The Boundaries: Who TRAIGA Regulates and Which AI Uses It Targets
TRAIGA's practical meaning begins with classification. The question here is how the Act's broad definition and Texas connections narrow into actor-specific duties, prohibited purposes, and sector boundaries. That analysis gives a reader a safer way to evaluate a real AI system: identify who is acting and in what context before deciding which rule, if any, applies.
A common mistake is to treat the statute's reach as if it were one large circle. The Act does create a wide perimeter, but its operative provisions draw smaller circles inside it. A person may be within the subtitle because they conduct business in Texas, yet a disclosure section may apply only if the actor is a governmental agency interacting with consumers. A biometric rule may concern a governmental entity, while a separate amendment changes how commercial biometric data used in AI training is treated. The same technology can therefore raise different questions at different points in its life.
Start with the system, the Texas connection, and the actor
TRAIGA defines an “artificial intelligence system” as a machine-based system that, for an explicit or implicit objective, infers from the inputs it receives how to generate outputs. Those outputs can include content, decisions, predictions, or recommendations that influence physical or virtual environments. In ordinary language, the definition focuses on an inference-and-output relationship, not on a particular brand, model architecture, or application label.
The subtitle applies to a person who promotes, advertises, or conducts business in Texas; produces a product or service used by Texas residents; or develops or deploys an AI system in Texas. The three routes are important because the statute identifies business activity, product or service use, and in-state development or deployment as distinct connections to Texas. A product used by Texas residents can matter. So can development or deployment in the state. The statute's perimeter is consequently broad enough to capture many commercial relationships connected to Texas, although the supplied materials do not resolve every jurisdictional question for an actor with more remote connections.
That perimeter is not the same thing as liability. Applicability answers whether the subtitle may be relevant. A violation still depends on the language of the particular section: the actor named there, the conduct described there, and—often—the purpose or intent required there. Confusing these steps produces two opposite errors. One says that a company outside a narrow fact pattern is automatically free of the Act because it does not fit a preferred category. The other says that once a company is within the subtitle, every TRAIGA obligation attaches to every system it operates. Neither follows from the structure of the text.
The statute supplies distinct role labels. A developer is a person who develops an AI system that is offered, sold, leased, given, or otherwise provided in Texas. A deployer is a person who deploys an AI system for use in the state. Those roles can belong to different organizations, or can overlap in one organization. The distinction matters because the Act sometimes asks about development and deployment together, while other provisions or investigative requests focus on what happens after deployment.
A “consumer” is narrower than “any person affected by AI.” It means an individual who is a Texas resident acting only in an individual or household context. Someone acting in a commercial or employment context is excluded from that definition. This does not erase other laws or protections that might apply to workers, applicants, businesses, or commercial users. It means that a provision written for consumers cannot be casually expanded to every recipient of an AI-assisted decision.
“Governmental entity” is also a defined term. It generally covers a department, commission, board, office, authority, or other administrative unit of Texas or a political subdivision exercising governmental functions. The definition excludes specified hospital districts and institutions of higher education, including university systems and component institutions. A government-facing rule must therefore be read with the statutory definition, not with an everyday assumption that any publicly funded or publicly visible organization is the same kind of entity.
The chapter also contains two framing limits. It may not be construed to impose a requirement that adversely affects a person's rights or freedoms, including free speech. Nor may it be read to authorize an agency other than the Department of Insurance to regulate or oversee the business of insurance. In addition, the chapter expressly preempts an ordinance, resolution, rule, or other regulation adopted by a political subdivision regarding the use of AI systems. These provisions establish a state-level architecture with rights, insurance, and local-government boundaries. They do not answer every constitutional or preemption question, but they do warn against treating the Act as an unlimited delegation of regulatory power.
The first analytical pass should therefore record at least five facts: what the system does, who developed it, who deploys it, how it connects to Texas, and whether the affected person is acting as a consumer. The facts do not decide the case by themselves. They determine which parts of the statute deserve attention.
Then apply the purpose and context filters
The most visible TRAIGA prohibitions are not written as a general command to eliminate all risk from AI. They target specified uses and mental states.
A person may not develop or deploy an AI system in a manner that intentionally aims to incite or encourage someone to commit physical self-harm, including suicide, harm another person, or engage in criminal activity. The rule has a serious subject but a deliberate structure. It addresses what the system is developed or deployed to do and the way the conduct is aimed. A system's ability to produce dangerous material, standing alone, is not the same as proof that its development or deployment intentionally aims to encourage one of those acts.
The constitutional-protection provision uses a related but distinct formulation. A person may not develop or deploy an AI system with the sole intent for the system to infringe, restrict, or otherwise impair an individual's rights guaranteed under the United States Constitution. The statute says this remedial provision does not create or expand a constitutional right. That sentence matters because it frames TRAIGA as a means of addressing a specified misuse of AI, not as a new constitutional code that defines rights beyond the Constitution.
The discrimination rule adds another boundary. A person may not develop or deploy an AI system with the intent to unlawfully discriminate against a protected class in violation of state or federal law. A protected class includes groups or classes protected from discrimination by civil-rights laws, with the statute naming characteristics such as race, color, national origin, sex, age, religion, and disability. The statute expressly says that disparate impact alone is not sufficient to demonstrate intent under this section.
That does not mean disparate outcomes are meaningless in every legal setting. It means that this particular TRAIGA prohibition requires more than disparate impact standing by itself to establish the specified intent. The underlying state and federal civil-rights rules remain part of the provision's language, and sector-specific treatment also matters. Insurance entities are addressed through an exception when other statutes govern unfair discrimination or related unfair or deceptive conduct in the business of insurance. A federally insured financial institution is considered compliant with this section if it complies with all federal and state banking laws and regulations.
The Act also addresses certain sexually explicit content and child-related conduct. It prohibits developing or distributing an AI system with the sole intent of producing, assisting in producing, or distributing visual material that violates specified Texas Penal Code provisions, including a deepfake video or image prohibited by one of those provisions. Separately, it prohibits intentionally developing or distributing an AI system that engages in text-based conversations simulating or describing defined sexual conduct while impersonating or imitating a child younger than 18. These rules use both subject matter and mental-state limits. They should not be paraphrased as a ban on every form of synthetic media or every discussion of sexuality by an AI system.
Some of the Act's most distinctive boundaries are reserved for governmental entities. A governmental entity may not use or deploy an AI system that evaluates or classifies a person or group based on social behavior or personal characteristics with the intent to assign a social score or similar valuation that could lead to unrelated, detrimental, unjustified, disproportionate, or rights-infringing treatment. The restriction is not a general prohibition on every public-sector classification. It describes a particular scoring purpose and specified harmful consequences.
The biometric provisions require the same care. “Biometric data” is data generated by automatic measurements of biological characteristics, such as a fingerprint, voiceprint, retina, iris, or another unique biological pattern used to identify a specific person. The statutory definition excludes ordinary photographs and recordings, data generated from them, and certain health-care information handled under the Health Insurance Portability and Accountability Act.
Section 552.054 addresses a governmental entity that develops or deploys AI to uniquely identify a specific individual using biometric data or the targeted or untargeted gathering of images or other media from the internet or another publicly available source without consent, when the gathering would infringe a constitutional or statutory right. The actor is governmental, the purpose is unique identification, and the consent condition is linked to infringement of a right. Removing any one of those elements can change the analysis.
A separate amendment to Texas's Capture or Use of Biometric Identifier Act, or CUBI, addresses commercial biometric data and AI development. It says that an image or other media containing a person's biometric identifiers being available on the internet is not, by itself, evidence that the person was informed of or consented to commercial capture or storage, unless the person made the image or media publicly available. At the same time, CUBI does not apply to the training, processing, or storage of biometric identifiers involved in developing, training, evaluating, disseminating, or otherwise offering AI models or systems, unless a system is used or deployed to uniquely identify a specific individual. The amendments also provide that later commercial use outside the stated exception can bring possession, destruction, and penalty provisions back into play.
This is neither a blanket biometric ban nor blanket permission to harvest public images. It is a boundary between activities. Training and model development receive one treatment; unique identification receives another; later commercial repurposing can alter the legal position again. A company evaluating a data pipeline would need to preserve those distinctions rather than rely on the phrase “publicly available.”
The diagram's branching is a reading method, not a claim that roles are always mutually exclusive. A health-care provider can also be a governmental entity. A developer can later become a deployer. One system can involve training data, consumer interaction, and a government customer at different stages. The point is to test each relevant interface instead of letting the system's marketing label decide the result.
This actor-and-purpose method also explains why TRAIGA should not be summarized through a list of forbidden topics. The important legal information is relational. Who is using the system? Is the system being developed, deployed, distributed, or used? What purpose is alleged? Is the relevant person a consumer? Does a sector exception apply? Is the conduct intentional, or is the claim being inferred solely from an outcome? Those questions turn a broad technology description into a legally meaningful set of facts.
The same method prevents overstatement in both directions. TRAIGA reaches widely enough that Texas business activity, products used by residents, and in-state development or deployment can matter. Yet the statute does not make every private AI interaction subject to the governmental-agency disclosure rule, does not make every disparate impact proof of unlawful discrimination under Section 552.056, and does not make every use of biometric data equivalent to unique identification. The next issue is what happens after the relevant rule has been identified: who can investigate, what evidence may be requested, and whether a violation can be cured before penalties follow.