What TRAIGA Is—and What It Is Not
The Texas Responsible Artificial Intelligence Governance Act, or TRAIGA, is the subject of this series. The central question is not simply whether Texas regulates artificial intelligence; it is what kind of regulatory system Texas has enacted, and how that system differs from the high-risk model commonly associated with Colorado. Answering that question gives readers a practical way to tell which actor, use, and consequence a Texas rule actually reaches—without mistaking a broad label for a legal conclusion.
That distinction matters because “AI law” can describe very different instruments. One law may require developers and deployers to assess and manage risks throughout the life of a system. Another may prohibit a person from using a system for a specified purpose, require a government agency to disclose that a consumer is interacting with AI, or give an enforcement agency power to investigate after a complaint. These instruments may address overlapping public concerns, but they do not create the same work, the same rights, or the same exposure.
TRAIGA is best understood as a connected set of levers rather than a single test that every AI system must pass.
The name of the law is not the model
H.B. 149 is formally titled the Texas Responsible Artificial Intelligence Governance Act. The enrolled text creates an “Artificial Intelligence Protection” subtitle in the Texas Business & Commerce Code and states that the Act takes effect January 1, 2026. Its stated purposes are broad: encourage responsible development and use, protect individuals and groups from known and reasonably foreseeable AI risks, provide transparency about risks, and give reasonable notice about state-agency use of AI.
Broad purposes do not, by themselves, answer what a company, agency, or provider must do. The operative provisions determine that. TRAIGA defines an AI system broadly as a machine-based system that infers from inputs how to generate outputs—including content, decisions, predictions, or recommendations—that can influence physical or virtual environments. It then reaches people who conduct business in Texas, produce a product or service used by Texas residents, or develop or deploy an AI system in the state. That perimeter is intentionally substantial.
But the provisions inside that perimeter are not interchangeable. The statute distinguishes a developer, who develops a system provided in Texas, from a deployer, who deploys a system for use in the state. It defines a consumer as a Texas resident acting in an individual or household context, excluding someone acting in a commercial or employment context. It defines governmental entities separately and excludes specified hospital districts and institutions of higher education. Those distinctions are not drafting trivia. They tell us whose conduct a particular section addresses.
The supplied comparison places Texas H.B. 149 in a “Government Use/Liability” category. It places Colorado S.B. 205, described there as the Colorado AI Act, in a “High-Risk AI” category. The chart describes Colorado's model as applying to developers and deployers of high-risk systems used in consequential decisions such as education, employment, and health care. It highlights reasonable-care duties, role-specific disclosures, assessments, risk management, and consumer rights to explanation, correction, and appeal after an adverse decision.
That is a different regulatory center of gravity. It does not follow that one state is simply serious about AI and the other is not. It means that the first question differs. A Colorado-style analysis, as summarized in the supplied material, begins by asking whether a system is high-risk and used in a consequential decision, then moves into lifecycle duties. A TRAIGA analysis begins by asking who is acting, what the system is being used or developed to do, whether a specified intent or purpose is present, and which institutional or sector rule applies.
This is why the title's claim is about architecture, not a political scorecard. A system can be important without falling under the same legal category in both states. A law can contain risk-management concepts without turning every deployment into a high-risk assessment. And a law can impose meaningful constraints without giving individuals every remedy found in another jurisdiction.
A map with several levers
The first lever is a set of substantive boundaries. TRAIGA prohibits a person from developing or deploying an AI system in a manner that intentionally aims to encourage physical self-harm, harm to another person, or criminal activity. It bars development or deployment with the sole intent to infringe, restrict, or impair constitutional rights. It addresses unlawful discrimination, certain sexually explicit or child-related content, and specified deepfake conduct. These rules are significant, but their language matters: they use terms such as “intentionally aims,” “sole intent,” and “intent to unlawfully discriminate.” They are not written as a general promise that every possible harmful output will be prevented.
Other boundaries are actor-specific. A governmental entity may not use or deploy AI for certain forms of social scoring. A governmental entity also faces a biometric-identification restriction when it develops or deploys AI to uniquely identify a specific person using biometric data or gathered public images or media without consent, where the gathering would infringe a constitutional or statutory right. The Act's biometric amendments also distinguish AI training and model development from later commercial use and identification. “Publicly available” is not automatically the same as informed consent for commercial biometric capture.
The second lever is targeted disclosure. A governmental agency that makes available an AI system intended to interact with consumers must disclose, before or at the interaction, that the consumer is interacting with an AI system. The notice must be clear, conspicuous, and in plain language, and it may not use a dark pattern. A separate health-care provision requires a provider to disclose AI use in relation to health-care service or treatment no later than the first date of service, or as soon as reasonably possible in an emergency.
The wording creates an important boundary. The enrolled text does not state one universal duty requiring every private developer or deployer to label every AI interaction. The actor and context determine whether this particular disclosure rule applies. Calling TRAIGA a universal chatbot-notice law would overstate it; calling it a law with no transparency requirements would understate it.
The third lever is enforcement. The Attorney General has exclusive authority to enforce Chapter 552, subject to a limited pathway for additional sanctions by a state agency. The chapter provides no private right of action. A complaint can lead to a civil investigative demand seeking high-level information about a system's purpose, data, inputs, outputs, metrics, limitations, monitoring, safeguards, and deployment oversight. If the Attorney General identifies a violation, the statute generally provides a 60-day opportunity to cure, supported by documentation and policy changes.
The fourth lever is supervised experimentation. TRAIGA directs the Department of Information Resources, in consultation with the Texas AI Council, to create a regulatory sandbox. An approved participant can receive limited market access and protection while testing an AI system, but participation requires an application, agency approvals, a benefit assessment, a mitigation plan, and proof of compliance with applicable federal AI law. The program may last up to 36 months, and its core Chapter 552 duties and prohibitions cannot be waived. The sandbox is therefore not an escape hatch from TRAIGA; it is a controlled way to learn while keeping the central boundaries in place.
The fifth lever is institutional visibility. The Council can study the regulatory environment, advise the legislature and agencies, receive sandbox reports, and conduct training, but it cannot adopt binding rules or override a state agency. Separately, state agencies must add AI use or considered use to information-technology inventories and reviews, while Sunset Commission criteria include an agency's use and oversight of AI. These provisions make public-sector use more visible without turning the Council into a new AI regulator.
The levers interact, but one should not be substituted for another. The existence of a sandbox does not erase a prohibition. The power to investigate does not create a private right of action. A broad definition does not make every actor subject to every disclosure. A reference to recognized risk-management frameworks in a statutory defense does not turn TRAIGA into a universal framework mandate.
Why the distinction matters
Consider a simple set of questions about an AI deployment in Texas. Is the actor a private developer, a deployer, a governmental agency, or a health-care provider? Is the system merely being developed, or has it been deployed? Is the relevant issue a prohibited purpose, a disclosure obligation, a biometric practice, discrimination, or a government-use restriction? Is the concern raised through a complaint, internal testing, or a sandbox application? Each answer changes the path through the statute.
A reader who imports the Colorado model too quickly may look for a general high-risk assessment obligation in every Texas deployment and miss TRAIGA's actual trigger logic. A reader who notices that Texas does not use the same framework may make the opposite mistake and assume that ordinary governance work is unnecessary. In practice, the Act's enforcement provisions make system descriptions, limitations, monitoring, safeguards, testing, and remediation materially important even when the statute does not impose one universal assessment filing.
The comparison also changes how individual protection is understood. The supplied Colorado summary emphasizes explanation, correction, and appeal after an adverse consequential decision. TRAIGA's supplied text emphasizes Attorney General enforcement, civil remedies, cure, targeted disclosure, and specified prohibitions, while expressly withholding a private right of action under Chapter 552. Those are different routes for translating concern into accountability. They should be compared on shared dimensions—trigger, actor, duty, evidence, remedy, and innovation pathway—not collapsed into a single scale from weak to strong.
The sources support this architectural conclusion, but not every conclusion a reader might want. The enrolled bill establishes the statutory text and dates. The Texas Attorney General page provides the state's public overview and warns that it is informational rather than legal advice. The comparative chart provides a concise category-level account of Texas and Colorado, not a complete Colorado statute, set of rules, case record, or implementation history. The materials do not establish how courts will interpret every intent standard, how agencies will administer the sandbox, or what enforcement priorities will develop.
The reliable starting point is therefore disciplined classification. Before asking whether TRAIGA is “strict,” identify the actor, the system, the purpose, the context, the deployment stage, the available evidence, and the possible remedy. TRAIGA is not a Colorado-style AI Act because its governing logic is different: targeted conduct and notice rules, centralized enforcement, supervised experimentation, and public-sector accountability stand where a general high-risk decision lifecycle would otherwise be expected. Understanding that difference begins with the boundaries of each rule—and with refusing to treat the name of the law as a substitute for its mechanism.