Bus. & Com. Code §§552.104–.106 (TRAIGA, HB 149))
The Texas Attorney General has exclusive enforcement authority with a 60-day notice-and-cure period; a complete, certified cure bars civil action for the noticed violation, and there is no private right of action. One exception: on the AG's recommendation after a finding, a state licensing agency may impose additional sanctions — licence suspension, probation, or revocation and monetary penalties up to $100,000 (Sec. 552.106) — which matters most for licensed practitioners. Keep system documentation, intent records, and remediation evidence organised so a cure can be executed and certified inside the window.
Disclaimer
Compliance guidance, not legal advice. Confirm obligations with counsel. Content version 2026.07.29-2, verified 2026-07-29.
Frequently asked questions
Who does Texas TRAIGA apply to?
No Texas nexus reported. TRAIGA applies to persons who promote, advertise, or conduct business in Texas, produce a product or service used by Texas residents, or develop or deploy an AI system in Texas (Sec. 551.002). Coverage turns on the screening questions listed on this page — each obligation then applies its own statutory gate.
When does Texas TRAIGA take effect?
in force since 1 January 2026
What are the obligations under Texas TRAIGA?
Cease or redesign the prohibited practice; Government agency: disclose AI interaction to consumers; Health care provider: disclose AI use in care or treatment; Run a documented internal review and red-team program (TRAIGA defense readiness); Maintain records to answer the AG and cure within 60 days.
