Compliance Guide

Texas TRAIGA Compliance for Enterprise AI Systems

The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), enacted as Texas H.B. 149, generally takes effect January 1, 2026. It applies to persons who develop, deploy, or offer AI systems in or into Texas when statutory nexus and covered-activity conditions are met.

Explore Runtime Governance Talk to an Expert

Enterprises should inventory models, agents, and decision workflows; screen for prohibited practices; meet disclosure and documentation expectations where triggered; and prepare governance, access control, audit evidence, and runtime policy enforcement for Attorney General civil investigation and enforcement.

What TRAIGA covers as of January 2026

TRAIGA is Texas House Bill 149, the Texas Responsible Artificial Intelligence Governance Act. It generally takes effect January 1, 2026, and establishes state-level prohibitions, consumer-protection and disclosure duties, Attorney General civil investigative and enforcement authority, and an artificial intelligence regulatory sandbox program. Scope is driven by statutory definitions of AI system, developer, and deployer, and by whether the system is developed, deployed, or offered in or into Texas under the Act’s nexus conditions. Model size, open-source status, or proprietary branding alone do not determine coverage.

Covered activity can include enterprise models, copilots, AI agents, RPA-plus-LLM hybrids, and vendor AI embedded in SaaS when those systems are used for Texas operations or customers and meet the statutory tests. Agentic systems that chain tools, identities, and data stores widen the compliance surface beyond a single model endpoint to workflows, permissions, and downstream actions. State agencies and certain public entities face heightened transparency and disclosure duties when using covered AI to interact with the public or make consequential decisions. Defined exclusions and limitations apply; boundary cases still require fact-specific legal analysis.

TRAIGA coexists with other Texas and federal requirements, including sector privacy, consumer protection, employment, and civil-rights laws. Compliance with one regime does not automatically satisfy the others. A regulatory sandbox administered with Texas Department of Information Resources involvement may allow limited, supervised testing; it is not a general production exemption from prohibited practices or Attorney General authority.

TRAIGA readiness focus areas

  • CoverageAI system, developer, deployer, and Texas nexus definitions
  • ProhibitionsUnlawful discrimination, harmful manipulation, and defined government uses
  • EvidenceInventory, disclosures, audit logs, and AG response packages
  • Runtime controlsIdentity, permissions, policy enforcement, and human oversight

Enterprise obligations, prohibitions, and enforcement

The statute prohibits certain AI uses, including intentional unlawful discrimination or manipulation that causes substantial harm, and certain government social-scoring or biometric identification practices as defined in the Act. It emphasizes documentation, risk management, and consumer-facing disclosures for covered high-impact uses rather than a single federal-style conformity assessment mark. Consequential decision pathways such as credit, employment, housing, healthcare access, essential services, and government benefits are priority targets for prohibited-practice and disclosure review.

Enforcement is centered on the Texas Attorney General, who holds civil investigative and enforcement authority, including civil penalties for violations after notice and cure opportunity where applicable. Effective-date planning therefore focuses on January 1, 2026 readiness for inventory, prohibited-use screening, complaint response, and cooperation with AG inquiries. Post-effective-date enforcement priorities, penalty practice, and interpretive guidance may still evolve. Secondary summaries also differ on private-right-of-action breadth versus consumer-protection interplay, so statutory text and counsel should drive enforcement posture.

For compliance leaders, the operational implication is clear: covered organizations need accountable owners for applicability decisions, exception approvals, and periodic re-attestation, plus retained policy versions, risk assessments, and human-oversight records proportionate to system risk and statutory duties.

Inventory AI systems and assess TRAIGA coverage

Coverage decisions should start from a complete inventory of models, agents, copilots, hybrids, and embedded vendor AI, with Texas nexus flags and clear ownership. Inventory is not only a catalog exercise; it is the foundation for prohibited-practice screening, disclosure design, and evidence packages that can be produced on AG timelines.

Practical evaluation criteria for covered AI programs

  • Applicability is decisioned and owned: Compliance, legal, security, and product owners can state which systems meet TRAIGA definitions and nexus tests, with dated re-attestation.
  • Consequential uses are prioritized: High-impact decision and public-interaction workflows have completed prohibited-practice screening and disclosure design.
  • Evidence is end-to-end: For a covered agent workflow, teams can produce identity, permissions, policy enforcement, and human-review records on AG timelines.
  • Vendor leverage is contractual: Deployer agreements include logging access, cooperation, warranties, and disclosure support rather than goodwill alone.
  • Runtime enforcement is independent of prompts: Prohibited-use and data-minimization rules bind tool-calling agents at enforcement points, not only through system prompts.
  • Multi-regime map is explicit: TRAIGA controls are traced against federal, other-state, and sector duties so gaps and overlaps are visible.

Governance and runtime controls that operationalize compliance

For tool-using agents and consequential workflows, compliance depends on controls that sit outside the model as well as documentation that sits with legal and risk teams. The following sequence keeps inventory, identity, policy, and audit evidence connected.

  1. Authoritative inventory

    Single source linking systems, agents, owners, purposes, data classes, tools, regions, and Texas nexus.

  2. Identity and least privilege

    Scoped non-human identities, tool approval, JIT elevation, and rapid revocation for high-risk actions.

  3. Policy decision points

    Allow, deny, and transform controls outside the model so prohibited-use rules stay updateable.

  4. Immutable audit evidence

    Logs of invocations, tool calls, policy outcomes, overrides, and human review for AG and complaint response.

January 2026 readiness checklist

  • Complete coverage inventory of models, agents, copilots, hybrids, and embedded vendor AI with Texas nexus flags
  • Screen and remediate use cases against TRAIGA prohibited practices and high-impact disclosure duties
  • Assign accountable owners for applicability, exceptions, training, and periodic re-attestation
  • Implement least-privilege agent permissions, tool governance, and separable runtime policy enforcement
  • Retain proportionate risk assessments, policy versions, disclosure records, and immutable runtime audit logs
  • Establish consumer complaint and AG civil investigative demand intake, cure, and evidence-package procedures

Strengthen runtime controls for covered AI agents

If your TRAIGA assessment includes tool-using agents and consequential workflows, review how runtime identity, permissions, policy enforcement, and audit logging support operational compliance evidence.

Explore Runtime Governance