TRAIGA: What the Texas AI Law Means for Employers

TRAIGA doesn't create a broad AI audit or registration regime for private companies. Instead, it bans specific intentional misuses of AI — building or deploying a system to discriminate against a protected class, to manipulate someone's behavior in a way that causes them real harm, or to produce illegal content like deepfakes or child sexual abuse material. Enforcement is generally understood to sit primarily with the Texas Attorney General, and the law is reported to include a cure period before penalties attach. This isn't legal advice — treat it as a starting point and loop in counsel for anything specific to your situation.

That's the quotable version. The longer version has a few wrinkles worth knowing before your next vendor contract or AI rollout.

A good chunk of the bill is aimed squarely at state agencies: mandatory AI system inventories, risk assessments for "high-risk" government use cases, and a regulatory sandbox program run through the Department of Information Resources. If you're not a state agency or building AI under a state contract, those sections pass you by.

What does reach private employers is the conduct-based layer — the law cares about what your AI does, not whether you've filed a form about it. TRAIGA is generally understood not to include a private right of action, meaning an employee or customer generally can't sue your company directly under this statute. That said, the same conduct could still expose you under existing discrimination, consumer protection, or data privacy law, so "TRAIGA doesn't apply" is rarely the end of the analysis.

Quick reference

• Applies to private employers: intentional discrimination via AI, AI-driven manipulation causing harm, illegal deepfake/CSAM generation, certain biometric data uses without consent.
• Government-only: AI system inventories, high-risk use assessments, the DIR sandbox program, agency reporting duties.
• Enforcement: generally understood to sit primarily with the Texas Attorney General, with a reported cure period before fines apply — no private lawsuits under TRAIGA itself.

You don't need a 40-page AI policy to get ahead of this. You need a short list of what AI tools touch hiring, lending, pricing, or any decision that affects someone's rights or opportunities, and a sanity check on whether any of those tools could plausibly produce a discriminatory outcome. If HR is using an AI resume screener, someone should be able to explain in plain English how it ranks candidates and whether it's been tested for bias — not because a regulator demanded it today, but because that documentation is exactly what you'll want if a complaint ever surfaces.

This is also a decent moment to tighten up who can actually configure or retrain these tools. A lot of AI governance problems start as access problems — a manager tweaks a chatbot's prompts without review, or a contractor gets standing access to a model that touches customer data. Pairing an acceptable-use policy with real controls over who can change AI configurations closes that gap faster than a policy document on its own ever will.

Even without a formal audit mandate, a thin paper trail protects you. Worth keeping on file:

• A current list of AI tools in use, who owns each one, and what data they touch.
• Vendor documentation on how each tool was trained or validated against bias, if the vendor provides it.
• Your internal AI acceptable-use policy, including what's allowed, what's prohibited, and who approves new tools.
• A record of any complaints or incidents involving an AI-assisted decision, and how they were resolved.

None of that is glamorous, but it's the difference between answering a question in an afternoon and scrambling to reconstruct history under a deadline.

If your company already handles protected health information, you're likely keeping documentation that satisfies HIPAA requirements, and a lot of that same discipline — knowing what systems touch sensitive data and who can access them — can often extend to AI governance. Same goes for financial-services and lending-adjacent businesses already working through the FTC Safeguards Rule. TRAIGA isn't asking you to reinvent your compliance program; it's asking you to extend the habits you've already built to a newer category of tool.

Here's where a lot of small and mid-sized companies are exposed without realizing it. Microsoft 365 Copilot and similar agentic AI features can often read across a wide range of company content depending on how permissions are configured — which means an AI assistant might surface sensitive HR or legal documents to someone who technically has license access but shouldn't have practical access. Getting your Microsoft 365 environment configured and permissioned correctly before you turn Copilot loose matters more than any policy memo.

The broader question — how your AI tools are deployed, monitored, and documented over time — is really a governance framework problem, not a one-time checklist. If you want a structured way to build that out, our team can walk you through a practical framework for managing AI risk across your tools without slowing your business down.

None of this works in isolation from your broader security posture, either. AI tools are just another endpoint touching your data, which means the same security fundamentals you'd apply to any new system — access reviews, monitoring, incident response — apply here too.

Does TRAIGA apply to small businesses in Texas?

Yes, if you're a private company operating in Texas and using AI in ways that touch employment decisions, consumer interactions, or similar activity, the conduct-based prohibitions in TRAIGA are generally understood to apply regardless of company size.

When does TRAIGA take effect?

TRAIGA is set to take effect soon.

Can employees sue my company directly under TRAIGA?

No. The statute is generally understood to give enforcement authority primarily to the Texas Attorney General and not create a private right of action, though other state or federal laws may still apply to the same conduct.

Do I need to register our AI tools with the state?

No. The inventory and registration-style obligations in TRAIGA apply to state agencies, not private employers.

What's the single biggest mistake companies make with TRAIGA?

Treating it as a compliance checkbox instead of looking at actual AI use cases. The law is conduct-based — what matters is whether your AI systems are being used in a way that discriminates or causes harm, not whether you have a binder labeled "TRAIGA policy."

Figuring out where your company's AI use actually creates risk — and where it doesn't — is easier with a second set of eyes. LayerLogix brings 20+ years of experience and 100% Texas-based support to exactly this kind of assessment. Request a free IT assessment or reach out to our team to talk through where your AI tools stand today.