TRAIGA: Texas and AI

With no comprehensive federal AI law, regulation falls to the states, and Texas has joined a growing number now regulating AI, especially in healthcare. The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), previously House Bill 149, took effect January 1, 2026, and carries specific obligations for anyone using AI in patient care. TRAIGA also reshaped Texas's longstanding biometric privacy law. Healthcare providers need to understand both.

TRAIGA broadly applies to any person or entity that develops or deploys an AI system in Texas; produces a product or service used by Texas residents; or promotes, advertises, or conducts business in the state. The statute broadly defines "artificial intelligence system," covering chatbots and generative tools as well as recommendation algorithms, diagnostic aids, imaging analysis, and other machine-based systems whose outputs influence real-world decisions.

If an AI system is used in relation to a health care service or treatment, the provider must give the patient (or the patient's personal representative) a clear and conspicuous written disclosure no later than the date the service or treatment is first provided. In an emergency medical situation, the disclosure may be made as soon as reasonably possible. The notice must be written in plain language and cannot rely on manipulative design or "dark patterns," which are user interfaces designed to manipulate or mislead a user into taking an action they might not otherwise have taken.

Beyond disclosure, TRAIGA prohibits deploying AI with the specific intent to unlawfully discriminate based on protected characteristics, though disparate impact alone does not establish discriminatory intent. TRAIGA also categorically prohibits developing or deploying an AI system that intentionally aims to incite or encourage a person to physically harm themselves or others or to engage in criminal activity, or that is intended to infringe, restrict, or otherwise impair a person's constitutional rights.

The Texas Attorney General has exclusive enforcement authority, meaning there is no private right of action under TRAIGA. Penalties range from $10,000 to $200,000 per TRAIGA violation, and certain violations can accrue on a daily basis. The statute provides a 60-day cure period after receiving a notice of violation from the Texas Attorney General as well as safe-harbor protection for organizations that document compliance with recognized frameworks such as the National Institute of Standards and Technology (NIST) AI Risk Management Framework.

TRAIGA also amended the Capture or Use of Biometric Identifier Act (CUBI), Texas's 2009 biometric privacy statute. CUBI has always required notice and consent before capturing a person's biometric identifier (e.g., retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry) for a commercial purpose.

More pertinently, TRAIGA tightened CUBI's consent requirements: the mere presence of a person's image on the internet or another public source does not, by itself, constitute notice to that individual or consent by that individual to capture the biometric identifiers the image contains, unless the individual made that media publicly available. TRAIGA further exempted from CUBI's capture-and-consent requirements the training, processing, or storage of a biometric identifier to develop or deploy an AI system, unless that system is deployed to uniquely identify a specific individual. TRAIGA also added a related carve-out for security and fraud prevention purposes.

For providers using facial recognition, voice analysis, or biometric patient-identification tools, consent still governs identification, and vendor arrangements warrant a fresh review.

TRAIGA is not the only Texas law pertaining to healthcare and AI usage. Senate Bill 1188 took effect in September 2025, governs electronic health records, and requires practitioner review of AI-generated records and recommendations, creating a dual transparency framework. Under SB 1188, a health provider may use AI for diagnosis or treatment only if: (a) they stay within the scope of their medical license, whether or not they use AI; (b) no other law bars that particular AI usage; and (c) they review all AI-generated records under the standards set by the Texas Medical Board. SB 1188 also mandates data localization and bars physical offshoring of electronic medical records by providers, vendors, and cloud service providers. Covered entities must also limit record access to staff who need it for treatment, payment, or operations, and maintain reasonable administrative, physical, and technical safeguards to keep patient data confidential, accurate, and available.

Providers should: (a) map where AI touches patient care; (b) build standardized disclosure language and supporting documentation; (c) audit their AI vendors; and (d) update governance policies and staff training. Because neither TRAIGA nor SB 1188 provides a model disclosure form, providers must build that compliance framework themselves.

Disclaimer: This industry insight is for general information only, is not legal advice, and does not create an attorney-client relationship.