HB149

HB149, the Texas Responsible Artificial Intelligence Governance Act, took effect January 1, 2026. It establishes targeted AI prohibitions, disclosures, attorney-general enforcement, a supervised testing program and an advisory council. Its reach includes people doing or advertising business in Texas, supplying products or services used by Texans, or developing or deploying AI in Texas. It is not a general guarantee that AI will be accurate, fair or safe. Final law, Sections 1, 4 and 10; official history.

Disclosures: A governmental agency offering AI intended to interact with consumers must disclose that fact before or at the interaction, even when it seems obvious. Notices must be clear, plain-language and free of manipulative interface designs; a link to a separate page is allowed. Health-care providers using AI in relation to services or treatment must notify the patient or personal representative no later than the first service date, or as soon as reasonably possible in an emergency. The statute defines consumers as Texas residents acting personally or for their households, not in employment or commercial roles. It does not impose this same blanket disclosure requirement on every private business. New Business & Commerce Code 551.001 and 552.051.

Prohibited uses: The law targets AI developed or deployed to intentionally encourage self-harm, harm to others or criminal activity; AI developed or deployed with the sole intent to impair federal constitutional rights; and AI developed or deployed with intent to unlawfully discriminate against a protected class. Unequal results alone are not enough to establish discriminatory intent under this provision. It also prohibits developing or distributing AI with the sole intent to produce or distribute the specified unlawful child sexual-abuse material or sexual deepfakes, and intentionally developing or distributing AI that engages in sexual text conversations while impersonating a child under 18. The constitutional provision does not create or expand constitutional rights. New Sections 552.052 and 552.055–.057.

Government and sector limits: Governmental entities face additional restrictions on social scoring that causes unrelated, unjustified or disproportionate adverse treatment or infringes rights, and on nonconsensual AI identification using biometric data or gathered public images when the gathering infringes rights. The defined “governmental entity” excludes hospital districts and the public higher-education institutions covered by Education Code 61.003; that is not a blanket exemption from every provision of the act. The discrimination section has an insurance-services exception for covered entities already subject to specified insurance laws, and treats federally insured financial institutions as compliant when they comply with all applicable federal and state banking laws. The act also preempts local AI-use regulations and preserves the Department of Insurance’s regulatory role. New Sections 552.001–.003 and 552.053–.056.

Biometric information: HB149 changes the existing commercial-biometric law, not just government rules. An image’s presence online is not by itself notice or consent to commercial biometric capture or storage, with an exception to that rule when the individual made the image public. Broad new exemptions cover AI-related training, processing and storage unless the system is used or deployed to identify a specific individual, and specified security, fraud-prevention and illegal-activity purposes. If training data is later used commercially outside the exemptions, possession/destruction requirements and penalties apply. The law also expressly includes applicable AI personal data in processors’ duties to assist with security and breach notifications. Sections 2–3.

Enforcement is limited: The attorney general principally enforces the new AI chapter; it creates no private right to sue. Written notice must identify the alleged violation, and an action cannot begin before day 60. Timely correction plus the required written statement, supporting documentation and preventive policy changes bars that action. Uncorrected curable violations or breaches of a cure statement can bring $10,000–$12,000 each; incurable violations, $80,000–$200,000 each; continuing violations, $2,000–$40,000 per day. Courts may also grant injunctions. Licensing agencies can impose additional sanctions, including up to $100,000, only after a violation finding and attorney-general recommendation. The complaint-portal deadline was September 1, 2026, subject to the agency-funding condition below. New Sections 552.101–.106 and Section 8.

The enforcement section includes a rebuttable reasonable-care presumption and separate protections from liability when another person misuses the defendant’s system, or when the defendant discovers a violation through specified feedback, testing, agency guidelines, or a qualifying internal review. The internal-review route requires substantial compliance with the named NIST generative-AI risk profile or another nationally or internationally recognized AI risk-management framework. The statute’s separate discovery protection does not repeat the notice-and-cure section’s correction requirement; those provisions should not be conflated. Civil-penalty actions under this section cannot target a system that has not been deployed. These are the statutory conditions, not a certification that any particular business qualifies. New Section 552.105(c)–(f).

Testing and oversight: The Department of Information Resources (DIR), with relevant regulators’ approval, can admit participants to a “sandbox”—limited market testing with specified regulatory waivers—for up to 36 months, extendable for good cause. The AI disclosure and prohibited-use requirements cannot be waived, and federal law remains applicable. Participants report quarterly; DIR reports annually and protects sensitive information. The seven-member Texas AI Council advises, studies risks and innovation, and provides government training, but cannot issue binding rules or override agencies. State-agency technology inventories and Sunset reviews must also consider AI. New Chapters 553–554 and Sections 5–7.

Funding condition: A state agency need not perform a mandatory duty imposed elsewhere in HB149 in a fiscal year unless specifically funded for that duty. It may use other available funding; if it does not implement a duty, it must report that fact and estimated costs in its next legislative budget request. This condition does not simply erase the private-sector prohibitions. This briefing describes the enacted requirements, not whether each agency has implemented them. Section 9.