Texas Responsible AI Governance Act

The pain the Texas AI Act is causing our customers

Texas has more AI activity than most states realize. Dallas, Austin, and Houston are major AI development hubs. Texas hospitals use AI in diagnostics. Texas banks use AI in credit and fraud detection. Texas state agencies procure AI systems worth hundreds of millions of dollars annually. Until HB 149, none of this activity had a Texas-specific framework. Now it does, and companies with Texas operations, Texas customers, or Texas contracts need to understand what the Texas AI Act requires and when.

The pain is compressed timeline plus scope confusion. HB 149's specific effective dates for various sections roll out through 2026 and 2027. Different provisions apply to different actors (developers, deployers, government agencies). Executives are trying to sort out what applies to them, when it applies, and how it interacts with the Colorado AI Act (which many Texas-based companies also must comply with).

What the Texas AI Act actually is

HB 149, the Texas Responsible AI Governance Act, was signed into law in 2025. It creates a framework covering three tracks:

The developer track imposes duties on entities that create AI systems for use in Texas, including documentation, testing, and disclosure obligations.

The deployer track imposes obligations on entities that use AI systems in Texas to make consequential decisions, including impact assessments, human oversight, and consumer notice.

The government track establishes rules for state agencies and government contractors using AI, including procurement standards and public disclosure of AI use.

The Texas AI Act is enforced by the Texas Attorney General. Penalties include civil penalties, injunctive relief, and, for repeat violations, escalating fines.

What the Texas AI Act requires you to do

Impact assessments for high-risk AI

Deployers of high-risk AI systems must complete impact assessments before deployment, covering purpose, benefits, potential harms, mitigation, and consumer impact. Assessments must be updated periodically and after material changes.

Consumer notice and rights

Texas consumers subject to consequential AI decisions must be notified that AI was used. In many contexts, consumers have rights to explanation, correction, and appeal. The specific rights vary by decision category (employment, credit, insurance, healthcare, housing).

Developer disclosure

Developers of high-risk AI must publish information about intended purposes, known limitations, and material risks. Documentation must be provided to deployers so deployers can complete their own obligations.

Government use restrictions

Texas state agencies using AI face additional obligations: public inventory of AI systems, procurement standards, and, in some categories, public comment periods before deployment.

Prohibited practices

Certain AI uses are prohibited outright: social scoring by government, real-time biometric surveillance in public spaces (with narrow exceptions), and AI-driven manipulation that exploits cognitive vulnerabilities.

Interaction with the Texas Data Privacy and Security Act

The Texas AI Act operates alongside the Texas Data Privacy and Security Act (TDPSA), which took effect July 1, 2024. TDPSA governs personal data processing; the Texas AI Act governs AI decision-making. Many AI systems trigger both. Companies operating in Texas need integrated compliance for both laws, not separate programs.

Why the Texas AI Act matters to you

Texas is the second-largest state by GDP and one of the largest markets for AI products and services. If you sell into Texas, hire in Texas, provide services to Texas consumers, or contract with the Texas state government, the Texas AI Act applies. Even companies with no Texas operations may find the Texas AI Act flowing through their vendor contracts, as Texas-based buyers demand compliance from out-of-state suppliers.

What the research says about Texas AI Act

The academic literature on Texas AI Act is ahead of most corporate practice, and it is unusually blunt. Two findings are worth putting in front of any executive who thinks this is a compliance formality.

“AI governance is a system of rules, practices and processes employed to ensure an organization's use of AI aligns with its strategies, objectives, and values.”

Birkstedt, Minkkinen, Tandon & Mäntymäki, Internet Research (2023)

That is the gap between having AI and governing it. The second finding is the one that tends to change the room.

“concerns about their impact on individual and societal wellbeing, particularly due to the lack of transparency and accountability”

Cheong, Frontiers in Human Dynamics (2024)

Neither of these is a fringe position. Both come from peer-reviewed work, and both describe the condition most organisations are actually in when the question about Texas AI Act arrives from the board, the buyer, or the regulator.

How to get compliant with Texas Responsible AI Governance Act: a 5-step path

This is the sequence that works, and it is not the sequence most organisations choose. They start with the framework and work backwards toward reality. Start with reality.

1. Inventory the AI in scope. List every AI system that could fall under Texas AI Act. Record what it does, what decision it influences, what data it touches, and who owns it. You cannot govern AI you cannot name, and almost every organisation we assess is running more AI than its leadership believes.
2. Determine whether you are actually in scope. Work out precisely which of your AI systems and activities Texas AI Act reaches, and write the determination down with its reasoning. Do this in writing. A documented scope determination, right or wrong, is defensible. An undocumented assumption is not.
3. Assign one accountable owner. Name a person, not a committee, with the authority to stop a deployment. Governance without someone who can say no is documentation, not control.
4. Build the evidence file. Assemble the documentation Texas AI Act expects: the scope, the risk assessment, the controls, the testing evidence, and the incident record. Assemble it before anyone asks. Reconstructing it under a regulator's deadline costs several times more and looks exactly like what it is.
5. Set a review cadence and hold it. Re-run the assessment on a schedule and after any material change to the model, the data, or the use case. Alignment decays. A control tested once is a snapshot, not a control.

Done in this order, Texas AI Act becomes tractable. Done out of order, it becomes a document nobody uses and a control nobody exercises.

Frequently asked questions about the Texas AI Act

When does the Texas AI Act take effect?

Various provisions phase in across 2026 and 2027. Compliance work should begin in early 2025 to hit the first effective dates.

How does the Texas AI Act differ from the Colorado AI Act?

Both regulate high-risk AI with impact assessments and consumer notice. The Texas AI Act adds a stronger government-use track and interacts explicitly with TDPSA. Colorado has an anti-algorithmic-discrimination framing that Texas handles differently.

What is a "consequential decision" under the Texas AI Act?

A decision affecting an individual's access to or terms of employment, credit, insurance, healthcare, housing, education, or essential government services. This is a broad category that captures most business AI uses.

Where does the Texas AI Act fit in SRJ's work?

SRJ is a Texas LLC. The Texas AI Act is the operating environment for our own firm and for our Texas clients. The 6-Step Review Process™ and Volume III of The Operating Discipline for AI Library™ are calibrated to Texas requirements as well as national ones.

Primary sources on Texas AI Act

The authoritative texts and agency pages behind this summary. We keep this page current, but where a compliance decision turns on exact wording, read the source. Anything concerning Texas AI Act that carries legal consequence should be confirmed against the enrolled text or the issuing body, not against a secondary summary, including this one.

• Texas Legislature Online