Texas AI Law (TRAIGA) and AI Use Policies for Small Business

TRAIGA is narrower than the AI laws that drew headlines in other states. In broad terms, it prohibits developing or deploying AI for specific harmful purposes, such as intentionally discriminating against protected groups, manipulating people toward self-harm, or unlawfully infringing constitutional rights. It is enforced by the Texas Attorney General, with no private right of action, and it gives businesses a notice-and-cure period before penalties apply. It also recognizes alignment with a recognized framework such as the NIST AI Risk Management Framework as a factor in your favor.

Most small businesses are not building AI systems. You are using them: Microsoft Copilot, ChatGPT, transcription tools, resume screeners, marketing generators. Using them does not make you a target, but it does mean you should be able to show what you use, why, and what guardrails exist. Confirm how the law applies to your situation with your attorney, since this article is not legal advice.

The statute is rarely the first thing that hurts a small firm. The more common problem is an employee pasting a contract, patient note, or customer list into a free AI tool that retains or trains on submitted content. That can break client confidentiality terms, trigger obligations under the Texas Data Privacy and Security Act, and surface later in a vendor questionnaire.

• Shadow AI: browser tools and extensions that nobody in IT has reviewed.
• Over-shared data: AI assistants that can read every file a user can read, including files that were never meant to be broadly accessible.
• Unverified output: AI-written text or analysis sent to a client without a human check.
• Impersonation: attackers using the same tools to craft convincing lures, which we cover in our guide to AI-powered phishing defense.

Keep it to two pages that people will actually read. A workable policy covers these items:

1. Approved tools. A short list of sanctioned AI services, each tied to a business account with data protections, not a personal login.
2. Data classes. What may never be entered into any AI tool, such as regulated data, client confidential material, credentials, and anything under an NDA.
3. Human review. A named person is accountable for checking AI output before it leaves the company or influences a hiring, lending, or pricing decision.
4. Disclosure. When you tell customers or candidates that AI was involved.
5. Request process. A simple way to ask for a new tool, so staff do not hide it.
6. Incident reporting. Who to tell if sensitive data went into the wrong tool.

Fold this into your existing written information security program rather than creating a standalone document that drifts out of date.

A policy without enforcement is a suggestion. The controls below give you visibility and a safety net:

• Fix permissions before turning on Copilot. AI assistants surface whatever a user can already access, so oversharing in SharePoint and Teams becomes instantly visible. Our overview of Microsoft 365 Business Premium security features covers sensitivity labels and data loss prevention that help here.
• Block or monitor unapproved AI sites and extensions on managed devices through your web filter and endpoint management.
• Use data loss prevention to warn or block when sensitive patterns leave your tenant.
• Review AI vendors like any other vendor. Ask where data is stored, whether prompts are used for training, and how long they are retained. See our guide to third-party vendor risk management.
• Train people. Short, scenario-based sessions beat annual slide decks, as we explain in security awareness training that works.

If a regulator, insurer, or customer ever asks how you govern AI, a documented approach carries weight. The NIST AI Risk Management Framework organizes the work into four functions: govern, map, measure, and manage. A small business does not need the full apparatus. Keep an inventory of AI tools, note the data each one touches, record the owner and the risk level, and review the list quarterly. The same discipline that supports audit-ready compliance evidence applies here: dated records beat good intentions.

This week, send a short survey asking every employee which AI tools they use and for what. Expect surprises. Then pick one approved platform, write the two-page policy, and check your Microsoft 365 permissions before rolling out any assistant broadly. If you want help, our IT compliance services team can build the inventory and policy with you, and our cybersecurity services team can implement the monitoring and data loss prevention behind it.

LayerLogix helps Texas SMBs govern AI and meet compliance obligations across the Greater Houston area, including:

• Houston managed IT services
• Katy managed IT services
• Sugar Land managed IT services