Texas TRAIGA Explained: What the 2026 AI Law Requires

TRAIGA began as one of the most ambitious state AI bills in the US, modelled partly on Colorado's risk-based approach. The version that passed was significantly narrower. It focuses on intent-based prohibitions, government use, and a regulatory sandbox. Here's what it requires.

TRAIGA at a glance

Prohibited AI practices (all entities)

TRAIGA prohibits developing or deploying AI with the intent to:

• manipulate people into self-harm, harming others or criminal activity;
• infringe, restrict or impair rights guaranteed by the US Constitution;
• unlawfully discriminate against a protected class. TRAIGA expressly says disparate impact alone isn't enough to show intent;
• produce or distribute child sexual abuse material or sexually explicit deepfakes involving minors, or AI that imitates a child in explicit conversations.

Duties for government entities

• Disclosure: agencies must clearly tell consumers when they're interacting with an AI system, even if it seems obvious.
• No social scoring: agencies can't use AI to score people in ways that lead to detrimental treatment.
• Biometric limits: agencies can't use AI to identify people from biometric data collected without consent, where that would infringe their rights.
• Healthcare: separate Texas provisions require disclosure when AI is used in healthcare services or treatment.

Enforcement and penalties

1. The Attorney General runs an online complaint mechanism.
2. The AG can issue civil investigative demands, including for a description of the system's purpose, training data types, inputs and outputs, performance metrics, limitations and safeguards.
3. Before suing, the AG must give written notice and a 60-day opportunity to cure.
4. Penalties scale with whether the violation can be cured, reaching up to $200,000 per violation, with up to $40,000 a day for continuing breaches. State agencies can also take action against licensed professionals.

Safe harbours and defences

• Framework defence: substantial compliance with the NIST AI RMF, including its Generative AI Profile, or another nationally or internationally recognised AI risk framework. See NIST AI RMF explained.
• Discovery by testing: violations found through red teaming, adversarial testing or internal review, and then cured, are treated more leniently.
• Sandbox participation: companies in the programme get limited protection while testing.

The regulatory sandbox and AI Council

The Texas Department of Information Resources runs a sandbox that lets approved participants test AI systems for up to 36 months with relief from certain state rules, subject to reporting. The Texas Artificial Intelligence Council studies AI use and can recommend changes to law and policy. It has no rulemaking power over private companies.

TRAIGA vs other state laws

See California's 2026 AI rules.

Federal preemption risk

Executive Order 14365 (December 2025) directed a federal AI Litigation Task Force to challenge state AI laws seen as onerous, and called for federal legislation to preempt them. An executive order can't repeal a state law by itself, so TRAIGA remains in force unless a court or Congress says otherwise. Monitor developments.

What companies should do

1. Inventory AI used in or offered to Texas.
2. Screen use cases against the prohibited-intent list and document legitimate purposes.
3. Align your AI risk programme with the NIST AI RMF to support the framework defence.
4. Keep records the AG might request: purpose, data types, metrics, limitations, safeguards.
5. If you sell to Texas agencies, support their disclosure duties.

How the Attorney General investigates

TRAIGA gives the Texas Attorney General exclusive enforcement power and civil investigative demand powers. In an investigation, the AG can request information such as a description of the AI system's purpose and intended use, the type of data used to train it, its inputs and outputs, performance metrics and known limitations, post-deployment monitoring and the safeguards in place. Companies that already document these points for the NIST AI RMF or ISO/IEC 42001 will find it much easier to respond.

Practical documentation to keep

The cure period in practice

Before bringing an action, the AG must give written notice of the alleged violation, and the company has 60 days to cure it, provide supporting documentation and explain the policy changes made to prevent recurrence. Using the cure period well depends on having an incident process that can investigate quickly and document fixes.

Frequently asked questions

Sources

1. Texas Legislature: HB 149 (89R)
2. Haynes Boone: TRAIGA – what businesses need to know
3. K&L Gates: Pared-back TRAIGA signed into law
4. Manatt: Executive Order targets state AI laws

Last reviewed: October 2026. This is general information, not legal advice.