Texas AI Governance: What TRAIGA Means for Your Business
Texas's first comprehensive AI law took effect January 1, 2026. Most businesses don't have an AI policy — let alone a governed environment.
The Texas Responsible Artificial Intelligence Governance Act (TRAIGA, House Bill 149) was signed into law on June 22, 2025. Texas becomes the third state in the country with a comprehensive AI statute.
Here's what most coverage of TRAIGA gets wrong: for the average business, the law's direct prohibitions are not the real risk. The real risk is the AI your employees are already using — without a policy, without oversight, and without anyone tracking what data is going into it.
This guide explains what TRAIGA actually does, what it requires of private businesses, where the genuine exposure lies, and the five questions every leadership team should be able to answer today.
What the Law Does — and Who It Applies To
TRAIGA is enforced by the Texas Attorney General — there is no private right of action, so individuals cannot sue your business directly under the statute. It defines an "artificial intelligence system" broadly: any machine-based system that infers from inputs how to generate outputs, including content, decisions, predictions, or recommendations. That captures everything from ChatGPT to the AI features quietly embedded in software your team already uses.
Most businesses
No General Disclosure Duty
Private businesses using mainstream AI tools
Required: no general AI disclosure.
Unlike laws in the EU or Colorado, Texas does not require you to label every AI interaction or disclose AI use to job applicants and employees. That was in earlier drafts; it was removed from the final version.
Everyone
Intent-Based Prohibitions
Anyone developing or deploying an AI system
Prohibited: AI built or used with intent to cause harm.
TRAIGA prohibits developing or deploying AI with the intent to manipulate people into self-harm or crime, to unlawfully discriminate against a protected class, or to produce certain illegal content. Disparate impact alone does not establish intent. For mainstream AI tools, this is a high bar.
Healthcare
Patient-Facing Disclosure
Providers of healthcare services
Required: clear and conspicuous AI disclosure.
Healthcare is the exception. Providers must clearly and conspicuously disclose their use of AI systems in certain patient-facing contexts. If you operate a medical or dental practice, this applies directly to you.
So if the direct penalties aren't the main threat for most businesses — what is? The AI already in use across your business, ungoverned.
The Exposure Most Businesses Are Ignoring
TRAIGA matters less because of what it directly penalizes and more because of what it signals: AI is now a regulated risk surface in Texas. The era of employees using whatever AI tool they want, with whatever data they want, is ending — driven not just by TRAIGA but by data security, professional responsibility, and client demands. The genuine exposure for a 10–50 person business looks like this:
Shadow AI
Your employees are already using ChatGPT, Gemini, Claude, and a dozen embedded AI features. Most leadership teams cannot name which tools, used by whom, with what data.
Confidentiality and privilege
An employee pastes a client's confidential information, a privileged document, or protected health information into a public AI tool. That data may now be outside your control — and in regulated professions, that's a reportable problem.
Discrimination liability
AI used in hiring, lending, or customer decisions can produce discriminatory outcomes that expose you under civil-rights laws that already exist — TRAIGA simply sharpens the focus.
Client and contract requirements
Your customers are starting to ask: "What's your AI policy?" Increasingly it's a line item in vendor security questionnaires and contracts. "We don't have one" is becoming a deal-breaker.
The documentation gap
If a regulator, client, or court asks how you govern AI, "we trust our people" is not an answer. You need a documented, enforced policy.
The common thread
None of these require a TRAIGA violation to hurt you. All of them are happening in Texas businesses right now.
Governed AI Isn't a Ban. It's Control.
Banning AI doesn't work — your team will use it anyway, just invisibly. The answer is the same as every other risk surface we operate: make it controlled, enforced, and documented. A governed AI environment has four components:
Component 1
An AI Acceptable-Use Policy
A written, plain-language policy defining which AI tools are approved, what data may and may not be entered, and who is accountable. The single document most likely to be requested by a client or regulator — and the one most businesses don't have.
Component 2
Shadow-AI Discovery
Identifying which AI tools your employees are actually using, through network and Microsoft 365 visibility. You cannot govern what you cannot see.
Component 3
Data-Loss-Prevention Controls
Technical guardrails that prevent sensitive data — client records, financials, protected health information — from being entered into unapproved AI tools in the first place.
Component 4
Approved-Tool Configuration
Properly configuring the AI tools you do sanction — Microsoft 365 Copilot and similar — so data boundaries, retention, and permissions are set correctly rather than left on default.
Documented. Enforced. Reviewed. The same operating discipline we apply to identity, email, and endpoints — extended to the newest risk surface.
Five Questions Every Leadership Team Should Be Able to Answer
Do we have a written AI acceptable-use policy?
If the answer is "no" or "it's informal," you have a documentation gap that clients and regulators will increasingly probe.
Do we actually know which AI tools our employees are using?
Not which ones you've approved — which ones they're actually using. The gap between those two is where the risk lives.
Can sensitive or client data be pasted into a public AI tool right now?
For most businesses, the honest answer is yes, with nothing stopping it. That's the exposure.
If we're in healthcare, do we disclose AI use where TRAIGA requires it?
This is a direct legal obligation for healthcare providers, effective January 1, 2026.
Can we document our AI governance if a regulator, client, or court asks?
A policy you can't produce, and controls you can't prove, provide no protection.
Five confident answers means you're ahead of the curve. Anything less is exposure that compounds the longer it goes ungoverned.
Our Role
Total 360 Technology implements and operates the technical guardrails that make AI use governed instead of ungoverned — and the documentation that shows it.
What an AI governance engagement delivers:
- AI acceptable-use policy — approved tools, data rules, and named accountability, written in plain language.
- Shadow-AI discovery — the AI tools actually in use across your environment, by whom.
- Data-loss-prevention controls — guardrails that keep sensitive and client data out of unapproved tools.
- Approved-tool configuration — Copilot and similar tools set up with the right data boundaries, retention, and permissions.
- Ongoing review — the policy and controls kept current and documented, not stood up once.
AI is the newest surface in a category we already operate: technology that creates risk. We govern it the same way we govern everything else — structurally, continuously, and on the record.
Where TRAIGA fits in our work
Need AI risk owned at the leadership level?
Total 360 Security runs the governance layer.
A fractional Chief AI Security Officer to own AI policy, risk decisions, and board reporting — while we operate the controls on the ground.
TRAIGA's obligations depend on what you do with AI. Find your situation, then look at what closing the gap actually takes.
Using mainstream AI tools
No direct disclosure duty
The prohibitions are intent-based and a high bar. The exposure is shadow AI, data leakage, and the missing policy.
An acceptable-use policy and basic discovery close most of the gap. An AI Governance Review tells you where you stand. Schedule it →
Healthcare providers
Patient-facing AI disclosure
A direct legal obligation since January 1, 2026, on top of the protected health information already at risk in public AI tools.
Disclosure language, PHI guardrails, and documented controls. This is where governed AI matters most. See healthcare →
AI in hiring, lending, or customer decisions
Discrimination exposure
TRAIGA requires intent, but existing civil-rights laws do not. Outcomes from AI-assisted decisions are already reviewable.
Documented tool approval, data rules, and human review points. Your counsel sets the policy; we enforce it. Talk it through →
The one document nobody has, and client questionnaires are starting to ask for it
A written AI acceptable-use policy. Ask your team for it today — if they can produce it, you are further along than most. If they cannot, you are in the majority. Most businesses adopted AI tools before anyone wrote down the rules.
An AI Governance Review maps the AI tools in use across your environment, identifies where sensitive data can leak, and gives you a documented baseline and a draft acceptable-use policy.
Schedule an AI Governance Review →TRAIGA (House Bill 149) is enforced by the Texas Attorney General; there is no private right of action. Civil penalties run $10,000 to $200,000 per violation and $2,000 to $40,000 per day for continuing violations, and some violations carry a 60-day cure period. This page is not a substitute for legal advice. Effective January 1, 2026.
The AI Governance Readiness Checklist
Free Download - complete the form below
The AI Governance Readiness Checklist
A one-page checklist covering the policy, discovery, control, and documentation elements of a governed AI environment — plus the TRAIGA healthcare disclosure flag. Designed for a leadership team to complete in 15 minutes and review with IT and counsel.
Free. No sales call required to download. We'll send the link to the checklist as soon as you submit a valid business email address via the form below.
Find Out Where Your AI Exposure Actually Is
An AI Governance Review maps the AI tools in use across your environment, identifies where sensitive data can leak, and gives you a documented baseline and a draft acceptable-use policy. You leave knowing exactly where you stand.