The recently concluded 89th Legislature addressed a wide range of artificial intelligence issues. Texas is taking a leading role in both encouraging AI use and regulating the use of artificial intelligence. (Other states passing similarly expansive laws include California, Colorado, and Utah. Additional states are considering more targeted action.) This article summarizes and reviews ten specific bills passed in the recent legislative session: The Texas Responsible Artificial Intelligence Governance Act (TRAIGA) (HB 149), SB 441 governing “deepfakes,” HB 3133 governing the takedown of deepfakes on social media, HB 783 governing “catfishing,” the App Store Accountability Act (SB 2420), HB 581 governing using AI to create artificial sexual material harmful to minors, SB 1188 governing electronic health records and use of AI in diagnostics, and several bills relating to government use of AI (SB 1964, HB 2818, and HB 3512).[1]
I. Texas Responsible Artificial Intelligence Governance Act
The most comprehensive bill passed in this legislative session is the Texas Responsible Artificial Intelligence Governance Act (TRAIGA) (HB 149), signed by Governor Abbott on June 22, effective January 1, 2026. This appears to be an innovation-friendly law focusing its most restrictive provisions on government agencies. For the most part, this law adds or reinforces guardrails designed to protect civil liberties and prevent AI-driven behavior manipulation.
First, TRAIGA updates the Biometric Identifier Act by clarifying that simply having an image with biometric identifiers (like facial scans or fingerprints) does not count as consent for capturing or storing that data, unless the individual made the image public. The Act’s restrictions do not apply to the use of biometric data for developing or training AI systems, unless the system is used to uniquely identify someone. Financial institutions using voiceprints and AI systems for security or fraud prevention are also exempt. At the same time, TRAIGA provides that the Biometric Identifier Act does not apply to training, processing, or storage of biometric identifiers involved in developing, training, evaluating, disseminating, or otherwise offering AI models or systems, unless such system is used or deployed for the purpose of uniquely identifying a specific individual.
Second, TRAIGA adds a new subtitle to the Business & Commerce Code, entitled “Artificial Intelligence Protection.” This subtitle defines AI as any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments. This new subtitle applies only to persons who:
- promote, advertise, or conduct business in Texas,
- produce a product or service used by Texas residents, or
- develop or deploy an AI system in Texas.
Disclosure. The new subtitle includes various disclosure requirements:
- A governmental agency using AI in its interaction with consumers must disclose that the consumer is interacting with an AI system. This prohibition extends to “data generated by automatic measurements of an individual’s biological characteristics,” including fingerprints, voiceprints, eye retina or iris scans, or other unique biological patterns of characteristics used to identify a specific individual with certain exceptions. This provision does not apply to private businesses.
- A health care service provider must disclose any AI used in relation to a health care service of treatment.
Manipulation of Human Behavior. The new subtitle prohibits developing AI systems intentionally aimed to incite or encourage a person to commit physical self-harm, harm another person, or engage in criminal activity.
Social Scoring. The new subtitle prohibits government entities from using or deploying an AI system that evaluates or classifies a natural person based on social behavior or personal characteristics with the intent to calculate or assign a social score that results or may result in detrimental or unfavorable treatment of a person in a context unrelated to the context in which the behavior was observed, disproportionate to the nature or gravity of the observed behavior, or infringement of any statutory or constitutional right.
Capturing Biometric Data. Government entities are prohibited from developing or deploying an AI system for the purpose of identifying a specific individual using biometric data or gathering an individual’s images from the Internet without the individual’s consent if the gathering would infringe any statutory or constitutional right.
Constitutional Protection. No person shall develop or deploy an AI system with the sole intent for the AI system to infringe, restrict, or otherwise impair an individual’s constitutional rights.
Unlawful Discrimination. No person shall develop or deploy an AI system with the intent to unlawfully discriminate against a protected class in violation of state or federal law. Note that disparate impact is not sufficient by itself to demonstrate intent to discriminate. And this section does not apply to insurance entities and is subject to statutes regulating unfair discrimination in the insurance business.
Sexually Explicit Content. This section prohibits developing or distributing an AI system with the sole intent of producing or distributing child pornography or deepfake sexually explicit videos or images. This section also prohibits developing or distributing an AI system capable of engaging in text-based conversation that simulates or describes sexual conduct while impersonating or imitating a child.
Enforcement. The Texas Attorney General has exclusive enforcement authority, and there is no private right of action. Moreover, no action can be taken for undeployed AI systems. State agencies may sanction licensed individuals for violations if recommended by the Attorney General, with possible penalties including license suspension, probation, revocation, and fines up to $100,000. The Attorney General must provide an online complaint system. A 60-day notice-and-cure period is available. Civil penalties include up to $12,000 for curable violations, $200,000 for uncurable violations, $40,000 per day for ongoing violations, and injunctive relief.
A person accused of violating these provisions has the right to seek expedited hearing, including declaratory judgment. A defendant cannot be found liable for another person’s use of the defendant’s AI system in a prohibited manner. In addition, a defendant cannot be found liable if the defendant discovers a violation of this chapter via developer feedback, testing, following state guidelines, or if the defendant substantially complied with the “Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile.” Published by the National Institute of Standards and Technology or other nationally or internationally recognized risk management framework for AI systems.
Third, TRAIGA includes a “Sandbox Program.” This is a program that enables a person to obtain legal protection and limited access to the Texas market to test AI systems without obtaining a license, registration, or other regulatory authorization. This “Sandbox Program” is to be created by the Texas Department of Information Resources, in consultation with the Texas Artificial Intelligence Council.
- This includes protection from action by the Attorney General for violation of a law or regulation waived under this provision during the testing period (up to 36 months, although this time period can be extended for good cause). Note that the provisions described above (Subchapter B, Chapter 552) cannot be waived.
- To obtain this protection, a person must obtain approval from the Department of Information Resources (“DIR”). The new law summarizes the type of information to be reviewed by the DIR in evaluating such applications.
- This program includes a provision for removing participants from the program and requires quarterly reporting on performance, risk mitigation, and consumer and stakeholder feedback for the system in question.
Finally, TRAIGA establishes the Texas Artificial Intelligence Council within the DIR, made up of seven public members appointed by state leaders. The Council may create an advisory board of experts and is responsible for monitoring AI use in state government, identifying harmful practices, recommending legislative changes, and ensuring ethical AI development. The Council will issue non-binding reports to the legislature and provide AI training programs for state and local government.
II. SB 441
Senate Bill 441, signed by Governor Abbott on June 20, 2025, and effective September 1, targets the misuse of AI to create nonconsensual intimate visual materials, or “deepfakes.” The bill updates Penal Code Section 21.165, making it a crime to knowingly produce or distribute, by electronic means, deepfake media that:
- Depicts a person with computer-generated intimate parts or engaging in sexual conduct they did not actually perform,
- Without the depicted person’s consent (which must include a general description of the deepfake).
Threating to produce or distribute such deepfakes to coerce, extort, harass, or intimidate is also an offense. These crimes are generally Class A misdemeanors, or felonies if a minor is involved. Threats alone are Class B misdemeanors, or Class A if a minor is involved. Internet service providers and AI developers are exempt from liability if they act only in a technical capacity and take steps to prevent deepfake creation.
The bill also amends Section 98B.001 of the Civil Practice and Remedies Code, creating a civil cause of action for producing, soliciting, disclosing, or promoting artificial intimate visual material without consent, with intent to harm, causing harm, and revealing the depicted person’s identity. Website or app owners who recklessly facilitate or profit from such material, or process payments for it, are liable for damages if they do not remove the material within 72 hours of a removal request and make reasonable efforts to remove identical copies.
The law requires website and app owners to provide an accessible reporting system and clear removal process. Violations may be considered deceptive trade practices, enforceable by the Texas Attorney General. Plaintiffs can sue confidentially, and the statute of limitations is 10 years with a discovery rule.
III. HB 449
House Bill 449 would have criminalized creating “deepfake media” that appears to depict a person with that person’s intimate parts exposed or engaged in sexual conduct. Governor Abbott vetoed this bill on June 22, 2025. To that end, the governor stated, “[t]he increased prevalence of sexually explicit deep fake media is alarming. However, the author of this bill requested it be vetoed because other, more comprehensive approaches to this issue were passed this session and signed into law, like Senate Bill No. 441.”
IV. HB 3133
House Bill 3133 was signed by Governor Abbott on June 20, 2025, and takes effect on September 1. This bill requires social media sites to provide (i) easily accessible and timely (e.g., 48-hour turn-around time) complaint system for alleged explicit deepfakes, (ii) means for removal of deepfake material deemed sexually explicit, and (iii) measures to ensure the same material is not posted again. A violation of this provision is subject to injunctive relief and actionable as a deceptive trade practice.
V. HB 783
House Bill 783 was signed by Governor Abbott on June 20, 2025, and takes effect on September 1. This bill makes individuals who impersonate another’s name, voice, signature, or likeness without consent and with intent to harm the individual being impersonated (i.e., “catfishing”) on social media liable for damages. To be actionable, the impersonation needs to be “virtually indistinguishable” from the actual person. (Note that Texas Penal Code Section 33.07 already criminalizes certain forms of online impersonation; this bill creates a civil cause of action.) There is an explicit exception for satire or parody. Civil remedies under this bill can include injunctive relief, actual damages, exemplary damages of not less than $500, costs, and attorneys’ fees.
VI. App Store Accountability Act SB 2420
Senate Bill 2420 was signed by Governor Abbott on May 27, 2025, and takes effect on January 1, 2026. This bill requires digital app marketplaces (i.e., app stores) to implement age verification and parental consent systems. Specifically, when any individual in Texas creates an account with an app store, the owner of that app store must use a commercially reasonable method of verifying the individual’s age and age category. Age categories include:
- under 13 “child”
- 13 to under 16 “younger teenager”
- 16 to under 18 “older teenager”
- 18 and older “adult”
Software developers must assign age ratings to their apps and verify users’ age categories and consent status. Accounts for minors must be linked to a parent or guardian account, and parental consent is required for each app download or in-app purchase. Consent requests must include specific information.
App store owners violate the law if they enforce contracts with minors without proper consent, use blanket consents, or fail to protect age verification data. Age ratings must be displayed for all apps.
The law does not apply if an app can be used without creating an account, and there are exceptions for emergency services, government, non-profits, and standardized testing. Violations are considered deceptive trade practices under Texas law.
VII. HB 581
House Bill 581 was signed by Governor Abbott on June 20, 2025, and takes effect on September 1. This bill requires operators of websites that have publicly available tools for creating “artificial sexual material harmful to minors” to use “reasonable age verification methods” to ensure that users are at least 18 years of age. (There are safe harbors for entities that include certain terms of use and take certain affirmative steps to limit the creation of such artificial sexual material harmful to minors.) Such website operators also must ensure that an individual used as the source for such material is at least 18 years of age and consented to the use of that individual’s face and body as the source of such material. The bill imposes civil penalties of up to $10,000 per day for violations of its provisions and a penalty of up to $250,000 if violation of the age verification requirements results in one or more minors accessing “sexual material harmful to minors.”
VIII. SB 1188
Senate Bill 1188, signed by Governor Abbott on June 20, 2025, takes effect September 1, with certain electronic health record storage provisions delayed until January 1, 2026. The bill amends the Texas Health & Safety Code to require “covered entities” to ensure electronic health records are physically stored in the United States, whether managed by third parties, cloud services, or other technologies. Access to these records must be limited to individuals needing the information for treatment, payment, or health care operations, and covered entities must implement safeguards to protect the records.
A “covered entity” includes most health care practitioners, with exceptions such as nursing homes and assisted living facilities. The bill requires electronic health records to allow practitioners to record communications about metabolic health and diet in chronic illness treatment. It prohibits including credit scores or voter registration information in health records. Each record also must include the individual’s biological sex as recorded at birth, with limited amendment options, and any decision support tools must use this information. The bill does not prohibit storing other information related to sex or gender identity.
In addition, health care practitioners using AI for diagnostics must act within their license, review AI-generated records for accuracy, and disclose AI use to patients. Minors’ records must be made available to parents or guardians upon request.
The Health and Human Services Commission and other agencies can investigate violations and take disciplinary action, and the Attorney General may seek injunctive relief and monetary penalties for violations.
IX. SB 1964
Senate Bill 1964, signed by Governor Abbott on June 20, 2025, and effective September 1, aims to protect individual rights regarding government use of AI in Texas.
The bill requires the Department of Information Resources (DIR) to keep an inventory of AI systems used by state agencies and to create an AI code of ethics for state and local governments. This code must address issues like human oversight, fairness, transparency, data privacy, accountability, and regular evaluation, and must align with national standards. Special rules apply to “Heightened Scrutiny AI Systems,” which are those making or heavily influencing important decisions.
DIR must also develop educational materials on responsible AI use, covering topics such as consumer rights and risk mitigation, and promote these to state and local governments. An eight-member advisory board will assist agencies with AI development and deployment.
Additionally, DIR will run a “sandbox program” to help eligible entities test and develop AI systems before deployment, sharing resources statewide.
State agencies must disclose public-facing AI systems unless it is obvious to users they are interacting with AI. Agencies using Heightened Scrutiny AI Systems must conduct confidential risk assessments.
Violations must be reported to DIR and the Attorney General. Vendors have 30 days to fix violations after notice, or their contracts may be voided. The Attorney General will also set up a web page for the public to report AI systems that unlawfully infringe on rights or financial livelihood, with complaints forwarded to DIR.
X. HB 2818
House Bill 2818 was signed by Governor Abbott on June 20, 2025, and takes effect on September 1. This bill creates an Artificial Intelligence Division inside the Department of Information Resources. This new division is tasked with helping state agencies and other entities that use DIR’s services modernize legacy state government computer systems more efficiently by using generative AI technologies.
XI. HB 3512
House Bill 3512 was signed by Governor Abbott on June 20, 2025, and takes effect on September 1. This bill (i) requires the Department of Information Resources to certify and periodically update AI and cybersecurity training programs, and (ii) requires certain state and local government employees (e.g., state employees who use a computer to complete at least 25% of their required duties) and school district employees (e.g., a school district’s cybersecurity coordinator) to complete such training programs.
Conclusion
Texas’s new AI laws reflect a rapidly evolving regulatory landscape, with significant implications for compliance, risk management, and innovation. Legal practitioners and clients should closely monitor legislative developments and proactively assess their AI systems, data practices, and platform policies to ensure alignment with these new statutory requirements. The availability of sandbox programs and clear enforcement mechanisms underscores the importance of early engagement with regulators and robust internal controls.
[1] We should also note that at least one version of the federal budget bill working its way through Congress includes a ten-year moratorium on all new state laws governing artificial intelligence.
