Texas TRAIGA: Prohibited Practices, AG Enforcement, and the NIST Safe Harbor

On June 22, 2025, Governor Greg Abbott signed House Bill 149 — the Texas Responsible AI Governance Act, known by its acronym TRAIGA — into law. The statute took effect January 1, 2026. Texas is a consequential state for AI regulation because it chose a fundamentally different approach from Colorado, Connecticut, and the other states building comprehensive high-risk AI frameworks: TRAIGA is centered almost entirely on prohibitions rather than process obligations. It tells you what you cannot do with AI, gives the Attorney General (AG) broad enforcement authority backed by civil penalties ranging from $10,000 to $200,000 per violation, and then offers a structured safe harbor for organizations that implement recognized risk management frameworks like the NIST AI Risk Management Framework.

For businesses operating in Texas — or deploying AI to Texas consumers and employees — this post explains the prohibited practices, how the AG enforces the law, what the penalty structure actually means, and how to qualify for the NIST affirmative defense.

The Architecture of TRAIGA: Why Texas Chose a “Prohibited Practices” Model

Most state AI laws in 2024 and 2025 followed a duty-of-care model: they required developers and deployers of high-risk AI systems to implement risk management programs, conduct impact assessments, and notify consumers about automated decisions. Colorado’s original AI Act (now repealed) was the template. This approach created significant compliance costs, particularly for small and mid-sized businesses.

Texas took a different path, deliberately aligned with the Trump administration’s preference for a lighter federal AI regulatory touch. TRAIGA focuses on outcomes rather than process: rather than requiring you to implement a compliance program to prevent harm, it prohibits certain harmful applications outright and then gives the AG authority to investigate and sanction violations. The NIST safe harbor is the bridge — it gives compliance-oriented organizations a route to an affirmative defense while avoiding the prescriptive process obligations of other state laws.

The result is a law that business interests largely preferred: no mandatory algorithmic impact assessments, no state agency pre-approval of AI systems, no consumer opt-out rights from AI decisions. But the prohibited practices list, the civil investigative demand power, and the penalty structure create real compliance obligations that organizations should not underestimate.

The Prohibited Practices in Detail

TRAIGA prohibits the development and deployment of AI systems for specified purposes. The statute covers both private actors and government entities, with some prohibited practices applying exclusively to government use.

Intentional Harm to Persons

No entity may develop or deploy an AI system that intentionally aims to incite or encourage a person to commit physical self-harm, including suicide; harm another person; or engage in criminal activity. This prohibition targets AI systems designed with the purpose of causing personal injury. It is not a prohibition on AI systems that may incidentally be misused — the intent requirement limits the scope to purposeful bad actors. But it covers a range of potential products: AI systems designed to foster self-harm ideation, systems that incite violence, and systems built to facilitate crime.

Constitutional Rights Infringement

TRAIGA prohibits AI systems designed with the sole intent of infringing, restricting, or otherwise impairing a person’s constitutional rights. This provision is broad in concept but narrow in practice: the “sole intent” threshold is high, meaning most AI systems with incidental constitutional implications are outside the prohibition. The provision appears targeted at AI systems designed specifically for government or third-party repression of protected speech, association, or other first and second amendment rights.

Unlawful Discrimination

AI systems may not be used to unlawfully discriminate against a protected class in violation of state or federal law. This incorporates existing anti-discrimination law rather than creating a new AI-specific discrimination standard. Protected classes under Texas and federal law include race, color, national origin, sex, age, religion, and disability. The key word is “unlawfully” — TRAIGA does not create strict liability for disparate impact; it prohibits uses of AI that violate existing civil rights statutes. Organizations with AI systems that produce discriminatory outcomes need to analyze whether those outcomes constitute violations of applicable anti-discrimination law — and if they do, the AI system producing them now carries a separate TRAIGA violation.

Child Sexual Abuse Material and Unlawful Deepfakes

TRAIGA explicitly prohibits the use of AI to produce and distribute child sexual abuse material (CSAM) and AI-generated sexual content involving minors. It also prohibits the creation and distribution of deepfakes that are unlawful under Texas law — a category that Texas has separately expanded through its laws on non-consensual intimate visual material and election-related deepfakes.

Social Scoring by Government Entities

One of the more politically charged provisions restricts government entities from using AI to assign a social score — a numeric valuation or rating — to individuals based on their social behavior, personal characteristics, or predicted behavior, where that score would result in detrimental, disproportionate, or discriminatory treatment, or would infringe on constitutional rights. This provision directly addresses the concern, prominent in discussions of Chinese-style social credit systems, that government might use AI to create a surveillance and rating apparatus that controls access to services or imposes penalties on disfavored citizens.

The restriction applies to government entities; private entities are not covered by the social scoring prohibition. But the provision is more consequential than its limited scope suggests, because it restricts one of the most expansive potential uses of AI by state and local government agencies.

Biometric Identification Without Consent

TRAIGA restricts government entities from using AI to identify specific individuals through biometric data — such as facial recognition — that was scraped or collected from the internet without the individuals’ consent, for the purpose of uniquely identifying them.

The statute also amends the Texas Capture or Use of Biometric Identifiers Act (CUBI) to address a practice that had become common in AI development: web-scraping publicly available photographs to build training datasets for facial recognition and other biometric systems. TRAIGA clarifies that individuals do not consent to the capture and storage of their biometric data based solely on the existence of an image online, unless the person deliberately made the image publicly available for biometric identification purposes.

This biometric amendment has significant implications for AI developers using web-scraped image data for training. If the scraping and use of biometric data constitutes “capture and storage” under CUBI, the lack of consent creates a separate liability pathway — not just under TRAIGA’s prohibited practice but under CUBI’s private right of action.

AG Enforcement: Civil Investigative Demands and the Consumer Complaint Mechanism

TRAIGA does not create a private right of action. There is no individual lawsuit that a consumer, employee, or competitor can bring for a violation of the prohibited practices. Enforcement runs entirely through the Texas Attorney General.

The Consumer Complaint Portal

TRAIGA requires the AG to maintain an online mechanism through which individuals may submit complaints about potential violations. This is not a passive feature: the statute provides that if the AG receives a complaint through this mechanism, the AG may issue a civil investigative demand to determine whether a violation has occurred. A single consumer complaint is sufficient to initiate a CID.

Civil Investigative Demands

A CID under TRAIGA is modeled on the AG’s existing CID authority under the Texas Deceptive Trade Practices Act and the Business & Commerce Code (§ 15.10). The AG can demand extensive information from the recipient, including:

• A high-level description of the AI system’s purpose and intended use.
• A description of the types of data used to program or train the AI system.
• A high-level description of data processed as inputs and outputs produced by the system.
• Metrics used to evaluate the system’s performance and known limitations.
• A description of post-deployment monitoring and user safeguards.

The scope of a TRAIGA CID is broad by design. The AG is not simply asking whether you violated the law — the AG is gathering technical information about how your AI system works, what it does, and what safeguards you have in place. For organizations that have not documented their AI systems, responding to a CID can be operationally demanding.

Cure Period and Penalty Escalation

Before imposing civil penalties, the AG must provide the violating party with a notice of violation. The notice triggers a cure period — in most cases, 60 days — during which the party can remediate the violation. If the party takes prompt corrective action, the AG may resolve the matter without imposing maximum penalties.

But the cure period is not automatic, and it is not guaranteed for repeat violations. If a violation is not cured, or if it recurs after a cure has been completed, the AG can proceed to enforce civil penalties without a new cure period.

The Penalty Structure: $10,000 to $200,000 Per Violation

Civil penalties under TRAIGA range from $10,000 to $200,000 per violation. Several features of the penalty structure amplify the financial exposure for organizations that do not take compliance seriously:

Daily accrual: Penalties can accrue on a continuing, daily basis for ongoing violations. An AI system that operates in violation of a prohibited practice every day it is deployed could generate a separate violation (and a separate $10,000–$200,000 penalty) for each day of operation.

Per-violation measurement: If the AG frames the violation as affecting multiple individuals — each consumer subjected to an AI-driven discriminatory outcome, or each person whose biometric data was captured without consent — the penalties could theoretically be assessed on a per-person basis, dramatically increasing total exposure.

The ceiling scales to severity: The $200,000 upper limit provides the AG with headroom to impose significant penalties for willful, large-scale violations. Organizations that demonstrate they knew about a violation and failed to correct it face exposure at the higher end of the range.

For context: a company that deploys an AI hiring system that unlawfully discriminates against a protected class, runs it for 90 days, and is subject to $10,000/day penalties faces $900,000 in potential civil exposure before any per-applicant analysis. These numbers are not hypothetical — they represent the enforcement math that TRAIGA deliberately built into the statute.

The NIST AI Risk Management Framework Affirmative Defense

This is where TRAIGA distinguishes itself from a pure liability regime. The statute provides an affirmative defense to civil penalties for organizations that have taken specified steps to implement recognized AI risk management frameworks and that discover violations through their own review processes.

What the Affirmative Defense Requires

Under TRAIGA, a party has an affirmative defense to a violation if the party:

1. Substantially complies with the most current version of the NIST AI Risk Management Framework (NIST AI RMF 1.0, and its Generative AI Profile NIST AI 600-1) or another nationally or internationally recognized risk management framework for AI systems; and

2. Discovers the violation through internal review, adversarial testing, or documented compliance processes; and

3. Takes prompt corrective action after discovery.

The key word in element 1 is “substantially” — perfect compliance is not required, but the organization must have a real, implemented framework, not just a policy document. The NIST AI RMF is built around four core functions: Govern, Map, Measure, and Manage. An organization claiming the affirmative defense needs to demonstrate that it has implemented practices corresponding to each function.

What the NIST AI RMF Actually Requires

Govern: Establish organizational policies, roles, accountability structures, and governance processes for AI risk management. This includes designating who is responsible for AI risk decisions, creating board or C-suite visibility into AI risk, and building AI risk considerations into procurement and development processes.

Map: Identify and document AI risks in your specific deployment context. For each AI system that could fall within TRAIGA’s scope, document the system’s purpose, its potential failure modes, and the populations it affects.

Measure: Assess risks using quantitative and qualitative methods. Conduct bias testing for AI systems affecting protected classes. Document performance benchmarks, known limitations, and the evaluation methods used to assess them.

Manage: Implement controls to address identified risks and monitor their effectiveness over time. Establish incident response procedures for when AI systems produce unexpected or harmful outputs.

Acceptable Alternative Frameworks

TRAIGA does not require the NIST AI RMF specifically — it allows any “nationally or internationally recognized risk management framework.” Organizations that have already adopted ISO/IEC 42001 (the international AI management system standard) or sector-specific frameworks approved by relevant Texas agencies should evaluate whether those frameworks satisfy the affirmative defense requirements.

The Discovery-and-Cure Path

The affirmative defense is most powerful when an organization discovers a violation through its own risk management processes and corrects it promptly. An organization that finds a discriminatory outcome in its hiring AI system through adversarial testing, remediates the system, and documents the entire process is in a significantly stronger position than an organization that discovers the same problem through a consumer complaint after a CID arrives.

Building testing and monitoring into your AI governance program is not just compliance theater — it is the mechanism that activates the affirmative defense.

Government Entity Obligations

TRAIGA imposes obligations on Texas government entities that go beyond the prohibited practices list. State agencies and local government entities that develop, procure, or deploy AI systems must:

• Maintain an inventory of AI systems they use.
• Designate an AI officer or coordinator responsible for governance.
• Adopt policies for responsible AI use consistent with state guidance.

Private sector organizations that sell AI to Texas government should be aware that their government customers are subject to these requirements, which may flow through as procurement and contractual obligations — requiring vendors to provide documentation about the AI systems they sell to the state.

What Businesses Must Do Now

TRAIGA is already in effect. January 1, 2026 is in the past. If your business deploys AI systems in Texas or affecting Texas residents, the following steps apply today.

1. Map your AI use against the prohibited practices. Review your deployed AI systems against each of the seven prohibited practices. For each system, ask: could this system’s outputs constitute unlawful discrimination? Does it process biometric data of Texas residents? Does it interact with government systems in ways that implicate the social scoring prohibition?

2. Document your systems. Prepare high-level documentation for each AI system: its purpose, the data it processes, its outputs, and the human oversight in place. This documentation will be your starting point for a TRAIGA CID response and for building your NIST AI RMF compliance record.

3. Begin NIST AI RMF implementation. Even if you have not yet formally adopted the NIST framework, start building the four functions into your AI governance program now. A genuine Govern-Map-Measure-Manage structure — documented and practiced — is the foundation of your affirmative defense.

4. Implement adversarial testing for high-risk systems. For AI systems that affect employment, lending, housing, insurance, or other areas where discriminatory outcomes create TRAIGA exposure, commission or conduct adversarial testing and bias assessments. Document the methodology, results, and remediation steps.

5. Prepare your CID response capability. Identify who in your organization would lead a TRAIGA CID response. Ensure that person understands the scope of what the AG can demand and that the necessary technical documentation is accessible.

6. Review your biometric data practices. If your AI systems use facial recognition, voice recognition, or other biometric identifiers — or if your training data was assembled using web-scraped biometric data — conduct a CUBI compliance review in light of TRAIGA’s amendments.

The Bigger Picture: TRAIGA as a Model

Texas explicitly designed TRAIGA as a complement to the federal government’s preference for voluntary AI frameworks over mandatory compliance regimes. The prohibited-practices approach avoids the prescriptive obligations that the Trump administration has criticized in state AI laws, while still giving the AG meaningful enforcement authority over genuine harms. Several other states are watching Texas’s model closely, and there is reason to think TRAIGA’s structure — prohibited practices plus NIST safe harbor plus AG enforcement — may influence legislation in other red-leaning states.

For businesses operating nationally, the practical lesson from Texas is that even “light-touch” AI regulation carries real bite when the prohibited practices are clearly defined and the penalty structure is aggressive. The absence of a private right of action should not be mistaken for the absence of liability. The AG is a formidable enforcement counterparty, CID power is broad, and $10,000 to $200,000 per day per violation is not a nuisance penalty.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.