Does TRAIGA (Texas's AI Law) Cover Your Business?

Texas's AI law got its enforcement trigger on September 1. The Attorney General's office switched on the online complaint portal that the Texas Responsible AI Governance Act, TRAIGA, required by statute. Every small business in Texas runnin

Texas's AI law got its enforcement trigger on September 1. The Attorney General's office switched on the online complaint portal that the Texas Responsible AI Governance Act, TRAIGA, required by statute. Every small business in Texas running a chatbot, a hiring tool, or an AI receptionist just moved from "the law is on the books" to "the mechanism to report you is live."

Most of what's circulating about what that actually means gets two things backward. One makes TRAIGA easier on a private business than the panic suggests. The other makes it harder, in a way almost nobody is writing about.

The Enforcement Trigger Went Live on September 1

HB 149 required the Attorney General to post an online complaint mechanism by September 1, 2026. That deadline landed, and the Consumer AI Rights page is now live on the AG's own site, plain-language overview and complaint form included.

That page matters more than a routine web update. Under Section 552.103 of the statute, the Attorney General can only issue a civil investigative demand, the legal tool that forces a business to hand over its AI documentation, after receiving a complaint through that specific mechanism. No complaint through that portal, no CID. For eight months, TRAIGA's substantive rules existed without the machinery to act on a tip. Now they don't.

That timing gap is worth sitting with for a second. Texas businesses spent the first eight months of 2026 operating under a law with real prohibitions and genuinely large penalties attached, but with no statutory on-ramp for a regulator to actually go looking. That's over. A single complaint filed through that form is now enough to put a civil investigative demand on the table, which means the practical odds of an investigation just moved from theoretical to real for the first time since the statute took effect.

TRAIGA Applies With No Small-Business Exemption

Here's where the law is harsher than a lot of Texas business owners assume once they hear "new AI regulation." Some skip it, assuming it's aimed at big tech. It isn't.

TRAIGA reaches any person or entity that develops or deploys an AI system while doing business in Texas, advertising to Texans, or offering a product Texas residents use. There's no headcount cutoff and no revenue floor. That's a deliberate contrast with the state's own privacy law: the Texas Data Privacy and Security Act exempts businesses that qualify as "small" under SBA size standards, and TRAIGA doesn't borrow that carve-out anywhere in its text. If you're a five-person shop using an off-the-shelf AI tool to screen resumes or score leads, you're inside the statute the same as a Fortune 500 company. The size of your payroll was never the relevant question here.

The substantive prohibitions are narrower than that scope suggests, though. TRAIGA bans developing or deploying an AI system with the intent to unlawfully discriminate against a protected class, to manipulate someone into self-harm or crime, or to enable government social scoring. A disparate outcome alone isn't enough to prove a violation. Intent is the hook, which is a meaningfully higher bar than the impact-based standard some state AI laws use.

The Disclosure Duty Skips Private Businesses Entirely

Here's the part that runs the other direction: TRAIGA is more permissive for an ordinary business than most compliance checklists imply.

That's a genuine gap between TRAIGA and the state disclosure laws we've written about elsewhere, like Maine's and Utah's AI chatbot rules. Texas didn't join that group with this statute. If you're building an AI receptionist for a Texas-based business, TRAIGA is not the law forcing a disclosure script into your call flow. Some other state's rule, or the EU AI Act if you take EU calls, might still be. Check the actual trigger before you assume the wrong law is the one binding you, the same mistake we walked through when Adam's Law's companion-chatbot definition got misread as covering ordinary business bots in California.

The "Consumer" Portal Locks Out the People Most Likely to Be Harmed

This is the twist most coverage of the September 1 launch missed entirely, and it's worth reading slowly if you use AI anywhere near hiring or employee management.

TRAIGA's own definitions section is explicit: "'Consumer' means an individual who is a resident of this state acting only in an individual or household context. The term does not include an individual acting in a commercial or employment context." The Attorney General's site repeats that definition verbatim on the same page that hosts the complaint form.

A law that bans AI discrimination in hiring, then builds its complaint portal for a category of person that specifically excludes anyone employed, isn't a loophole. It's a design choice. Know which side of it your AI tools sit on.

— Arthur, Bunny Honey Club

Walk through what that means. A job applicant screened out by a résumé-ranking tool, or an employee flagged by an AI monitoring system, isn't acting in an "individual or household context." They're acting in an employment context, which the statute carves out of the "consumer" definition by name. That means they can't use the AG's new AI complaint portal over that harm. TRAIGA also provides no private right of action, so they can't sue under the statute directly either. The prohibition on intentional discrimination still exists on paper. The enforcement path for the person most likely to be hurt by it just isn't this one. They'd have to reach for Title VII, the Texas Labor Code, or another existing employment law, entirely apart from TRAIGA.

None of that makes an AI hiring tool a safe bet. It makes TRAIGA the wrong law to check your exposure against if hiring or employee monitoring is where you use AI. Existing discrimination law was already live before September 1 and doesn't share TRAIGA's carve-out.

The 60-Day Cure Window Is a Real Second Chance, Not a Formality

Give the statute credit where it's earned. If the AG's office finds a violation, Section 552.104 requires written notice and bars a lawsuit for 60 days after that notice, giving the business a window to fix the problem and document the fix. Several employment-law firms have flagged this as unusually business-friendly compared to statutes that skip straight to penalties.

Only after that window closes, or if the violation isn't curable at all, do the numbers get real: $10,000 to $12,000 per curable violation once cured too late, $80,000 to $200,000 for a violation the court decides can't be cured, and $2,000 to $40,000 for every day a violation keeps running. There's no cap on how many separate violations one bad AI deployment can generate, which is the detail that turns a single uncorrected tool into a genuinely expensive mistake.

What Actually Changes for a Texas Business Running AI

The honest checklist is shorter than most TRAIGA guides make it look, precisely because the disclosure duty and the "consumer" portal both apply more narrowly than headlines suggest.

If you deploy AI anywhere in your business, know what it's for and be able to show you didn't build or configure it with intent to discriminate, manipulate, or exploit. If that AI touches hiring, scoring, or employee monitoring, don't treat TRAIGA's narrow consumer-complaint portal as your whole exposure. Employment discrimination law was never waiting on this statute. If you're running an AI receptionist or chatbot, TRAIGA doesn't force a disclosure line into the script, but check whether a different state's law or the EU AI Act does, the way we broke down for lead qualification and routing tools. And if the AG's office ever does send written notice, treat the 60-day window as what it is: real time to fix the problem and produce a paper trail, not a countdown to a fine.

That paper trail is the part most off-the-shelf AI tools don't give you by default. A vendor's chatbot or scoring model wasn't built to hand you documentation proving your intent, or a clean audit log showing a human reviewed the output before it affected anyone. That's a build decision, not a checkbox in someone else's settings panel, and it's exactly what we wire into automation builds for clients who'd rather have that answer ready before the AG's office ever asks the question.

None of this is a reason to avoid AI in a Texas business. TRAIGA's intent standard, its cure period, and its narrow disclosure duty add up to a statute that punishes carelessness and bad faith, not the fact of using AI at all. The businesses that get hurt by it are the ones that never bothered to know what their own tools were doing.