Texas House Bill 149, formally the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), took effect on January 1, 2026, after Governor Greg Abbott signed it on June 22, 2025. The law bans a short list of intentional AI misuses, imposes disclosure duties on government agencies and healthcare providers, and gives the Texas Attorney General exclusive authority to enforce it with civil penalties that can reach $200,000 per violation. It does not classify AI by risk level, does not create a private right of action, and preempts any city or county from writing its own AI rules.
Who the Law Applies To
HB 149 reaches two groups. A “developer” is any person who creates an AI system that is offered, sold, leased, or otherwise provided in Texas. A “deployer” is any person who puts an AI system into service or use in the state. The law covers anyone who develops or deploys AI in Texas, produces products or services used by Texas residents, or conducts business in the state.
An “artificial intelligence system” is defined broadly: any machine-based system that infers from inputs how to generate outputs such as content, decisions, predictions, or recommendations that can influence physical or virtual environments. There is no “high-risk AI” tier in the Texas law. Every covered system is measured against the same set of prohibited uses, regardless of sector.
The definition of “consumer” is narrower than many readers expect. It means an individual acting in an individual or household capacity. Employees, job applicants, and people acting in a commercial or B2B context are excluded.
What HB 149 Prohibits
Every prohibition in the law turns on intent. A plaintiff or the Attorney General must show that the developer or deployer acted with the purpose of causing the banned harm. Disparate impact alone is not enough to establish intent to discriminate; the statute says so expressly.
- Developers and deployers may not intentionally use AI to incite physical self-harm, harm to others, or criminal activity.
- AI may not be developed or deployed with the sole intent to infringe rights under the U.S. or Texas Constitution.
- AI systems may not be developed or deployed with the intent to unlawfully discriminate against a protected class.
- Developing AI with the sole intent of producing child sexual abuse imagery, deepfake pornography, or text conversations that simulate sexual content while impersonating a child is prohibited.
- Governmental entities may not use AI to categorize individuals based on behavior or characteristics when doing so leads to detrimental, unjustified, or disproportionate treatment or violates constitutional rights.
- Government entities may not use AI to uniquely identify individuals through biometric data collected from public sources without consent, if doing so violates constitutional or legal rights.
The social scoring and biometric identification bans apply only to government. The law exempts commercial AI systems from those two restrictions.
Who Must Disclose AI Use
Disclosure obligations under HB 149 are narrow and fall on two groups.
Any government agency that provides an AI system for consumer interaction must disclose, before or at the time of the interaction, that the person is engaging with an AI system. The notice must be clear, conspicuous, in plain language, and free of dark patterns.
Healthcare providers using AI in connection with health care services or treatment must disclose that fact to patients, either before or at the time of the interaction. In emergencies, disclosure may be made as soon as reasonably possible. These healthcare disclosures may be delivered through entry waiver forms.
Private employers are not required to disclose AI use to employees or job applicants. Earlier drafts of the bill included that mandate; the enacted version does not. The final text also dropped any requirement that private entities conduct algorithmic impact assessments or adopt mandatory risk management policies.
Exemptions and Carve-Outs
Several categories of activity sit outside the law’s practical reach:
- Insurers already subject to state insurance laws on unfair discrimination or competition are exempt from the Act’s discrimination prohibitions.
- Federally insured financial institutions are considered in compliance if they follow applicable federal and state banking laws.
- Restrictions on government social scoring and biometric identification do not apply to AI systems developed or deployed for commercial purposes.
- The Attorney General may not bring civil penalty actions against developers or deployers for AI systems kept isolated from customer interaction in a pre-deployment environment.
- Any disclosure requirement that conflicts with state or federal law may be exempt. The Act must be construed consistently with the U.S. Constitution and federal law, including Section 230 of the Communications Decency Act.
The law also amends existing Texas statutes in ways that create space for AI development. Under the Capture or Use of Biometric Identifiers statute (Business and Commerce Code Section 503.001), private developers may use biometric data for AI training, processing, or development as long as the resulting system is not intended to uniquely identify specific individuals. Biometrics used in AI systems deployed for security or fraud prevention are also exempted. At the same time, the amendment clarifies that individuals have not consented to biometric capture merely because images or media containing their identifiers appear publicly online, unless they themselves made that media public.
A separate amendment to the Texas Data Privacy and Security Act (Section 541.104(a) of the Business and Commerce Code) requires processors to assist controllers in complying with security requirements for personal data collected, stored, and processed by AI systems.
Penalties and How Enforcement Works
The Texas Attorney General has exclusive authority to investigate and enforce HB 149. There is no private right of action. Consumers who believe a developer, deployer, or government agency violated the law can submit a complaint through an online portal that was scheduled to go live by September 1, 2026.
Before filing suit, the Attorney General must send written notice of the alleged violation and allow a 60-day cure period. If the entity cures the violation within that window, notifies affected consumers and the AI Council, provides supporting documentation, and updates its policies to prevent recurrence, no enforcement action may be brought.
Civil penalties scale with severity:
- Curable violations not cured within 60 days: $10,000 to $12,000 per violation.
- Uncurable violations: $80,000 to $200,000 per violation.
- Continuing violations: $2,000 to $40,000 per day the violation persists.
State agencies may impose separate monetary penalties of up to $100,000, or revoke licenses and registrations, for violations of the prohibited-uses provisions by their own licensed or certified professionals. The Attorney General may also seek injunctive relief, attorney’s fees, and court costs.
Safe Harbors and Affirmative Defenses
HB 149 gives regulated entities several paths to reduce or avoid liability. An entity can assert an affirmative defense by showing it discovered and cured a violation through internal testing, adversarial red team testing, or internal review.
Substantial compliance with a recognized AI risk management framework is also a defense. The statute names the National Institute of Standards and Technology’s “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile” and the ISO/IEC 42001 standard as qualifying. Compliance with guidelines issued by state agencies counts as well.
Third-party misuse can serve as a defense. If an outside party uses a developer’s or deployer’s system in ways the regulated entity did not intend or authorize, that misuse is not automatically attributed to the developer or deployer.
The Regulatory Sandbox
Companies that want to test, research, or train AI systems in Texas can apply to the AI Regulatory Sandbox Program, administered by the Texas Department of Information Resources. Accepted participants may operate for up to 36 months without standard regulatory authorization or licensure. The application must include a detailed description of the AI system, a benefit assessment covering impacts on consumers, privacy, and public safety, a plan for mitigating adverse consequences, and proof of compliance with applicable federal AI laws. Participants submit quarterly reports on performance metrics and consumer feedback.
During sandbox participation, the Attorney General and state agencies may not pursue punitive action against participants for activities conducted in compliance with the program’s requirements. The core prohibitions above still apply inside the sandbox.
Healthcare Providers Have a Second Statute to Worry About
Senate Bill 1188, signed on June 20, 2025, and effective September 1, 2025, sits alongside HB 149 and applies specifically to healthcare. It requires practitioners to review all AI-generated records for accuracy, disclose AI use to patients, and ensure that the practitioner makes the ultimate medical decision. It also requires that electronic health records be physically maintained within the United States. Providers covered by both laws must satisfy TRAIGA’s transparency requirements and SB 1188’s clinical and data-localization rules.
Local Rules Are Preempted
Section 551.152 of the Act states that it supersedes and preempts any ordinance, resolution, rule, or other regulation adopted by a political subdivision regarding the use of AI systems. Texas cities and counties cannot write their own AI rules. Compliance with HB 149 is the ceiling as well as the floor at the state level.
Federal Preemption Remains an Open Question
A federal moratorium on state AI laws has been proposed but not enacted. During the 2025 congressional session, a provision in what was called the “Big Beautiful Bill” would have imposed a 10-year moratorium on state AI laws, tied to the $42.5 billion Broadband Equity, Access, and Deployment program. On July 1, 2025, the Senate voted 99 to 1 to strip that provision from the bill, largely due to procedural issues and drafting flaws. Senator Ted Cruz has pledged to reintroduce a moratorium concept, including it in his September 2025 “Legislative Framework for American Leadership in Artificial Intelligence” alongside the SANDBOX Act, and House Republican leaders have considered attaching preemption language to the National Defense Authorization Act. If any such measure passes, it could suspend enforcement of HB 149 during the moratorium period. Until then, the Texas law is in force and the Attorney General’s enforcement infrastructure continues to build out.