Texas AI Governance: What TRAIGA Means for Your Leadership Team
Texas's first comprehensive AI law took effect January 1, 2026. Most businesses don't have an AI policy — let alone a governed environment.
The Texas Responsible Artificial Intelligence Governance Act (TRAIGA, House Bill 149) was signed into law on June 22, 2025. Texas becomes the third state in the country with a comprehensive AI statute.
Here's what most coverage of TRAIGA gets wrong: for the average business, the law's direct prohibitions are not the real risk. The real risk is the AI your employees are already using — without a policy, without oversight, and without anyone tracking what data is going into it.
This guide explains what TRAIGA actually does, what it requires of private businesses, where the genuine exposure lies, and the five questions every leadership team should be able to answer today.
What the Law Does — and Who It Applies To
TRAIGA is enforced by the Texas Attorney General — there is no private right of action, so individuals cannot sue your business directly under the statute. It defines an "artificial intelligence system" broadly: any machine-based system that infers from inputs how to generate outputs, including content, decisions, predictions, or recommendations. That captures everything from ChatGPT to the AI features quietly embedded in software your team already uses.
Most businesses
No General Disclosure Duty
Private businesses using mainstream AI tools
Required: no general AI disclosure.
Unlike laws in the EU or Colorado, Texas does not require you to label every AI interaction or disclose AI use to job applicants and employees. That was in earlier drafts; it was removed from the final version.
Everyone
Intent-Based Prohibitions
Anyone developing or deploying an AI system
Prohibited: AI built or used with intent to cause harm.
TRAIGA prohibits developing or deploying AI with the intent to manipulate people into self-harm or crime, to unlawfully discriminate against a protected class, or to produce certain illegal content. Disparate impact alone does not establish intent. For mainstream AI tools, this is a high bar.
Healthcare
Patient-Facing Disclosure
Providers of healthcare services
Required: clear and conspicuous AI disclosure.
Healthcare is the exception. Providers must clearly and conspicuously disclose their use of AI systems in certain patient-facing contexts. If you operate a medical or dental practice, this applies directly to you.
So if the direct penalties aren't the main threat for most businesses — what is? The AI already in use across your business, ungoverned.
The Exposure Most Businesses Are Ignoring
TRAIGA matters less because of what it directly penalizes and more because of what it signals: AI is now a regulated risk surface in Texas. The era of employees using whatever AI tool they want, with whatever data they want, is ending — driven not just by TRAIGA but by data security, professional responsibility, and client demands. The genuine exposure for a 10–50 person business looks like this:
Shadow AI
Your employees are already using ChatGPT, Gemini, Claude, and a dozen embedded AI features. Most leadership teams cannot name which tools, used by whom, with what data.
Confidentiality and privilege
An employee pastes a client's confidential information, a privileged document, or protected health information into a public AI tool. That data may now be outside your control — and in regulated professions, that's a reportable problem.
Discrimination liability
AI used in hiring, lending, or customer decisions can produce discriminatory outcomes that expose you under civil-rights laws that already exist — TRAIGA simply sharpens the focus.
Client and contract requirements
Your customers are starting to ask: "What's your AI policy?" Increasingly it's a line item in vendor security questionnaires and contracts. "We don't have one" is becoming a deal-breaker.
The documentation gap
If a regulator, client, or court asks how you govern AI, "we trust our people" is not an answer. You need a documented, enforced policy.
The common thread
None of these require a TRAIGA violation to hurt you. All of them are happening in Texas businesses right now.
Governed AI Isn't a Ban. It's Control.
Banning AI doesn't work — your team will use it anyway, just invisibly. The answer is the same as every other risk surface a security program governs: make it controlled, enforced, and documented. A governed AI environment has four components:
Component 1
An AI Acceptable-Use Policy
A written, plain-language policy defining which AI tools are approved, what data may and may not be entered, and who is accountable. The single document most likely to be requested by a client or regulator — and the one most businesses don't have.
Component 2
Shadow-AI Discovery
Identifying which AI tools your employees are actually using, through network and Microsoft 365 visibility. You cannot govern what you cannot see.
Component 3
Data-Loss-Prevention Controls
Technical guardrails that prevent sensitive data — client records, financials, protected health information — from being entered into unapproved AI tools in the first place.
Component 4
Approved-Tool Configuration
Properly configuring the AI tools you do sanction — Microsoft 365 Copilot and similar — so data boundaries, retention, and permissions are set correctly rather than left on default.
Documented. Enforced. Reviewed. The same discipline a well-run security program applies to identity, email, and endpoints — extended to the newest risk surface.
Five Questions Every Leadership Team Should Be Able to Answer
Do we have a written AI acceptable-use policy?
If the answer is "no" or "it's informal," you have a documentation gap that clients and regulators will increasingly probe.
Do we actually know which AI tools our employees are using?
Not which ones you've approved — which ones they're actually using. The gap between those two is where the risk lives.
Can sensitive or client data be pasted into a public AI tool right now?
For most businesses, the honest answer is yes, with nothing stopping it. That's the exposure.
If we're in healthcare, do we disclose AI use where TRAIGA requires it?
This is a direct legal obligation for healthcare providers, effective January 1, 2026.
Can we document our AI governance if a regulator, client, or court asks?
A policy you can't produce, and controls you can't prove, provide no protection.
Five confident answers means you're ahead of the curve. Anything less is exposure that compounds the longer it goes ungoverned.
Where We Stand
Total 360 Security designs and oversees the AI governance program — the policy, the risk decisions, the accountability, and the documentation that shows your leadership team governs AI on purpose.
What a vCAISO engagement delivers against TRAIGA:
- AI acceptable-use policy — approved tools, data rules, and named accountability, ratified by leadership.
- AI risk assessment — where AI is used across the business, what data it touches, and which uses need review.
- Decision rules for high-risk uses — hiring, lending, customer decisions, and patient-facing AI, with human review points your counsel can stand behind.
- Quarterly board-ready reporting — AI governance treated as an ongoing program, not a one-time policy.
- Compass-backed evidence repository — policies, approvals, and reviews in one defensible record.
This is the program-level oversight that turns AI adoption into a governed, documented risk surface.
Where TRAIGA fits in our work
Need the guardrails operationally enforced?
Total 360 Technology runs the IT operations layer.
Shadow-AI discovery, data-loss-prevention controls, and approved-tool configuration that make your AI policy real on the ground.
TRAIGA's obligations depend on what you do with AI. Find your situation, then look at what closing the gap actually takes.
Using mainstream AI tools
No direct disclosure duty
The prohibitions are intent-based and a high bar. The exposure is shadow AI, data leakage, and the missing policy.
An acceptable-use policy and basic discovery close most of the gap. A Risk Discussion tells you where you stand. Schedule it →
Healthcare providers
Patient-facing AI disclosure
A direct legal obligation since January 1, 2026, on top of the protected health information already at risk in public AI tools.
Disclosure decisions, PHI rules, and documented oversight. This is where governed AI matters most. See healthcare →
AI in hiring, lending, or customer decisions
Discrimination exposure
TRAIGA requires intent, but existing civil-rights laws do not. Outcomes from AI-assisted decisions are already reviewable.
Documented tool approval, decision rules, and human review points. A vCAISO owns the program. See the vCAISO →
The one document nobody has, and client questionnaires are starting to ask for it
A written AI acceptable-use policy. Ask your team for it today — if they can produce it, you are further along than most. If they cannot, you are in the majority. Most businesses adopted AI tools before anyone wrote down the rules.
A vCAISO engagement starts with exactly that: an AI risk assessment and a draft acceptable-use policy your leadership team can ratify, with the operating controls handed to your IT provider or to Total 360 Technology.
See the vCAISO program →TRAIGA (House Bill 149) is enforced by the Texas Attorney General; there is no private right of action. Civil penalties run $10,000 to $200,000 per violation and $2,000 to $40,000 per day for continuing violations, and some violations carry a 60-day cure period. This page is not a substitute for legal advice. Effective January 1, 2026.
The AI Governance Readiness Checklist
Free Download
The AI Governance Readiness Checklist
A one-page checklist covering the policy, discovery, control, and documentation elements of a governed AI environment — plus the TRAIGA healthcare disclosure flag. Designed for a leadership team to complete in 15 minutes and review with IT and counsel.
Free. No sales call required to download. Request it with a valid business email address and we'll send you the link.
Get the checklist →Find Out Where Your AI Exposure Actually Is
A Risk Discussion maps how AI is being used across your business, where sensitive data can leak, and what your leadership team would need to show a regulator, client, or court. You leave knowing exactly where you stand.
Schedule a Risk Discussion