Texas Responsible AI Governance Act

Statute United States (Texas)

TRAIGA is the US answer to the EU AI Act that nobody expected to come from Texas, and it took a genuinely different route. Where the EU sorts systems by risk tier and attaches duties to the tier, TRAIGA attaches liability to intent. Signed 22 June 2025, in effect 1 January 2026.

• Prohibited purposes, not prohibited categories - Developing or deploying an AI system with the intent to incite self-harm or crime, to manipulate behaviour in ways that circumvent informed decision-making, to conduct government social scoring, to uniquely identify individuals from biometric data without consent, or to unlawfully discriminate against a protected class.
• Intent is the element - Disparate impact without intent is expressly not enough for the discrimination provision. This is the whole design, and it is what made the bill passable.
• A NIST AI RMF safe harbour - An organisation substantially complying with the NIST AI Risk Management Framework gets an affirmative defence. A voluntary framework, given teeth by being the thing that protects you.
• Attorney-General enforcement with a cure period - Civil penalties from $10,000 to $200,000 per violation, with notice and an opportunity to fix.
• A regulatory sandbox and an AI Council - Time-limited authorisation to test systems outside the ordinary rules.

The safe harbour is the provision with the longest reach, and I do not think its significance is widely appreciated outside of compliance teams. NIST AI RMF was published as guidance — genuinely voluntary, deliberately non-prescriptive, adopted mostly by organisations that already wanted to do the work. TRAIGA converts it into the cheapest available insurance policy in the state of Texas. That changes the economics of adopting it for every company that was previously treating it as optional, and it does so without the legislature having to write a single technical requirement itself.

That mechanism — legislate the liability, point at an external standard for the defence — is one I expect to see copied, and it is the most API-relevant thing in the statute. It means the operative compliance artefact is not defined by law at all. It is defined by NIST, revised by NIST, and whatever machine-readable expression the AI governance community builds around NIST AI RMF becomes, in Texas, legally load-bearing.

For the catalog the practical question is what a provider can publish that evidences substantial compliance. Today, essentially nothing standardised: RMF conformance is an internal programme with internal documents. If there is a gap worth someone building a specification into, it is this one — a declarative, publishable profile of AI RMF conformance that a customer, a partner or an Attorney-General can retrieve rather than request. Texas just created the demand for it.