Law / United States / 
Texas
TRAIGA (H.B. 149, 2025), Attorney General enforcement, civil investigative demand, cure period, penalties and defenses
Tex. Bus. & Com. Code §§ 552.101-552.106
In force since .
An AI governance rule binding public and private bodies.
- Enforcement body
- Office of the Attorney General of Texas, with exclusive enforcement authority
- How the hook was established
- express
- What makes it apply
- Market targeting, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
As of .
What it requires
- If the Attorney General notifies you in writing of a violation, cure it within 60 days of the notice and give the Attorney General a written statement that you have cured the violation, supporting documentation showing the manner in which you cured it, and a statement that you have made any necessary changes to internal policies to reasonably prevent further violation (s. 552.104(b)).
- Respond to a civil investigative demand from the Attorney General, which may ask for a high-level description of your system's purpose, intended use, deployment context and benefits, the type of data used to program or train it, the categories of input data, its outputs, performance metrics, known limitations, and post-deployment monitoring and user safeguards (s. 552.103).
- To rely on the defense that you found the violation yourself, discover it through feedback from a developer, deployer or other person who believes a violation has occurred, through testing including adversarial or red-team testing, through following guidelines set by applicable state agencies, or through an internal review process while you substantially comply with the most recent version of the National Institute of Standards and Technology's Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile or another nationally or internationally recognized AI risk management framework (s. 552.105(e)(2)).
- You may not be found liable where another person uses your AI system in a manner the chapter prohibits (s. 552.105(e)(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Sec. 552.105(a) sets three tiers: $10,000 to $12,000 per violation the court finds curable or a breach of a cure statement, $80,000 to $200,000 per violation the court finds uncurable, and $2,000 to $40,000 per day for a continued violation. The figure recorded here is the top of the uncurable-violation range; the $2,000 daily figure is recorded as the minimum.
- Rule
- Per violation only
- As of
- Minimum
- 2,000
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 200,000
What it makes you log
Logging duty
Sections 552.101 through 552.106 set out enforcement and do not state a duty to create, keep, or later produce a log or record. Section 552.103 lets the attorney general request documentation about a reported system through a civil investigative demand, and Section 552.104(b) has a person that cures a violation provide a written statement and supporting documentation of the cure; neither creates a duty to make or maintain any of it in advance.
- Kind
- None
- As of
What this law does
The Attorney General has exclusive authority to enforce the chapter, and the chapter provides no basis for a private right of action. The Attorney General maintains an online mechanism through which a consumer may submit a complaint. On a complaint alleging a violation, the Attorney General may issue a civil investigative demand under the procedures of Section 15.10.
A demand may ask for a high-level description of the system's purpose, intended use, deployment context and associated benefits, a description of the type of data used to program or train it, a high-level description of the categories of input data and of the outputs, any performance metrics, any known limitations, and a high-level description of post-deployment monitoring and user safeguards.
Before suing, the Attorney General must notify the person in writing of the specific provisions allegedly violated, and may not bring an action before the 60th day after the notice or if the person cures the violation within that period and provides a written statement that it has cured the violation, supporting documentation, and any necessary changes to internal policies to reasonably prevent further violation.
A person who violates the chapter and does not cure the violation is liable for a civil penalty of $10,000 to $12,000 for each curable violation or breach of a cure statement, $80,000 to $200,000 for each uncurable violation, and $2,000 to $40,000 for each day a violation continues, and the Attorney General may also seek an injunction and recover attorney's fees, court costs and investigative expenses.
There is a rebuttable presumption that a person used reasonable care as required under the chapter. A defendant may seek an expedited hearing or other process, including a request for declaratory judgment, if it believes in good faith that it has not violated the chapter.
A defendant may not be found liable if another person uses its AI system in a manner the chapter prohibits, or if it discovers a violation through feedback from a developer, deployer, or other person who believes a violation has occurred, through testing including adversarial or red-team testing, through following guidelines set by applicable state agencies, or, if it substantially complies with the most recent version of the National Institute of Standards and Technology's Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile or another nationally or internationally recognized risk management framework for AI systems, through an internal review process.
The Attorney General may not bring an action to collect a civil penalty against a person for an AI system that has not been deployed. A state agency may impose sanctions, including suspension, probation or revocation of a license, registration or certificate or a monetary penalty not to exceed $100,000, on a person it licenses, registers or certifies if the person has been found in violation under Section 552.105 and the Attorney General has recommended additional enforcement by that agency.
When LexLint raises it
When your app profile says your app generates content with AI, deploys a chatbot or makes high-risk automated decisions.