Texas AI Law (TRAIGA, HB 149): A 2026 Small Business Checklist

HB 149 is a short statute with a wide definition and a narrow set of prohibitions.

The Texas AI law is the Texas Responsible Artificial Intelligence Governance Act, passed as HB 149 by the 89th Texas Legislature and in effect since January 1, 2026. HB 149 adds an Artificial Intelligence Protection subtitle to the Texas Business & Commerce Code, bans a short list of intentional AI misuses, and gives enforcement to the Texas attorney general alone.

Section 551.001 defines an artificial intelligence system as "any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments." That wording covers a chatbot, a meeting transcription tool and the scoring features built into accounting, hiring and customer software.

Section 551.002 applies the subtitle to a person who does any of the following:

• Promotes, advertises or conducts business in Texas.
• Produces a product or service used by Texas residents.
• Develops or deploys an artificial intelligence system in Texas.

The Texas House passed HB 149 on April 23, 2025 by a vote of 146 to 3. The Senate passed an amended version on May 23, 2025 by 31 to 0, and the House concurred on May 30, 2025 by 121 to 17. The act set a second date as well: the attorney general had until September 1, 2026 to post an online complaint mechanism.

HB 149 does 3 other things a Houston business should know. Section 552.003 preempts any city or county rule on the use of AI systems, so a business in Katy, Sugar Land or The Woodlands follows one statewide rule. Chapter 553 creates a regulatory sandbox, run by the Texas Department of Information Resources, where an approved participant can test an AI system for up to 36 months. Chapter 554 creates a 7-member Texas Artificial Intelligence Council, which under Section 554.103 may not adopt binding rules.

The statute names who each rule binds. Reading it rule by rule removes most of the worry.

HB 149 puts its consumer disclosure, social scoring and biometric identification rules on government, and puts 4 intent-based prohibitions on every person. A private Houston business is also reached by the health care AI disclosure in Section 552.051(f) and by the biometric consent rule in Section 503.001 of the Business & Commerce Code.

The table below lists each HB 149 rule, the section it sits in, who the section binds, and what the rule means for a private Houston business.

Houston has a large health care sector, and Section 552.051(f) is the rule most likely to touch a Houston practice in daily operations. A dental office, clinic or therapy practice that uses an AI system in relation to a health care service or treatment has a disclosure duty that a CPA practice or engineering firm using the same software does not.

The enforcement chapter is a fixed sequence, and each step is something a business can prepare for.

The Texas attorney general has exclusive authority to enforce HB 149, and Section 552.101 states that the law creates no private right of action. Enforcement follows a fixed sequence: a consumer complaint filed online, a civil investigative demand, a written notice of violation, 60 days to cure, and a civil penalty only if the violation is not cured.

Section 552.102 requires the attorney general to maintain an online mechanism for consumer complaints. As of October 8, 2026, the attorney general's File a Consumer Complaint page lists an AI complaint form for concerns that an AI system "is being developed or deployed in a way that violates Texas law."

On a complaint, Section 552.103 lets the attorney general issue a civil investigative demand. The demand can request 7 named categories of information, plus other relevant documentation:

• A high-level description of the purpose, intended use, deployment context and associated benefits of the AI system.
• A description of the type of data used to program or train the system.
• A high-level description of the categories of data processed as inputs.
• A high-level description of the outputs the system produces.
• Any metrics the business uses to evaluate the system's performance.
• Any known limitations of the system.
• A high-level description of post-deployment monitoring and user safeguards, including, for a deployer, the oversight, use and learning process set up to address issues.

Section 552.104 then requires written notice naming the specific provisions at issue. The attorney general may not bring an action before the 60th day after that notice, or at all if the business cures the violation within the 60 days and sends a written statement that it has cured the violation, supplied supporting documentation and changed internal policies to prevent a repeat.

Civil penalties under Section 552.105 are $10,000 to $12,000 for each curable violation, $80,000 to $200,000 for each uncurable violation, and $2,000 to $40,000 for each day a violation continues. The attorney general can also seek an injunction and recover attorney's fees and costs. For a business licensed, registered or certified by a Texas agency, Section 552.106 lets that agency add sanctions on the attorney general's recommendation, including license suspension or revocation and a monetary penalty of up to $100,000. That reaches Houston CPA practices, engineering firms and medical practices.

Section 552.105 also writes in defenses. The statute presumes a person used reasonable care unless shown otherwise. A defendant may not be found liable if another person misuses its AI system, or if the defendant discovers a violation through feedback, through testing such as red-team testing, by following state agency guidelines, or through an internal review process while substantially complying with the NIST Generative Artificial Intelligence Profile or another recognized AI risk management framework.

In 35+ years of IT work I have watched new rules reach small businesses the same way each time. The business that struggles is the one that cannot show, in writing, what it was doing.

The checklist follows the statute: each step produces a document the attorney general can request or a defense the law recognizes.

A Houston small business prepares for the Texas AI law by building one written AI record that answers the 7 categories of information the attorney general can request under Section 552.103. The record lists each AI tool, its purpose, its data, its limits, the rules staff follow and the framework used to review it.

• List every AI system in use, measured against the Section 551.001 definition. Include AI features inside software the business already pays for and accounts staff opened on their own.
• Write each tool's purpose and intended use in 2 or 3 plain sentences. Section 552.103(b)(1) asks for exactly this.
• Record the data going in and the outputs coming out. Sections 552.103(b)(2) to (4) cover training data, input categories and outputs. For a purchased tool, keep the vendor's documentation.
• Note how the business judges each tool and where the tool fails. Sections 552.103(b)(5) and (6) ask for performance metrics and known limitations.
• Write the use and oversight policy: who may use which tool with which data, who reviews the output, and how staff report a problem. Section 552.103(b)(7) calls this the oversight, use and learning process.
• Review the record against a recognized framework and date the review. Section 552.105(e) names the NIST Generative Artificial Intelligence Profile.
• Check the 2 rules that reach private businesses directly: the health care disclosure in Section 552.051(f) and biometric consent under Section 503.001. Also review any tool that makes decisions about people.
• Name the person who answers an attorney general notice, and put the 60-day cure period in Section 552.104 on that person's calendar the day a notice arrives.

The NIST Generative Artificial Intelligence Profile is NIST AI 600-1, published by the National Institute of Standards and Technology on July 26, 2024. HB 149 refers to "the most recent version," so the review should name the version it used. The statute's standard is substantial compliance, which a 40-person firm can meet with a short written review and without an outside certification.

Start with the inventory. Every later step depends on knowing which tools exist, and a SaaS audit usually finds AI accounts the owner did not know about. The same record answers the AI questions that now appear on customer security reviews, which CinchOps covers in its guide to responding to a security questionnaire.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

CinchOps is an IT provider, not a law firm, and the legal reading of HB 149 belongs with a Texas attorney. The written AI record is IT work: finding the accounts, documenting the data and enforcing the policy. AI policy and compliance projects are scoped by an audit and quoted after it. The published CinchOps managed IT rate is a flat $100 to $250 per user per month under Zero-Zero-Zero terms: no long-term contracts, no hidden fees, no cancellation penalties.

• A SaaS audit and shadow IT discovery finds every AI account in use, which is the first line of the record.
• AI policy and governance writes the rules and the record: purpose, data, limits, oversight and the framework review.
• AI training and user adoption teaches staff the policy, and AI security and risk management monitors the accounts and devices the tools run on.
• Compliance services and cybersecurity with 24/7 threat monitoring sit under the record, and help desk requests are answered in under 15 minutes during office hours.
• Managed IT in Houston, Katy, Sugar Land and Cypress, with programs for CPA firms, law firms and engineering firms.

HB 149 is a narrow law, and a Houston business that uses AI for ordinary office work is unlikely to break one of its prohibitions. The exposure is being unable to describe that ordinary use in writing when a complaint lands. Write the record this quarter, while nobody is asking for it. To see what that takes for your headcount, talk to CinchOps.