Texas has passed the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), establishing new rules for the use of artificial intelligence and biometric technologies in both government and select private-sector contexts. Signed by Governor Greg Abbott on June 22, 2025, the legislation will take effect on January 1, 2026.
The law prohibits specific uses of AI, such as systems that generate exploitative content or intentionally discriminate, and bars state and local agencies from implementing social-scoring systems. While earlier drafts contemplated broader oversight for private-sector AI applications, the final law restricts most obligations to government agencies and defines a narrow list of prohibited uses that apply across the board.
Biometric Clarifications and Commercial Consent
TRAIGA also amends the state’s existing Capture or Use of Biometric Identifiers (CUBI) Act, originally enacted in 2009. The new provisions clarify that informed consent is required before biometric identifiers can be captured for commercial purposes, and that such consent cannot be presumed solely from the presence of an image online unless the individual has made it publicly available themselves.
The updated statute includes exemptions for biometric use in security and antifraud systems, as well as for training AI models when the goal is not to uniquely identify individuals. These clarifications respond to concerns raised by the private sector following high-profile enforcement actions under CUBI, including a $1.4 billion settlement with Meta over facial recognition tagging in 2024.
“What is the most significant for the security industry is the clarity H.B. 149 additionally brings to other Texas laws on biometrics,” noted the Security Industry Association in its analysis of the legislation.
Enforcement and Implementation
Only the Texas Attorney General has the authority to enforce TRAIGA, with no private right of action available. Civil penalties range from $10,000 to $200,000 per violation, with daily fines for continued non-compliance. To encourage compliance, TRAIGA includes a safe-harbor provision: organizations following recognized AI risk-management frameworks, such as NIST’s AI RMF, may use that adherence as a defense.
The law also establishes a regulatory sandbox program managed by the Texas Department of Information Resources. This initiative allows for limited pilot deployments of AI systems under relaxed regulatory conditions, offering companies a controlled environment to experiment with new technologies.
Although TRAIGA stops short of broad mandates on private-sector AI use, it places Texas among a growing number of states introducing tailored legislation to govern emerging technologies. Colorado passed the first comprehensive AI law in 2024, while California and Utah have introduced narrower disclosure requirements. Meanwhile, a draft federal proposal circulating in the U.S. House of Representatives would pause state-level AI laws for up to a decade, raising the possibility of pre-emption battles ahead.
With TRAIGA’s effective date set for January 2026, public agencies and regulated entities in Texas have several months to align their operations with the new framework.
Sources: Security Industry Association, K&L Gates, Texas Legislature
–
By Cass Kennedy
