TRAIGA Deep Dive: Texas’s “Prohibited Practices” AI Law, the Biometric Trapdoor, and the Enforcement Math
TRAIGA’s “big teeth / narrow bite” design
Texas did something that, in the current U.S. AI-policy moment, is genuinely unusual: it enacted an omnibus AI statute that (1) carries six‑figure, per‑violation civil penalties, (2) preempts local AI ordinances statewide, and (3) gives the Attorney General a dedicated investigative playbook—while still (4) declining to build a broad “risk-tier” compliance regime and (5) refusing to create a private right of action. Tex. H.B. 149, 89th Leg., R.S., §§ 4 (adding Tex. Bus. & Com. Code ch. 552), 6 (local preemption), 11–15 (enforcement), 10 (effective date) (2025).
That “big teeth / narrow bite” model is the most interesting feature of the Texas Responsible Artificial Intelligence Governance Act (“TRAIGA”). Tex. H.B. 149, 89th Leg., R.S., §§ 4 (adding Tex. Bus. & Com. Code ch. 552), 10 (2025).
What follows is a high-level attorney-style deep dive into what TRAIGA is, how it works, how Texas’s approach differs, and exactly how penalties are calculated. Tex. H.B. 149, 89th Leg., R.S., §§ 4, 10 (2025).
1. What TRAIGA is—and where it lives in Texas law
TRAIGA is the short title for House Bill 149, which adds a new “Artificial Intelligence Protection” subtitle to the Texas Business & Commerce Code and makes several targeted amendments to existing Texas privacy and biometric provisions. Tex. H.B. 149, 89th Leg., R.S., §§ 1, 2–4 (2025).
Most of TRAIGA’s “AI law” provisions sit in Subtitle D, Business & Commerce Code, which includes:
Chapter 551 (General Provisions);
Chapter 552 (Artificial Intelligence Protection);
Chapter 553 (AI Regulatory Sandbox Program); and
Chapter 554 (Texas Artificial Intelligence Council). Tex. H.B. 149, 89th Leg., R.S., § 4 (adding Tex. Bus. & Com. Code subtit. D, chs. 551–554) (2025).
TRAIGA took effect January 1, 2026. Tex. H.B. 149, 89th Leg., R.S., § 10 (2025).
A timing nuance worth noticing (and likely to become a “gotcha” fact pattern) is that the Act separately directs the Attorney General to post the online complaint mechanism required by Chapter 552 no later than September 1, 2026. Tex. H.B. 149, 89th Leg., R.S., § 8 (2025).
2. Scope: who is covered, and what counts as an “AI system”
2.1 Applicability is broad—but not unlimited
TRAIGA applies only to a person who (1) promotes, advertises, or conducts business in Texas, (2) produces a product or service used by Texas residents, or (3) develops or deploys an AI system in Texas. Tex. Bus. & Com. Code § 551.002(1)–(3) (effective Jan. 1, 2026).
The statute instructs courts to construe Subtitle D broadly to advance responsible AI development, protect against foreseeable risks, promote transparency, and provide notice regarding state-agency AI use. Tex. Bus. & Com. Code § 551.003(1)–(4) (effective Jan. 1, 2026).
2.2 The definition of “artificial intelligence system” is intentionally expansive
TRAIGA defines an “artificial intelligence system” as any machine-based system that infers from inputs how to generate outputs—including content, decisions, predictions, or recommendations—that can influence physical or virtual environments. Tex. Bus. & Com. Code § 551.001(1) (effective Jan. 1, 2026).
That definition is not limited to “generative AI,” and it is broad enough to capture classification models, scoring engines, ranking systems, and embedded automation in enterprise software. Tex. Bus. & Com. Code § 551.001(1) (effective Jan. 1, 2026).
2.3 “Consumer” is narrower than many readers expect
TRAIGA defines “consumer” as a Texas resident acting only in an individual or household context, and it expressly excludes individuals acting in a commercial or employment context. Tex. Bus. & Com. Code § 551.001(2) (effective Jan. 1, 2026).
That single carveout—consumer ≠ employee, consumer ≠ B2B—helps explain why TRAIGA is often described as “targeted” rather than a full-spectrum compliance regime. Tex. Bus. & Com. Code § 551.001(2) (effective Jan. 1, 2026).
3. The Texas design choice: regulate prohibited conduct, not “risk tiers”
A central differentiator is what TRAIGA does not do: it does not create a layered taxonomy of “high-risk AI systems” with extensive impact assessments, consumer rights workflows, or broad disclosure duties for private-sector deployers. Karin McGinnis & Jules Carter, Unique Aspects of Texas’ Approach to AI Regulation, Law360 (Nov. 21, 2025).
Instead, TRAIGA primarily operates as a prohibitions + enforcement statute—banning specific AI uses (or banning uses when coupled with certain intent), plus giving the Attorney General a complaint-driven investigative path and tiered civil penalties. Tex. Bus. & Com. Code §§ 552.051–.057, 552.101–.106 (effective Jan. 1, 2026).
This approach is repeatedly contrasted with broader risk-based frameworks (including the EU AI Act model and Colorado’s approach) in practitioner commentary, which highlights Texas’s narrower commercial-entity obligations. Skadden, Texas Charts New Path on AI With Landmark Regulation (June 23, 2025).
4. TRAIGA’s core prohibitions and duties, in plain English
TRAIGA’s operational rules live in Chapter 552, Subchapter B (“Duties and Prohibitions”). Tex. Bus. & Com. Code §§ 552.051–.057 (effective Jan. 1, 2026).
4.1 Mandatory disclosure when government uses AI to interact with consumers
A governmental agency that makes available an AI system intended to interact with consumers must disclose—before or at the time of interaction—that the consumer is interacting with an AI system. Tex. Bus. & Com. Code § 552.051(b) (effective Jan. 1, 2026).
The disclosure is required even if the AI nature of the interaction would be “obvious” to a reasonable consumer. Tex. Bus. & Com. Code § 552.051(c) (effective Jan. 1, 2026).
The disclosure must be clear and conspicuous, written in plain language, and may not use a “dark pattern” (as defined in Texas’s privacy statute). Tex. Bus. & Com. Code § 552.051(d); see also Tex. Bus. & Com. Code § 541.001 (defining “dark pattern”) (effective Jan. 1, 2026).
TRAIGA permits disclosure by hyperlinking to a separate web page. Tex. Bus. & Com. Code § 552.051(e) (effective Jan. 1, 2026).
Drafting note (and future litigation trivia): Chapter 552 defines “governmental entity,” but the disclosure rule uses “governmental agency,” which may generate interpretive arguments until courts or agencies harmonize the terms. Tex. Bus. & Com. Code § 552.001(3); Tex. Bus. & Com. Code § 552.051(b) (effective Jan. 1, 2026).
4.2 Additional disclosure rule for healthcare services or treatment
If an AI system is used in relation to health care service or treatment, the provider must disclose to the recipient (or personal representative) no later than the date the service is first provided (or as soon as reasonably possible in emergencies). Tex. Bus. & Com. Code § 552.051(f) (effective Jan. 1, 2026).
TRAIGA defines “health care services” in this section as services related to human health or diagnosis/prevention/treatment provided by a licensed/registered/certified individual. Tex. Bus. & Com. Code § 552.051(a) (effective Jan. 1, 2026).
4.3 Prohibition on AI designed to incite self-harm, harm to others, or crime
A person may not develop or deploy an AI system in a manner that intentionally aims to incite or encourage physical self-harm (including suicide), harm to another person, or criminal activity. Tex. Bus. & Com. Code § 552.052(1)–(3) (effective Jan. 1, 2026).
4.4 Government “social scoring” ban
A governmental entity may not use or deploy an AI system that evaluates or classifies people based on social behavior or personal characteristics with the intent to assign a “social score” that results or may result in detrimental treatment, disproportionate consequences, or infringement of rights under federal or state law. Tex. Bus. & Com. Code § 552.053(1)–(3) (effective Jan. 1, 2026).
4.5 Government biometric identification limits tied to rights infringement
TRAIGA restricts governmental entities from developing or deploying AI to uniquely identify an individual using biometric data or by gathering images/media from the internet or public sources without consent if the gathering would infringe an individual right under the U.S. Constitution, the Texas Constitution, or other law. Tex. Bus. & Com. Code § 552.054(b) (effective Jan. 1, 2026).
TRAIGA also provides that a violation of Texas’s biometric identifier law (Business & Commerce Code § 503.001) is a violation of this biometric-AI section as well. Tex. Bus. & Com. Code § 552.054(c) (effective Jan. 1, 2026).
4.6 “Constitutional rights” misuse—intent-focused, and expressly remedial
A person may not develop or deploy an AI system with the sole intent for the system to infringe, restrict, or otherwise impair an individual’s rights guaranteed under the U.S. Constitution. Tex. Bus. & Com. Code § 552.055(a) (effective Jan. 1, 2026).
TRAIGA clarifies that this section is remedial and may not be construed to create or expand constitutional rights. Tex. Bus. & Com. Code § 552.055(b) (effective Jan. 1, 2026).
4.7 Unlawful discrimination: intent required, disparate impact alone not enough
TRAIGA prohibits developing or deploying an AI system with the intent to unlawfully discriminate against a protected class in violation of state or federal law. Tex. Bus. & Com. Code § 552.056(b) (effective Jan. 1, 2026).
The statute defines “protected class” broadly by reference to characteristics protected by state or federal civil rights laws and expressly includes race, color, national origin, sex, age, religion, and disability. Tex. Bus. & Com. Code § 552.056(a)(3) (effective Jan. 1, 2026).
Critically, TRAIGA states that disparate impact is not sufficient by itself to demonstrate intent to discriminate. Tex. Bus. & Com. Code § 552.056(c) (effective Jan. 1, 2026).
Commentators identify this intent-centered standard as one of Texas’s sharpest departures from broader “algorithmic discrimination” frameworks elsewhere. McGinnis & Carter, Unique Aspects of Texas’ Approach to AI Regulation, Law360 (Nov. 21, 2025). 15210_Law360 - Unique Aspects O…
TRAIGA also includes industry-specific carveouts, including limitations for certain insurance entities already regulated for unfair discrimination and for federally insured financial institutions that comply with applicable banking laws and regulations. Tex. Bus. & Com. Code § 552.056(d)–(e) (effective Jan. 1, 2026).
4.8 Sexually explicit content, child pornography, and certain deepfake conduct
TRAIGA prohibits developing or distributing an AI system with the sole intent of producing, assisting in producing, or distributing visual material violating Penal Code § 43.26 or deepfake videos/images violating Penal Code § 21.165. Tex. Bus. & Com. Code § 552.057(1)(A)–(B) (effective Jan. 1, 2026).
TRAIGA also prohibits intentionally developing or distributing an AI system that engages in text-based conversations describing sexual conduct while impersonating or imitating a child under 18. Tex. Bus. & Com. Code § 552.057(2) (effective Jan. 1, 2026).
5. The biometric “trapdoor”: what TRAIGA changed in Texas’s consent statute
One of TRAIGA’s most concrete (and litigation-ready) impacts is the amendment of Texas’s biometric identifier law in Business & Commerce Code § 503.001, a statute Texas has enforced for years in the privacy space. Tex. H.B. 149, 89th Leg., R.S., § 2 (2025) (amending Tex. Bus. & Com. Code § 503.001).
5.1 No implied consent from public images (unless the individual posted them)
TRAIGA clarifies that an individual has not been informed of and has not provided consent for capture/storage of a biometric identifier for a commercial purpose based solely on the existence of an image online unless the image/media was made publicly available by the individual. Tex. Bus. & Com. Code § 503.001(b-1) (effective Jan. 1, 2026).
This provision is aimed squarely at “internet scraping” arguments that public availability equals consent. Tex. Bus. & Com. Code § 503.001(b-1) (effective Jan. 1, 2026).
5.2 Training and security exceptions—carefully bounded
TRAIGA adds exceptions so that § 503.001 does not apply to training/processing/storage of biometric identifiers involved in developing/training/evaluating/offering AI models unless the system is used or deployed for uniquely identifying a specific individual. Tex. Bus. & Com. Code § 503.001(e)(2) (effective Jan. 1, 2026).
It also creates exceptions for certain AI development/deployment tied to security incidents, fraud, harassment, identity theft, malicious/deceptive activities, integrity/security of systems, and investigation/reporting/prosecution of those activities. Tex. Bus. & Com. Code § 503.001(e)(3)(A)–(C) (effective Jan. 1, 2026).
5.3 The “trapdoor” provision: later commercial use can trigger full compliance exposure
If a biometric identifier captured for training an AI system is later used for a commercial purpose not described by the exceptions, the possessor becomes subject to § 503.001’s possession/destruction provisions and penalties. Tex. Bus. & Com. Code § 503.001(f)(1)–(2) (effective Jan. 1, 2026).
In other words, TRAIGA’s training exception is not a permanent immunity shield if the data later migrates into commercial identification use cases. Tex. Bus. & Com. Code § 503.001(e)(2), (f) (effective Jan. 1, 2026).
6. Enforcement architecture: exclusive AG power, complaint-driven investigations, and a mandatory cure window
6.1 No private right of action
TRAIGA gives the Attorney General exclusive authority to enforce Chapter 552 (with limited downstream consequences involving licensing agencies), and it expressly states the chapter does not create a private right of action. Tex. Bus. & Com. Code § 552.101(a)–(b) (effective Jan. 1, 2026). That one sentence will shape the litigation landscape in Texas far more than most readers realize.
6.2 Online complaint mechanism
The Attorney General must create and maintain an online mechanism for consumers to submit complaints alleging violations. Tex. Bus. & Com. Code § 552.102 (effective Jan. 1, 2026). As noted above, the Act separately directs the Attorney General to post this information and mechanism on the AG’s website no later than September 1, 2026. Tex. H.B. 149, 89th Leg., R.S., § 8 (2025).
6.3 Civil Investigative Demands (CIDs): what the AG can ask for
If the Attorney General receives a complaint through the online mechanism, the AG may issue a civil investigative demand to determine whether a violation occurred, using procedures under Business & Commerce Code § 15.10. Tex. Bus. & Com. Code § 552.103(a) (effective Jan. 1, 2026).
TRAIGA itemizes categories of information the AG may request, including high-level descriptions of: purpose and intended use, training data types, input/output categories, performance metrics, known limitations, post-deployment monitoring and safeguards, and other documentation reasonably necessary for the investigation. Tex. Bus. & Com. Code § 552.103(b)(1)–(8) (effective Jan. 1, 2026).
This “high-level description” language is doing a lot of work: it signals a desire for meaningful transparency without necessarily forcing disclosure of proprietary code or full datasets as a default expectation. Tex. Bus. & Com. Code § 552.103(b)(1)–(8) (effective Jan. 1, 2026).
6.4 Notice and a 60-day opportunity to cure
If the Attorney General determines a person has violated or is violating Chapter 552, the AG must notify the person in writing and identify the allegedly violated provisions. Tex. Bus. & Com. Code § 552.104(a) (effective Jan. 1, 2026).
The AG may not bring an enforcement action before the 60th day after providing notice. Tex. Bus. & Com. Code § 552.104(b)(1) (effective Jan. 1, 2026).
If the person cures within 60 days and provides a written statement with supporting documentation and policy changes reasonably preventing recurrence, the AG may not bring an action. Tex. Bus. & Com. Code § 552.104(b)(2)(A)–(B) (effective Jan. 1, 2026).
Practitioner commentary has noted that the notice-and-cure mechanism appears to apply broadly across Chapter 552’s prohibitions, which could become a focal point in future enforcement debates. McGinnis & Carter, Unique Aspects of Texas’ Approach to AI Regulation, Law360 (Nov. 21, 2025).
7. Penalties: the exact dollar amounts, plus what else the state can seek
TRAIGA’s penalty provisions are in § 552.105, and they are not vague. Tex. Bus. & Com. Code § 552.105 (effective Jan. 1, 2026).
7.1 Three tiers of civil penalties (plus daily “continuing” penalties)
If a person violates Chapter 552 and does not cure under § 552.104, the person is liable to the State for civil penalties of:
$10,000 to $12,000 for each violation the court determines is curable (or for breaching a cure statement submitted to the AG). Tex. Bus. & Com. Code § 552.105(a)(1) (effective Jan. 1, 2026).
$80,000 to $200,000 for each violation the court determines is uncurable. Tex. Bus. & Com. Code § 552.105(a)(2) (effective Jan. 1, 2026).
$2,000 to $40,000 per day for a continued violation for each day the violation continues. Tex. Bus. & Com. Code § 552.105(a)(3) (effective Jan. 1, 2026).
The Attorney General may sue to collect penalties, obtain injunctive relief, and recover attorney’s fees and reasonable court costs or investigative expenses. Tex. Bus. & Com. Code § 552.105(b)(1)–(3) (effective Jan. 1, 2026).
Skadden’s summary of these penalty tiers matches the statute’s plain text and highlights the size of the “uncurable” band (up to $200,000 per violation) as TRAIGA’s headline enforcement lever. Skadden, Texas Charts New Path on AI With Landmark Regulation (June 23, 2025).
7.2 A rebuttable presumption of reasonable care
TRAIGA provides a rebuttable presumption that a person used reasonable care as required under Chapter 552. Tex. Bus. & Com. Code § 552.105(c) (effective Jan. 1, 2026). That presumption is likely to matter most where enforcement theories hinge on whether a developer or deployer maintained meaningful safeguards around training, monitoring, and post-deployment controls. Tex. Bus. & Com. Code §§ 552.103(b)(7), 552.105(c) (effective Jan. 1, 2026).
7.3 Defense posture: expedited hearing / declaratory relief concept
A defendant may seek an expedited hearing or other process, including a request for declaratory judgment, if the person believes in good faith the person has not violated the chapter. Tex. Bus. & Com. Code § 552.105(d) (effective Jan. 1, 2026).
7.4 Two important limitations on liability / penalty exposure
A defendant may not be found liable if another person uses the AI system in a manner prohibited by Chapter 552. Tex. Bus. & Com. Code § 552.105(e)(1) (effective Jan. 1, 2026). A defendant also may not be found liable if the defendant discovers a violation through specified pathways such as feedback from others, testing (including adversarial or red-team testing), following state-agency guidelines, or an internal review process tied to substantial compliance with the most recent NIST “AI RMF: Generative AI Profile” (or another recognized risk management framework). Tex. Bus. & Com. Code § 552.105(e)(2)(A)–(D) (effective Jan. 1, 2026). TRAIGA
Finally, the Attorney General may not bring an action to collect a civil penalty for an AI system that has not been deployed. Tex. Bus. & Com. Code § 552.105(f) (effective Jan. 1, 2026).
7.5 “Second wave” sanctions by licensing agencies (up to $100,000)
After a finding of violation under § 552.105, and if the Attorney General recommends additional enforcement, a state agency may impose sanctions against a person licensed, registered, or certified by that agency for violating Subchapter B. Tex. Bus. & Com. Code § 552.106(a)(1)–(2) (effective Jan. 1, 2026).
Those sanctions may include suspension/probation/revocation of the license or authorization and a monetary penalty not to exceed $100,000. Tex. Bus. & Com. Code § 552.106(b)(1)–(2) (effective Jan. 1, 2026).
8. Preemption: TRAIGA wipes out local AI ordinances
TRAIGA expressly provides that Chapter 552 supersedes and preempts any ordinance, resolution, rule, or other regulation adopted by a political subdivision regarding the use of AI systems. Tex. Bus. & Com. Code § 552.003 (effective Jan. 1, 2026).
Statewide preemption is one of the most “Texas” parts of TRAIGA, and it is likely to become a recurring citation in municipal and procurement disputes where cities or counties attempt to impose their own AI conditions. Tex. Bus. & Com. Code § 552.003 (effective Jan. 1, 2026).
9. The sandbox and the Texas Artificial Intelligence Council: innovation + oversight, but no binding rules
9.1 The regulatory sandbox (Chapter 553)
TRAIGA requires the Texas Department of Information Resources, in consultation with the Council, to create a regulatory sandbox program enabling testing of innovative AI systems with legal protections and limited market access. Tex. Bus. & Com. Code § 553.051(a) (effective Jan. 1, 2026).
The sandbox is designed to promote safe innovation across sectors while balancing consumer protection, privacy, and public safety. Tex. Bus. & Com. Code § 553.051(b)(1)–(2) (effective Jan. 1, 2026).
Participants can test and deploy under the program for up to 36 months, subject to extensions for good cause. Tex. Bus. & Com. Code § 553.053(a)–(b) (effective Jan. 1, 2026).
Importantly, Subchapter B of Chapter 552 (the prohibitions) may not be waived even for sandbox participants. Tex. Bus. & Com. Code § 553.051(e) (effective Jan. 1, 2026).
9.2 The Texas Artificial Intelligence Council (Chapter 554)
TRAIGA creates the Texas Artificial Intelligence Council to study and make recommendations regarding ethical AI use, public safety impacts, innovation barriers, and related legal risks. Tex. Bus. & Com. Code § 554.001(a)(1)–(11) (effective Jan. 1, 2026).
The Council may issue reports and conduct training and outreach, but it may not adopt binding rules or interfere with state agencies. Tex. Bus. & Com. Code §§ 554.101, 554.102, 554.103(1)–(3) (effective Jan. 1, 2026).
10. So what is “different” about Texas—summarized in five points
Prohibitions-first, not risk-tier compliance. Tex. Bus. & Com. Code §§ 552.051–.057 (effective Jan. 1, 2026).
Narrow disclosure duties focused on government interactions and healthcare contexts. Tex. Bus. & Com. Code § 552.051(b)–(f) (effective Jan. 1, 2026).
Intent-based discrimination standard; disparate impact alone is not enough. Tex. Bus. & Com. Code § 552.056(b)–(c) (effective Jan. 1, 2026).
Exclusive Attorney General enforcement; no private lawsuits; mandatory notice-and-cure. Tex. Bus. & Com. Code §§ 552.101(b), 552.104(b) (effective Jan. 1, 2026).
Concrete biometric-law amendments limiting “public image = consent” arguments, with training exceptions and a later-use trapdoor. Tex. Bus. & Com. Code § 503.001(b-1), (e)(2)–(3), (f) (effective Jan. 1, 2026).
Practitioner analysis frames these as deliberate, Texas-specific policy choices that balance enforcement tools with room for private-sector innovation. McGinnis & Carter, Unique Aspects of Texas’ Approach to AI Regulation, Law360 (Nov. 21, 2025); Skadden, Texas Charts New Path on AI With Landmark Regulation (June 23, 2025).
Closing thought: TRAIGA is less about “AI paperwork” and more about “AI intent + AI outcomes + provable controls”
TRAIGA’s practical gravity is not a checklist of mandated impact assessments; it is the way the statute sets up enforcement leverage (CIDs + cure window + tiered penalties) around a defined set of prohibited AI uses and around biometric consent rules that can become expensive quickly if mishandled. Tex. Bus. & Com. Code §§ 552.103–.105; Tex. Bus. & Com. Code § 503.001(b-1), (f) (effective Jan. 1, 2026).