Texas AI Law (TRAIGA): What North Texas Businesses Need to Know

Texas Responsible AI Governance Act  ·  In force since January 1, 2026

HB 149 applies to anyone conducting business in Texas. It also contains a safe harbor almost nobody is using. Here is what it says, and how to get on the right side of it.

Thursday, September 24, 2026  ·  12:00 PM Central  ·  No cost to attend

On January 1, 2026, the Texas Responsible Artificial Intelligence Governance Act took effect. It is the first broad state AI statute that reaches ordinary Texas businesses, not just technology companies.

Most of the coverage since has been either alarmist or unreadable. Here is the plain version: what the law actually says, what it does not say, and the one clause every North Texas owner should know about.

This page is general information, not legal advice. The Fulcrum Group is an IT and cybersecurity firm, not a law firm. Talk to your attorney about how TRAIGA applies to your specific business.

The basics

• Who it covers. Anyone conducting business in Texas, and anyone developing, deploying, or offering AI systems in the state.

• Who enforces it. The Texas Attorney General, exclusively. There is no private right of action, so you will not be sued by a customer under this statute.

• You get 60 days. The AG must give written notice and a 60-day opportunity to cure before bringing an enforcement action.

• Curable violations left uncured. $10,000 to $12,000 per violation.

• Uncurable violations. $80,000 to $200,000 per violation.

• Continuing violations. $2,000 to $40,000 per day.

Those numbers get quoted a lot, usually without the next section, which is the part that actually matters for a normal business.

Honest scope

If you run a manufacturing company, a medical practice, a law firm, or a distribution business in Tarrant County, TRAIGA is narrower than the headlines suggest. For private companies it prohibits developing or deploying an AI system with the intent to:

• Incite or encourage self-harm, harm to another person, or criminal activity

• Infringe, restrict, or otherwise impair constitutional rights

• Unlawfully discriminate against a protected class

• Produce child sexual abuse material or unlawful explicit deepfake content

Intent is the hinge. The statute specifically says that showing disparate impact alone is not sufficient to prove intent to discriminate. That is a meaningfully higher bar than the compliance-panic emails in your inbox imply.

So no, an ordinary business is not going to be fined for letting an employee use ChatGPT. Anyone telling you otherwise is selling something.

Government entities carry a heavier load.

• They must disclose to Texas residents when they are interacting with an AI system, before or at the point of contact

• They may not use AI to assign social scores that lead to detrimental treatment

• They face restrictions on biometric identification from publicly available sources without consent

If you are a municipality, a school district, or a water or wastewater district in North Texas, this section is about you, and it is worth a conversation. We work with public entities across the region and hold a Texas DIR contract and Texas HUB status.

The clause that matters

TRAIGA gives organizations an affirmative defense against liability. Among the ways to establish it, one stands out for ordinary businesses:

Substantially complying with the NIST Artificial Intelligence Risk Management Framework, or another recognized national or international AI risk framework.

• The defense is also available where a violation is discovered through internal testing, including adversarial testing and red team exercises

• Or where the issue arose from a third party misusing your system

Which leads to one question worth five minutes of your time.

If someone asked today how your company governs employee AI use, what would you hand them? For most North Texas businesses the honest answer is nothing. Not out of negligence — because AI arrived through the side door, one employee at a time, and there was never a moment where anyone sat down and wrote a policy.

The real exposure

It is the client contract that went into a free summarizer. The customer spreadsheet pasted into a chatbot. The notetaker sitting in a call nobody approved. Every one of those is a person trying to do their job well, using a tool nobody told them not to use.

• 63% of organizations have no AI governance policy of any kind

• Breaches involving shadow AI cost an average of $670,000 more than breaches without it

• 97% of organizations that suffered an AI-related security incident lacked proper AI access controls

Source: IBM, 2025 Cost of a Data Breach Report.

The same written governance that establishes your TRAIGA safe harbor is what keeps client data out of a public model. You are not doing two projects. You are doing one.

Step 1  ·  Free self-assessment

Ten questions, about five minutes, scored on screen. It covers the same ground a recognized framework asks about, so it doubles as a starting inventory for your written governance.

• Governance, shadow AI, data protection, and written policy

• Employee training, incident reporting, and leadership alignment

• Your results on screen immediately, with no waiting on a report

Before you click: The assessment is hosted by our security partner, Breach Secure Now. The first screen asks for your name, work email, company name, and phone number so your scorecard can be delivered. Then you answer the ten questions and see your results on screen. About five minutes start to finish. We do not sell your information.

Step 2  ·  Executive webinar

• How to find out which AI tools your people are already using

• What TRAIGA requires, and what establishing the safe harbor looks like in practice

• The one-page AI acceptable use policy you can put in place this month

• How to move from awareness to a structured 90-day plan

Who should attend

Owners, executives, and IT or security leaders at North Texas organizations. If you are the person who gets the phone call when client data turns up somewhere it should not, this is for you. This is not a technical deep dive, and no preparation is required.

Thursday, September 24, 2026  ·  12:00 PM Central
45 minutes plus live Q&A  ·  No cost to attend  ·  Can’t make it? Register anyway and we will send you the recording.

Common questions

Does TRAIGA apply to my small business?

It applies to anyone conducting business in Texas, so yes, you are within scope. But the prohibitions on private companies are narrow and turn on intent, so a typical small or midsize business is unlikely to violate them by accident. The practical issue is having nothing documented, and therefore no safe harbor if a question ever arises.

What is the safe harbor, exactly?

TRAIGA provides an affirmative defense for organizations that substantially comply with the NIST AI Risk Management Framework or another recognized AI risk framework. It is also available where you caught the issue yourself through internal or adversarial testing, or where a third party misused your system.

Can a customer sue me under this law?

No. Enforcement authority sits exclusively with the Texas Attorney General and the statute creates no private right of action.

Do I get a chance to fix a problem before penalties?

Yes. The Attorney General must provide written notice and a 60-day period to cure before bringing an enforcement action.

What is shadow AI?

Any AI tool an employee uses for work that the business has not approved, configured, or documented. In practice that usually means a personal ChatGPT or Gemini account, a free browser extension, or an AI notetaker quietly joining meetings.

Do I have to attend the webinar to take the assessment?

No, they are independent. Most people take the assessment first, because the webinar makes a lot more sense once you have seen your own score.

Is this legal advice?

No. The Fulcrum Group is an IT and cybersecurity firm, not a law firm. We can help you build and document AI governance; your attorney should advise you on how the statute applies to your business.

Waiting does not reduce the risk. It just means the inventory takes longer when you finally do it.

or take the 5-minute assessment first

The Fulcrum Group  ·  1670 Keller Parkway, Suite 130, Keller, TX 76248
817-337-0300  ·  sales@fulcrumgroup.net

Serving Keller, Fort Worth, Dallas, and North Texas.  ·  Powered by Breach Secure Now. Guided by The Fulcrum Group.

General information only, not legal advice. Statutory details reflect Texas HB 149 as enacted, effective January 1, 2026.