Colorado SB 26-189 and Texas TRAIGA: what deployers must do and who enforces

Two laws, three primary documents

This explainer compares the two laws using three primary documents: the Colorado General Assembly's bill page, the Texas Attorney General's consumer AI rights page, and a Texas Attorney General press release dated September 18, 2024.

The Colorado General Assembly's bill page for SB26-189 records in its bill history that the governor signed the bill on May 14, 2026.

The bill summary on that page says the general assembly enacted Senate Bill 24-205 in 2024 to create consumer protections in interactions with AI systems, and that the new act repeals and reenacts those provisions with new requirements for the use of automated decision-making technology in consequential decisions.

The Texas Attorney General's page says the Texas Responsible Artificial Intelligence Governance Act, called TRAIGA, took effect on January 1, 2026, and that it governs entities deploying AI in Texas.

Colorado: what the law covers

The Colorado bill summary defines automated decision-making technology, or ADMT, as a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information used to make, guide, or assist a decision, judgment, or determination concerning an individual.

The summary then limits the law to consequential decisions, which it defines as decisions relating to an individual's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits.

Those two definitions set the scope for the duties described next.

Colorado: what developers and deployers must do

The summary splits the duties between developers, who build the technology, and deployers, who use it. For developers, it says that starting January 1, 2027, the developer of an ADMT used to materially influence a consequential decision, which the act calls a covered ADMT, must give deployers technical documentation describing intended uses, categories of training data, known limitations, and instructions for appropriate use and human review; developers must also notify deployers of material updates or modifications, and both developers and deployers must retain records needed to demonstrate compliance for at least 3 years.

For deployers, the summary describes consumer notice requirements: clear and conspicuous notice at the point of interaction with a covered ADMT, and a plain language description of the ADMT's role within 30 days after a consequential decision that results in an adverse outcome for the consumer, with the attorney general required to adopt rules clarifying those post-adverse outcome disclosures by January 1, 2027.

The summary also lists consumer rights that deployers must be ready to honor: consumers can request their personal data and correction of factually incorrect personal data used by a covered ADMT, and they can request meaningful human review and reconsideration after a covered ADMT makes a consequential decision with an adverse outcome.

Colorado: how it is enforced

The summary says the attorney general enforces the act through the Colorado Consumer Protection Act, that a violation is deemed a deceptive trade practice, and that before initiating an action before January 1, 2030, the attorney general must give the developer or deployer a 60-day notice and opportunity to cure the alleged violation if a cure is deemed possible.

The summary adds that the act creates no new private right of action but sets how fault is allocated between developers and deployers in civil actions alleging unlawful discrimination under existing law, and that specified entities are exempt from the act to the extent they comply with other legal obligations.

Texas TRAIGA: prohibitions and disclosures

The Texas page lists prohibitions that apply to any person, beginning with manipulation of human behavior: a person may not develop or deploy an AI system in a manner that intentionally aims to incite or encourage a person to commit physical self-harm, including suicide, harm another person, or engage in criminal activity.

On discrimination, the page says a person may not develop or deploy an AI system with the intent to unlawfully discriminate against a protected class in violation of state or federal law, that a disparate impact alone is not enough to show intent, and that certain insurance entities and federally insured financial institutions are exempt if they comply with or are regulated by other laws.

The page's disclosure requirement is aimed at government. It says a governmental agency that makes available an AI system intended to interact with consumers must tell each consumer, before or at the time of the interaction, that they are interacting with an AI system, in a disclosure that is clear and conspicuous and written in plain language.

A second disclosure rule covers health care. The page says that when an AI system is used in relation to health care services or treatment, the provider must give the recipient or the recipient's personal representative a clear and conspicuous disclosure no later than the date the service or treatment is first provided, or as soon as reasonably possible in an emergency.

The page defines a consumer as an individual who is a resident of Texas acting only in an individual or household context, and it says the term does not include an individual acting in a commercial or employment context.

Texas TRAIGA: enforcement and a prior case

The Texas page says the attorney general has exclusive authority to enforce TRAIGA unless the attorney general has recommended additional enforcement by another state agency, may issue civil investigative demands, and may seek civil penalties, injunctive relief, attorney's fees, and reasonable court costs or investigative expenses.

The page sets the penalty ranges: $10,000 to $12,000 for each violation the court determines to be curable or for a breach of a statement submitted to the attorney general, $80,000 to $200,000 for each violation the court determines to be uncurable, and $2,000 to $40,000 for each day a violation continues.

The page also states that there is no private right of action under the act.

The Texas Attorney General's press release of September 18, 2024, which predates TRAIGA, describes how the office handled an AI company before the act existed. It says Attorney General Ken Paxton secured a first-of-its-kind settlement with Pieces Technologies, a Dallas-based AI healthcare technology company, resolving allegations that it deployed its products at several Texas hospitals after making false and misleading statements about their accuracy and safety.

Under the settlement, the release says, Pieces agreed to accurately disclose the extent of its products' accuracy and to ensure that hospital staff using its generative AI products to treat patients understand how far they should or should not rely on them.