Last reviewed
Sources
No citations yet
Review status
Needs citations
Revision
v3 ยท 4,461 words
Add missing citations, update stale details, or suggest a clearer explanation.
The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), enacted as House Bill 149 of the 89th Texas Legislature, Regular Session, is a state statute that establishes the first comprehensive artificial intelligence governance framework in Texas. The bill was authored by Representative Giovanni Capriglione (R-Southlake) and sponsored in the Senate by Senator Charles Schwertner (R-Georgetown).[1][2] Governor Greg Abbott signed HB 149 into law on June 22, 2025, and its substantive provisions took effect on January 1, 2026.[1][3]
TRAIGA prohibits the intentional development or deployment of AI systems for narrowly defined harmful purposes, including unlawful discrimination against protected classes, behavioral manipulation that incites self-harm or criminal activity, the production of child sexual abuse material or unlawful deepfakes, and government use of AI for social scoring or unconsented biometric identification. It also creates the Texas Artificial Intelligence Advisory Council, an AI Regulatory Sandbox Program administered by the Texas Department of Information Resources, and assigns exclusive enforcement authority to the Texas Attorney General, with civil penalties of up to $200,000 per uncurable violation and no private right of action.[4][5][6]
With its enactment, Texas became the third U.S. state, after Colorado and Utah, to adopt comprehensive AI legislation, and the law is widely characterized by legal commentators as substantially more "innovation-friendly" than the Colorado AI Act on which an earlier draft was modeled.[4][7][8] The enacted version is a dramatically pared-back successor to a 2024 draft (HB 1709) that would have imposed European Union-style risk-based regulation on private developers and deployers of "high-risk" AI systems. After sustained pressure from technology trade associations and a shift in the federal political environment following the 2024 elections, most private-sector obligations, including impact assessments, risk management policies, and consumer disclosure mandates, were stripped from the bill before passage.[7][9][10]
Texas's interest in regulating AI emerged against the backdrop of accelerating state-level legislative activity following the slow pace of federal action through 2024 and 2025. Colorado had enacted Senate Bill 24-205 (the Colorado AI Act) in May 2024, becoming the first U.S. state to adopt comprehensive AI legislation regulating algorithmic discrimination in consequential decisions.[7][8] The EU AI Act, which entered into force in August 2024, offered a risk-tiered framework that influenced numerous state-level proposals in the United States, including the original Texas effort.[7][11]
Representative Capriglione, who had previously authored the Texas Data Privacy and Security Act, positioned himself as the principal legislative architect of Texas's AI policy. In statements supporting the bill, he argued that "by balancing innovation with public interest, we aim to create a blueprint for responsible AI use that other states and nations can follow."[12] Capriglione co-chaired the Texas House Select Committee on Artificial Intelligence, which produced findings that informed the original December 2024 draft of TRAIGA.[9]
The legislative environment shifted sharply between the introduction of the original bill in late 2024 and its passage in mid-2025. The November 2024 federal elections produced a Republican trifecta in Washington and were widely interpreted as a mandate for lighter-touch AI regulation aligned with the technology industry's preferences.[10][13] During this period, the U.S. Senate considered and ultimately rejected by a 99-1 vote in July 2025 a proposed 10-year federal moratorium on state AI laws that had been incorporated into reconciliation legislation passed by the House in May 2025.[11][13] TRAIGA was drafted, revised, and signed during this period of acute uncertainty about whether state-level AI legislation would even remain enforceable.
The original Texas Responsible AI Governance Act was filed as House Bill 1709 in December 2024 by Representative Capriglione.[9][14] The 43-page draft was modeled closely on the Colorado AI Act and the EU AI Act, and would have imposed comprehensive obligations on both developers and deployers of "high-risk" AI systems, defined as systems that play a "substantial factor" in consequential decisions in domains such as employment, healthcare, financial services, housing, and education.[7][9]
Key features of the December 2024 draft included:
The original draft attracted intense opposition from technology trade associations, business groups, and several legal commentators who argued the framework was overbroad, would chill innovation, and would impose Colorado-style compliance burdens that the industry had opposed in that jurisdiction.[9][10] A Bloomberg Law analysis published in early 2025 argued the bill "threatens innovation and economic growth," and the Fortune publication characterized HB 1709 as the "next battleground for U.S. AI policy."[14]
Capriglione responded to the criticism by redrafting the bill. The Transparency Coalition, a public-interest group tracking the legislation, reported that the author "adjusted accordingly after February blowback, removing many of TRAIGA's most substantial requirements."[9] On March 14, 2025, the substantially narrowed successor bill was filed as House Bill 149, now 31 pages in length.[9][15]
HB 149 was assigned to the House Committee on Delivery of Government Efficiency, where it was reported favorably out of committee by a 13-0 vote. The Senate companion process took place in the Senate Business & Commerce Committee, which reported the bill out 11-0.[1] The legislature passed HB 149 on May 31, 2025, and Governor Abbott signed it on June 22, 2025.[3][4][16] The effective date was set as January 1, 2026.[1][4]
Legal analyses consistently describe the transition from HB 1709 to HB 149 as one of the most dramatic substantive narrowings of any major AI legislation under active consideration in the United States. K&L Gates characterized the enacted text as a "pared-back" version of the original.[10] Specific changes documented in published comparative analyses include:
The statute defines an "artificial intelligence system" as "any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments."[4][6] This definition is intentionally broad and technology-neutral, encompassing generative AI, predictive systems, recommender algorithms, autonomous-vehicle controllers, and biometric identification systems.[17]
A "developer" is defined as a person who creates an AI system that is offered, sold, leased, or otherwise provided in Texas, and a "deployer" is defined as a person who puts an AI system into service or use within the state.[6] A "consumer" is defined narrowly as a Texas resident "acting in an individual or household context," with explicit exclusion of employment and commercial contexts.[5][6]
The statute defines a "governmental entity" as a Texas state department, board, agency, or instrumentality exercising state functions, and excludes hospitals operated by political subdivisions and institutions of higher education from that definition.[4][5]
TRAIGA's substantive prohibitions are organized around specific harms rather than broad risk categories. Each prohibition incorporates an intent element. The prohibited uses applicable to both public and private entities are:[4][5][15]
The discrimination prohibition includes notable carve-outs for insurers complying with Texas insurance regulatory authority and for federally insured financial institutions complying with applicable banking law.[5][15]
Provisions applicable to governmental entities are more stringent than those applicable to private actors. Texas governmental entities are subject to all of the general prohibitions above and additionally must:
The statute requires the Texas Department of Information Resources (DIR) to assess state agencies' AI system usage and requires the Sunset Advisory Commission to evaluate AI deployment and oversight as part of its review process.[6]
TRAIGA imposes specific disclosure obligations on healthcare providers, which are also reinforced by companion legislation Senate Bill 1188 enacted in the same session.[5][16] When a healthcare provider uses an AI system in the provision of services or treatment to a patient, the provider must clearly and conspicuously disclose its use of the AI system to the patient or the patient's personal representative. In clinical settings, the disclosure must be made before or at the time of the interaction, except in emergencies, in which case the disclosure must be provided "as soon as reasonably possible."[4][15][16] Disclosures may be incorporated into intake documents or treatment consent forms.[15]
In addition to restricting governmental use of biometric identification, TRAIGA amends Texas's preexisting Capture or Use of Biometric Identifier (CUBI) statute. The amendments create two new exemptions to the underlying biometric consent regime:[15][16]
The amendments also clarify that the mere fact that biometric-containing imagery is publicly available does not constitute consent for biometric capture, unless the individual themselves made it public. Financial institutions using voice prints in customer authentication are also addressed by specific carve-outs.[16]
HB 149 creates the Texas Artificial Intelligence Advisory Council (sometimes abbreviated TAIAC), an independent body administratively attached to the Department of Information Resources.[5][6][16] The committee-substitute bill analysis describes a council of seven appointed members with staggered four-year terms.[4][6][16] Appointments are made by the Governor, the Lieutenant Governor, and the Speaker of the House of Representatives.[4][5][16]
Council members must be Texas residents with expertise in one or more of the following areas: AI systems, data privacy and security, technology ethics or law, public policy, risk management, governmental efficiency, or anticompetitive practices.[6]
The Council's authorized functions include:[4][5][6]
The statute expressly prohibits the Council from promulgating binding rules or regulations and from interfering with the operations of executive-branch agencies.[4][6][16] This limitation distinguishes the Texas Council from regulatory authorities created in some other jurisdictions and reinforces the Texas legislature's preference for centralized enforcement through the Office of the Attorney General.
Among the most innovation-oriented features of TRAIGA is the AI Regulatory Sandbox Program, administered by the Department of Information Resources.[4][5][6] The program permits qualifying participants to test AI systems for up to 36 months in a controlled environment, with the possibility of extension, while obtaining temporary waivers from certain Texas licensing and regulatory requirements that would otherwise apply.[4][5][6][16]
Sandbox applicants must submit:[6][15][16]
Participants must file quarterly reports with DIR detailing performance metrics, risk mitigation activities, and stakeholder feedback.[4][15][16] The Department of Information Resources may terminate participation in the sandbox upon a finding of undue risk or violation of applicable law.[4][15]
During approved participation, the Texas Attorney General is prohibited from filing or pursuing charges against a sandbox participant for violations of waived laws, and state licensing agencies may not impose punitive action with respect to the waived requirements.[15][16] Importantly, the core TRAIGA prohibitions are not subject to waiver through sandbox participation: a participant remains liable for prohibited conduct such as intentional discrimination, behavioral manipulation, or production of child sexual abuse material.[5][15]
The Texas Attorney General is the sole authority empowered to enforce TRAIGA. There is no private right of action under the statute.[4][5][6][16] Members of the public may file complaints through an online complaint intake system that the Attorney General is required to maintain.[6][16]
The Attorney General may issue civil investigative demands seeking information such as system descriptions, training data, model outputs, known limitations, and monitoring practices.[6] Before pursuing an enforcement action, the Attorney General must provide written notice of the alleged violation and afford a 60-day cure period during which the alleged violator may remediate the violation.[4][5][6][15]
The statute prescribes civil penalty ranges varying with the type of violation:[4][5][6][15]
| Violation type | Penalty per violation |
|---|---|
| Curable violations (uncured after notice) | $10,000-$12,000 |
| Uncurable violations | $80,000-$200,000 |
| Continuing violations | $2,000-$40,000 per day |
State agencies whose AI use violates the statute may face licensing and certification sanctions, with fines of up to $100,000 when recommended by the Attorney General.[6][16]
A defendant may avoid liability where the conduct giving rise to the violation was discovered through:[4][5][15][16]
The statute provides a rebuttable presumption that an entity exercised reasonable care, which the Attorney General must overcome in order to establish a violation.[16] These provisions are widely viewed as creating a meaningful incentive to adopt the NIST framework as a compliance baseline.[4][7][15]
TRAIGA contains a number of carve-outs that limit the practical scope of its prohibitions. The most significant include:
The statute does not contain explicit exemptions for non-commercial open-source development or for research and development. The Texas Policy Research organization recommended that lawmakers strengthen open-source protections through a dedicated exemption for non-commercial open-source AI developers, but no such carve-out was added to the enacted text.[18] Some commentators argue that the intent-based nature of the prohibitions effectively shields good-faith open-source and research activity from liability, although this protection is doctrinal rather than statutory.[15]
A notable feature of TRAIGA is its express preemption of local AI regulation. The statute provides that any city, county, or other political subdivision ordinance regulating AI is nullified, establishing statewide regulatory uniformity.[7][15] This provision parallels Texas's general approach to preempting local regulation in other policy domains, and is one of the structural features that distinguishes the Texas regime from California's, where local jurisdictions retain greater authority over AI-related issues.[15]
Industry response to the enacted version of TRAIGA was substantially more favorable than to the original HB 1709. Major technology trade associations had opposed the December 2024 draft, and the revisions that produced HB 149 reflected what one publication called a "private sector reprieve."[10][19] Analyses by Baker Botts, K&L Gates, Latham & Watkins, Perkins Coie, Norton Rose Fulbright, and DLA Piper consistently characterized the enacted statute as "innovation-friendly," "lighter-touch," and substantially narrower than peer state legislation.[4][10][15][16][17][19]
The Foundation for American Innovation and other free-market technology policy organizations praised the regulatory sandbox in particular as a mechanism for permitting experimentation under reduced regulatory burden.[20] Hudson Cook noted that the law's exemptions for federally insured financial institutions and its focus on intent rather than impact made it especially favorable to the financial services industry.[21]
Consumer-advocacy and civil-society groups offered a more critical assessment. Kevin Welch of EFF-Austin, while praising the bill's focus on "real harms" such as racial profiling and privacy violations, argued that the absence of a private right of action substantially weakened enforcement. "If we really want to give these laws teeth, we have to make it where citizens can bring lawsuits," Welch told the Texas Tribune.[12] The Transparency Coalition described the final law as having been "dramatically revised" under tech-industry pressure and identified specific provisions, particularly those related to disclosure, impact assessments, and duty of care, as casualties of the lobbying campaign.[9] Texas Policy Research raised concerns that the bill "imposes sweeping compliance obligations on all entities without exemptions for small businesses or research projects."[18]
The most extensive comparison in published analyses is between TRAIGA and the Colorado AI Act, the only other comprehensive state AI law of comparable scope to take effect in the same time frame.[4][7][8][15] Major differences include:
| Feature | TRAIGA (Texas) | Colorado AI Act |
|---|---|---|
| Liability standard | Intent-based: requires intent to discriminate or harm | Impact-based: requires reasonable care against algorithmic discrimination |
| Disparate impact | Insufficient to prove violation | Central to liability theory |
| High-risk AI category | Eliminated from final bill | Defined and central to obligations |
| Private-sector impact assessments | Not required | Required for high-risk systems |
| Consumer disclosures by private deployers | Not required | Required for high-risk systems |
| Regulatory sandbox | 36-month program | Not specified |
| Enforcement | Texas Attorney General, exclusive | Colorado Attorney General, exclusive |
| Private right of action | None | None |
| Effective date | January 1, 2026 | February 1, 2026 |
Several commentators describe TRAIGA as effectively the "anti-Colorado" approach, replacing Colorado's risk-management and impact-assessment architecture with a narrower, intent-based prohibition framework that places fewer affirmative obligations on private actors.[7][15]
Like the EU AI Act, TRAIGA prohibits AI systems used for unconsented biometric identification by government entities, social scoring by public authorities, generation of child sexual abuse material, and intentional discrimination on protected grounds. The two regimes diverge in their treatment of risk-tiered systems: the EU AI Act regulates "high-risk" AI through detailed conformity assessment, technical documentation, and human oversight requirements, while TRAIGA, having stripped the high-risk category during revision, imposes no comparable obligations.[4][7][16][17]
Texas became the third U.S. state to enact comprehensive AI legislation, after Colorado and Utah. Utah's AI Policy Act (effective May 2024) took a more limited approach focused on disclosure requirements for "regulated occupations." California Senate Bill 53, focused on frontier AI developer transparency, and California SB 1047, which was vetoed in 2024, address different sets of issues than TRAIGA, particularly the safety of large-scale foundation models rather than narrow harms, and reflect a more developer-focused regulatory stance.[4][7][15]
TRAIGA's enactment occurred during a period of intense debate over the role of state AI legislation within the federal system. Following the rescission of the Biden-era Executive Order on AI on the first day of the second Trump administration and the announcement of a new federal AI policy emphasizing American leadership and minimal regulatory burden, the U.S. House of Representatives included a 10-year moratorium on state AI laws in budget reconciliation legislation passed in May 2025.[11][13] The proposed moratorium would have rendered TRAIGA unenforceable shortly after taking effect.
The U.S. Senate stripped the moratorium from the reconciliation bill by a 99-1 vote in July 2025, preserving the enforceability of TRAIGA and similar state laws.[11][13] Some commentators and policy analysts argue the moratorium may be reintroduced in future federal legislation, and the durability of state AI laws in the face of federal preemption remains uncertain.[11][13]
The substantive provisions of TRAIGA took effect on January 1, 2026.[1][4] By the operation of the statute, the Texas Attorney General is required to maintain a public online complaint intake system, and the Department of Information Resources is required to begin administering the AI Regulatory Sandbox Program and to provide implementation guidance to state agencies.[4][6][16] Appointments to the Texas Artificial Intelligence Advisory Council have proceeded under the framework specified in the statute, with seven members appointed by the Governor, Lieutenant Governor, and Speaker of the House serving staggered four-year terms.[4][5][16]
Because Texas operates on a biennial legislative calendar, the next regular legislative session in which substantive amendments to TRAIGA could be considered will be the 90th Legislature, which convenes in January 2027.[22] Holland & Knight noted in February 2026 that, in the interim, the Texas Attorney General's office is expected to be the primary engine of TRAIGA development, including through enforcement actions, guidance documents, and complaint-handling practice.[22]