Texas TRAIGA. Prohibition first. Sandbox second.

01 / Who this applies to

Develop, distribute, or deploy AI in Texas.

TRAIGA covers three roles. You're in scope as a developer if you build or substantially modify AI systems made available in Texas. You're a distributor if you make those systems available through a marketplace, a procurement contract, or a reseller channel. You're a deployer if you operate AI systems whose outputs reach Texans.

Headquarters location is not the deciding factor. A California SaaS vendor whose product is used by a Texas school district is in scope. A New York staffing firm whose AI screening tool ranks Texas applicants is in scope. Operating in or directing AI outputs at Texas is the trigger.

Texas state agencies are also covered, with additional restrictions on government use of AI for social scoring, biometric identification in public spaces, and unconstitutional surveillance.

Companies under a federal preemption defense (national security, certain federal-contracted systems) have their own carve-outs. The TRAIGA carve-out list is narrower than industry hoped for during the 2025 legislative session.

02 / Key dates and timeline

From signing to first enforcement.

Texas became the first major US state AI law to take effect, one month before the Colorado AI Act. Most national-scope companies are working through both at the same time, plus the EU AI Act, plus state privacy law overlays.

The federal executive order signed in December 2025 directs the US Attorney General to challenge state AI laws on commerce-clause and federal-preemption grounds. Litigation is foreseeable. Until courts or Congress act, TRAIGA remains enforceable and you must comply.

03 / What TRAIGA prohibits

A list of categorical bans, not a risk framework.

TRAIGA names prohibited AI uses. Each prohibition has its own scope and definitions. The five most operationally relevant:

1. Behavioral manipulation toward harm.

You cannot deploy AI systems intended to manipulate human behavior in a way that materially encourages self-harm, criminal activity, or violence. Intent matters; an AI tool that incidentally surfaces dangerous content is treated differently than one designed to push it.

2. Unlawful discrimination.

You cannot use AI to discriminate on the basis of constitutionally protected characteristics. The cleanest analog is Title VII discrimination for employment plus the Texas Constitution's protected classes. Disparate-impact analysis is part of the test.

3. Government social scoring.

State agencies and contractors cannot operate AI systems that score Texans on the basis of their personal characteristics or social behavior to determine access to benefits, services, or rights. This mirrors a similar EU AI Act prohibition.

4. Non-consensual intimate imagery and CSAM.

AI systems that generate or distribute non-consensual intimate imagery, synthetic CSAM, or substantially similar content are prohibited outright. There is no sandbox carve-out for these uses.

5. Unconstitutional government surveillance.

Government use of AI for biometric identification in public spaces, mass surveillance without warrant, and similar Fourth-Amendment-implicating activities is constrained. Private-sector surveillance products sold to government have their own evidence obligations.

The list is not exhaustive. TRAIGA leaves room for the Texas AI Council and the AG to flag additional categories during rulemaking. Read the statute or talk to counsel for the lines that fit your stack.

04 / What you must do

Inventory. Disclose. Audit. Sandbox if useful.

TRAIGA is prohibition-first, not risk-management-first. Your obligations split into four buckets.

1. Inventory the AI in scope.

You cannot prove a TRAIGA prohibition was not violated by an AI system you didn't know existed. Every Texas-touching company should run a current inventory of AI tools across employee browsers, desktop apps, and CLI agents. The inventory should include category (productivity, generative, decision-support, surveillance), data classes processed, and policy state.

2. Disclose AI use to Texans, where applicable.

Where the law requires consumer or employee notice (notably for hiring, government services, and certain healthcare uses), give the notice in plain language at or before the point of decision. Allow a path to human review.

3. Run a discrimination audit.

For each AI system that influences employment, lending, housing, or other consequential outcomes touching Texas, document your disparate-impact analysis. A signed and dated discrimination audit is the most-asked-for evidence in early enforcement matters.

4. Use the sandbox if it fits.

If you're testing a novel AI capability that might brush against a prohibition while you study the data, the sandbox program is worth evaluating. Sandbox participation is opt-in, comes with reporting obligations, and gives you reduced regulatory exposure for a defined period. The sandbox does not authorize prohibited uses; it lowers risk on borderline ones.

05 / Evidence the AG will ask for

Inventory, audit, decision log.

The Texas AG's office has signaled what evidence comes up first in TRAIGA inquiries.

1. The current AI inventory. Per-user, per-tool, per-surface (browser, desktop, CLI). Time-stamped. Updated continuously, not quarterly.
2. The disparate-impact analysis. Signed, dated, methodology disclosed, results documented. Annual minimum.
3. The consumer notice and human-review record. What the notice says, when it fired, who exercised human review.
4. Tamper-evident decision log. Per-decision records of AI use with categorization. SHA-256 signed CSV exports are the bar; an unsigned spreadsheet is not.
5. Sandbox reports if you participate. Whatever the program-specific reporting mandates require.