Texas Responsible AI Governance Act (TRAIGA) takes effect statewide

The Texas Responsible Artificial Intelligence Governance Act (TRAIGA) is a statewide law that bans specific harmful uses of AI and sets disclosure duties for government agencies, and it became effective on January 1, 2026.

Governor Greg Abbott signed the bill roughly six months earlier, making Texas one of the first states with a dedicated AI statute.

What it is

TRAIGA applies to any person conducting business in Texas, selling to Texas residents, or developing or deploying an AI system in the state.

It defines an AI system broadly as any machine-based system that infers from inputs how to generate outputs that can influence physical or virtual environments.

Legal commentary describes it as the third comprehensive state AI law, following Colorado.

What it requires

The statute bars anyone from developing or deploying an AI system meant to incite self-harm, harm to others, or criminal activity.

It also bars AI developed or deployed with intent to unlawfully discriminate against a protected class, though a disparate impact alone does not establish that intent.

State agencies deploying consumer-facing AI must disclose that a consumer is interacting with an AI system before or at the time of the interaction.

Healthcare providers using AI in treatment must give patients a similar disclosure no later than when the service is first provided.

The law also creates a regulatory sandbox letting approved participants test AI systems for up to 36 months without standard state licenses.

TRAIGA preempts local AI ordinances so that a single statewide set of rules applies.

The Texas attorney general has exclusive authority to enforce the law and may issue civil investigative demands.

After a notice of violation, a party has 60 days to cure the issue and document the fix before an enforcement action proceeds.

Curable violations carry civil penalties of $10,000 to $12,000, uncurable violations $80,000 to $200,000, and continuing violations $2,000 to $40,000 per day.

TRAIGA does not provide a private right of action.

An entity that substantially complies with the NIST AI Risk Management Framework or other recognized standards can raise that compliance as a defense.

What security leaders should do

Security and compliance teams should inventory every AI system touching Texas operations or Texas residents and map each to TRAIGA's intent-based prohibitions, since the attorney general can issue civil investigative demands on short notice. Mapping AI governance work to the NIST AI Risk Management Framework gives both a defensible compliance posture and a documented basis for the statute's safe-harbor defense. Because enforcement runs through a 60-day cure period rather than private lawsuits, teams should build internal processes to detect and document fixes quickly, and track vendor contracts so biometric, hiring, and healthcare-adjacent AI tools can produce the records the attorney general may request.