Texas Responsible Artificial Intelligence Governance Act
United States Β· Law Β· Texas Legislature
Our summary
Texas law establishing protections and governance requirements for artificial intelligence systems used in the state. It applies to developers and deployers of AI systems serving Texas residents and requires government agencies to disclose when consumers interact with AI systems. The law also restricts the use of biometric identifiers in AI training without consent and sets standards for data processors handling personal data processed by AI systems.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
42 sections
Jump to a chapter
Section 1 Short title and amendment of biometric identifier provisions
Establishes the act's name and amends the Business & Commerce Code to define artificial intelligence systems and biometric identifiers, requiring explicit consent for capturing or storing biometric identifiers for commercial purposes and clarifying that public availability of images does not constitute informed consent unless the individual themselves made it public. Requires data processors to assist controllers in responding to consumer requests, meeting security requirements for personal data and artificial intelligence systems, and providing information for data protection assessments.
Chapter 551 General provisions
3 sections
Introduces subtitle D on artificial intelligence protection, establishing definitions, applicability standards, and construction principles for the regulatory framework.
Section 551.001 Definitions
Defines artificial intelligence system as a machine-based system that generates outputs influencing physical or virtual environments, defines consumer as a Texas resident acting in an individual or household context, and establishes the Texas Artificial Intelligence Council.
Section 551.002 APPLICABILITY OF SUBTITLE. This subtitle
The subtitle applies to persons who promote, advertise, or conduct business in Texas, produce products or services used by Texas residents, or develop or deploy artificial intelligence systems in the state.
Section 551.003 Construction and application of subtitle
The subtitle must be broadly construed to facilitate responsible AI development and use, protect individuals from known and reasonably foreseeable AI risks, provide transparency regarding AI risks, and give reasonable notice of state agency AI use.
Chapter 552 Artificial intelligence protection
16 sections
Establishes chapter 552 containing duties, prohibitions, and enforcement mechanisms for artificial intelligence systems, including provisions on consumer disclosure, behavioral manipulation, social scoring, biometric data capture, unlawful discrimination, sexually explicit content, and the attorney general's enforcement authority.
Section 552.001 Definitions
Section 552.002 Construction of chapter
The chapter does not authorize requirements that harm anyone's rights or freedoms, including free speech. Only the Department of Insurance may oversee or regulate the insurance business.
Section 552.003 LOCAL PREEMPTION. This chapter supersedes
The chapter supersedes and preempts any local ordinance, resolution, rule, or regulation by political subdivisions regarding artificial intelligence system use.
Section 552.051 DISCLOSURE TO CONSUMERS. (a) In this
Governmental agencies deploying artificial intelligence systems for consumer interaction must inform each user that they are interacting with artificial intelligence before or at the moment of interaction, regardless of whether this would be obvious. The disclosure must be clear, conspicuous, written in plain language, without using dark patterns, and may be provided via hyperlink. Health care providers must give this disclosure to service recipients or their representatives no later than when service begins, or as soon as reasonably possible in emergencies.
Section 552.052 Manipulation of human behavior
No person may develop or deploy an artificial intelligence system intended to incite or encourage physical self-harm, suicide, harm to others, or criminal activity.
Section 552.053 Social scoring
Governmental entities may not use artificial intelligence systems that evaluate or classify individuals or groups based on social behavior or personal characteristics to assign a social score or similar assessment that results in unfavorable treatment in unrelated social contexts, treatment unjustified or disproportionate to the behavior, or infringement of constitutional or legal rights.
Section 552.054 CAPTURE OF BIOMETRIC DATA. (a) In this
Defines biometric data as automatically generated measurements of biological characteristics used to identify individuals, including fingerprints, voiceprints, and iris or retina patterns, but excluding photographs and recordings or health care information under federal law. Prohibits governmental entities from developing or deploying AI systems for unique identification using biometric data or gathering images from the Internet without individual consent if doing so would breach constitutional or statutory rights. Violations of a related financial privacy statute are also violations of this section.
Section 552.055 Constitutional protection
No person may develop or deploy an artificial intelligence system whose sole intent is to infringe, restrict, or impair individual rights guaranteed by the United States Constitution. This section is remedial in purpose and does not create or expand any constitutional right.
Section 552.056 UNLAWFUL DISCRIMINATION. (a) In this
Section 552.057 Certain sexually explicit content and child
No person may develop or distribute artificial intelligence systems whose sole purpose is to produce, assist in producing, or distribute child sexual abuse material or deepfake videos or images in violation of Penal Code, or intentionally develop systems that simulate or describe sexual conduct while impersonating or imitating a child under 18 years of age.
Section 552.101 ENFORCEMENT AUTHORITY. (a) The attorney
The attorney general has exclusive enforcement authority over this chapter, subject to limited exceptions. This chapter does not establish a private right of action.
Section 552.102 INFORMATION AND COMPLAINTS. The attorney
The attorney general must create and maintain an online mechanism on its website through which consumers may submit complaints about violations of this chapter.
Section 552.103 INVESTIGATIVE AUTHORITY. (a) If the
Section 552.104 Notice of violation; opportunity to cure
The attorney general must notify a person in writing of alleged violations, specifying which provisions are breached. The attorney general may not take action before 60 days after notice, or if the person cures the violation within that period, submits written confirmation with supporting documentation, and changes internal policies to prevent recurrence.
Section 552.105 CIVIL PENALTY; INJUNCTION. (a) A person who
A person who violates this chapter and does not cure is liable for: 10,000 to 12,000 dollars per curable or breached violation; 80,000 to 200,000 dollars per uncurable violation; 2,000 to 40,000 dollars per day for continued violations. The attorney general may seek these penalties, injunctions, and attorney's fees. A person is presumed to have used reasonable care, may seek expedited hearings, and is not liable if another person misuses their system or if they discover violations through feedback, testing, agency guidelines, or compliance with the NIST Artificial Intelligence Risk Management Framework or other recognized frameworks.
Section 552.106 ENFORCEMENT ACTIONS BY STATE AGENCIES. (a) A
A state agency that licenses, registers, or certifies a person may impose sanctions including license suspension, probation, revocation, or other authorization revocation, and monetary penalties up to 100,000 dollars, if the person has been found liable under the civil penalty provisions and the attorney general recommends additional enforcement.
Chapter 553 Artificial intelligence regulatory sandbox program
8 sections
This chapter establishes a regulatory sandbox program with general provisions on definitions, program establishment, applications, participation duration, resource coordination, and oversight mechanisms.
Section 553.001 Definitions
Defines applicable agency as a state department regulating business and people in certain sectors; department as the Texas Department of Information Resources; program as the sandbox allowing testing without licenses for limited time and scope; and program participant as an approved applicant testing an artificial intelligence system.
Section 553.051 ESTABLISHMENT OF SANDBOX PROGRAM. (a) The
The department must create a sandbox enabling testing of innovative artificial intelligence systems without licenses, designed to promote safe use across healthcare, finance, education, and public services while protecting consumers and privacy. The program waives or suspends certain laws and regulations during testing, and the attorney general and state agencies cannot file charges or punitive actions against participants for violations of waived laws. However, the requirements of Subchapter B, Chapter 552, cannot be waived.
Section 553.052 APPLICATION FOR PROGRAM PARTICIPATION. (a)
A person must obtain department and applicable agency approval before testing. The application must describe the artificial intelligence system and intended use, include a benefit assessment addressing consumer, privacy, and safety impacts, describe plans to mitigate adverse consequences, and provide proof of compliance with federal artificial intelligence laws.
Section 553.053 DURATION AND SCOPE OF PARTICIPATION. (a) A
An approved program participant may test and deploy an AI system under the program for up to 36 months. The department may extend the test period if it determines good cause exists for continuation.
Section 553.054 EFFICIENT USE OF RESOURCES. The department
The department must coordinate activities and information sharing under this subchapter and other artificial intelligence laws to ensure efficient implementation and streamline resource use.
Section 553.101 COORDINATION WITH APPLICABLE AGENCY. (a)
Section 553.102 PERIODIC REPORT BY PROGRAM PARTICIPANT. (a)
Program participants must submit quarterly reports to the department containing performance metrics for the AI system, updates on risk mitigation, and feedback from consumers and affected stakeholders. The department must protect confidential proprietary information, trade secrets, and other sensitive information obtained through the program.
Section 553.103 ANNUAL REPORT BY DEPARTMENT. (a) The
The department must submit an annual report to the legislature with data on participant numbers, overall performance and impact of tested AI systems, and recommendations for legislative changes to laws or regulations.
Chapter 554 Texas artificial intelligence council
10 sections
This chapter establishes the Texas Artificial Intelligence Council, which is administratively attached to the Department of Information Resources, and outlines its creation, organization, membership, powers, duties, and limitations.
Section 554.001 CREATION OF COUNCIL. (a) The Texas
The council is created to ensure AI systems are ethical and serve public interest, identify laws and regulations that impede AI innovation, evaluate regulatory capture and tech company influence on competitors, guide the legislature on AI governance, study the regulatory environment, and oversee the sandbox program. The Department of Information Resources provides administrative support and the parties must execute a memorandum of understanding on administrative details.
Section 554.002 Council membership
The seven-member council comprises three members appointed by the governor, two by the lieutenant governor, and two by the speaker of the house, serving staggered four-year terms with three or four terms expiring every two years. The governor appoints a chair and the council elects a vice chair, and may establish an advisory board of experts in relevant fields.
Section 554.003 Qualifications
Council members must be Texas residents with knowledge or expertise in AI systems, data privacy and security, ethics in technology or law, public policy and regulation, risk management related to AI, improving government operations efficiency, or anticompetitive practices and market fairness.
Section 554.004 Staff and administration
The council may employ an executive director and other personnel as needed to carry out its functions.
Section 554.101 Authority to issue reports
The council may submit reports to the legislature on AI system use in Texas, including system compliance with state law, ethical implications, data privacy and security concerns, and potential liability or legal risks.
Section 554.102 TRAINING AND EDUCATIONAL OUTREACH. The
The council must provide instructional programs to state and local government entities to develop competency in deploying artificial intelligence systems.
Section 554.103 Limitation of authority
The council may not adopt binding rules or guidance for any entity, interfere with or override state agency operations, or exercise powers not granted by the chapter.
Section 325.011 CRITERIA FOR REVIEW. The commission and its
Commissions assessing whether state agencies or advisory committees should continue must examine their operational efficiency, mission achievement, activities beyond statutory authority, fee and enforcement powers, less restrictive alternatives, coordination with other agencies, complaint handling, rulemaking procedures including public participation, compliance with employment equality and privacy laws, conflicts of interest policies, records management practices, federal funding effects, justification of reporting requirements, and cybersecurity practices using information from the Department of Information Resources or other state agencies.
Section 8 Not later than September 1, 2026, the attorney
By September 1, 2026, the attorney general must post required information and an online mechanism on the attorney general's website. State agencies are not required to implement mandatory provisions without specific appropriations for that fiscal year, but may implement them using other available funds; if not implementing, agencies must certify this in their legislative budget request and estimate costs for the next biennium.
Section 10 This Act takes effect January 1, 2026
This Act takes effect January 1, 2026.
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.