Texas HB 149 · TRAIGA

Texas just made AI a $200,000-per-violation liability. Most professional services firms are still running blind.

The Texas Responsible AI Governance Act has been in effect since January 1, 2026. The Attorney General is the sole enforcer, the complaint portal is live, and there is a clean safe harbor for firms that document NIST AI RMF compliance before a complaint lands. This page is the operating-side playbook for Texas-domiciled law firms, CPA practices, financial advisories, and accounting firms.

Take the 4-Minute Readiness Assessment Book a 30-Min Exposure Call

Section 1

The Law in 60 Seconds

The facts you need, sourced from the enrolled text of HB 149 and corroborated against Norton Rose Fulbright and K&L Gates.

Effective Date

Jan 1, 2026

Signed June 22, 2025 by Gov. Abbott. Currently in force.

Who It Applies To

Texas Nexus

Doing business in Texas, selling to Texas residents, or developing or deploying AI inside the state.

Civil Penalties

$10K–$200K

Per violation, plus $2K to $40K per day for continuing violations.

Enforcer

Texas AG

Sole enforcement authority. No private right of action. 60-day cure period after notice.

Section 2

What TRAIGA Actually Prohibits

HB 149 names five intent-based prohibitions. For a typical Texas law firm, CPA practice, financial advisory, or accounting firm, two are the live exposure.

Intentional Unlawful Discrimination Through AI

Developing or deploying an AI system with intent to unlawfully discriminate against a protected class, or to infringe constitutional rights. Insurers and federally insured financial institutions get a carve-out when complying with their existing regulators; every other firm is in the open.

Incitement and Behavioral Manipulation

AI systems designed to push a person toward self-harm, harm to others, or criminal activity. Rare exposure for legitimate pro-services use, but the documentation burden still applies if a complaint surfaces.

Government Agency AI Disclosure Failure

Applies only when your firm acts as a government agency. Out of scope for private pro-services firms.

Healthcare Provider AI Disclosure Failure

Applies when your firm is a licensed healthcare provider. Out of scope for most professional services unless you serve clients in a clinical capacity.

Government AI-Based Social Scoring

Applies only to government agencies. Out of scope for private pro-services firms.

Intent-based, not risk-tier-based. Unlike Colorado SB 205 or the EU AI Act, TRAIGA hinges on what your firm meant to do. Most legitimate business use of HubSpot Breeze, Clio Duo, Karbon AI, Pipedrive, or Salesforce Einstein sits outside the prohibited zone. Exposure shows up when the firm cannot document intent, testing, or oversight if the AG asks.

Section 3

The Safe Harbor (This Is the Whole Game)

HB 149 builds in an affirmative defense for firms that show good-faith compliance with the NIST AI Risk Management Framework. The statute also protects firms that catch and remediate issues through internal review, red-teaming, or stakeholder feedback.

Govern

A written AI use policy, a named accountability owner, vendor disclosures on file.

Map

An inventory of every AI-touched workflow, classified by where consequential decisions get made.

Measure

Testing notes, fairness checks, and monitoring logs that show the system did what you said it would do.

Manage

A remediation playbook so that if something surfaces, the response is documented before the AG sees it.

For most professional services firms a defensible NIST mapping runs 4 to 8 hours of scoping plus a deliberate documentation sprint, well short of a six-figure compliance overhaul.

Section 4 · Interactive

TRAIGA Readiness Assessment

10 questions, about 4 minutes. Get your firm's exposure tier plus the top three NIST controls and exposure points to focus on first. No email required to see your results.

Before you start

10 questions · ~4 minutes · No email required for results

This assessment maps your firm against the five TRAIGA exposure dimensions: Texas nexus, sector regulatory overlap, AI deployment depth, governance maturity, and accountability posture. It returns a tier plus the three NIST controls most likely to move your defensible position forward.

Built by a Halan Digital fractional AI officer. Operating-side guidance, not legal advice.

Question 1 of 10

Tier

Your Tier

Top 3 NIST Controls to Address First

Likely Exposure Points for Your Profile

Next Step

A 30-minute Exposure Call to map your firm's situation specifically. No pitch deck, no engagement letter at the table.

Book a 30-Min Exposure Call Download the One-Pager

Want your results emailed?

Drop your email and I will send the one-pager plus your tier read and recommended controls. No nurture spam.

Got it. The one-pager is in your inbox within a few minutes.

Retake the assessment

Section 5

The 30 to 60 Day NIST Mapping Sprint

What the engagement actually looks like for a typical small-to-mid Texas professional services firm.

Week-by-Week

Inventory every AI-touched workflow across the firm. Tag each one by department, vendor, and whether a consequential decision is involved.
Map each workflow to the four NIST functions. Identify where Govern, Map, Measure, and Manage controls already exist and where they do not.
Build the policy, accountability, and vendor-disclosure layer. Named owner, written use policy, signed vendor representations on file.
Red-team the highest-risk workflow. Document the issue, the fix, and the review loop so the safe harbor is on paper, not in someone's head.
A binder (or a structured Notion or SharePoint set) the AG would see as good-faith compliance if a complaint ever landed.

What the Sprint Is

A fractional engagement that produces the documentation layer your outside counsel and your E&O carrier both expect. Fixed scope, fixed price, fixed timeline. Built by an operator who ran ad spend, hiring, and tooling decisions for actual firms, not a compliance theorist with a checklist.

Honest limits. The sprint produces the documentation layer your outside counsel and your E&O carrier both expect, alongside (never instead of) your legal representation.

Section 6

Why Me, Specifically

I work as a fractional AI officer for Texas pro-services firms, sitting in the operating-side gap between the AI tools the firm already pays for, the operations those tools touch, and the compliance posture the AG portal expects the firm to be able to show. My role is adjacent to your outside counsel and your IT vendors, not a replacement for either.

The work I do for Texas pro-services firms looks like the work I have already done for a Dallas chiropractic practice (regulatory-overlap-heavy operating-side strategy), a Dallas craft brewery (operations and automation audit), and a specialty industrial construction firm (AI estimating and proposal architecture). The common thread is operating-system thinking. Where are the inputs? Where are the bottlenecks? What metric changes when the documentation is real?

TRAIGA exposure is a documentation problem before it is a legal problem. The firms that do well on it are the firms that already know how their operations actually run. The firms that get hurt are the ones who learn how their operations run from an AG civil investigative demand.

Background

Petroleum EngineerAnalytical rigor, systems thinking, control-system mindset.
Healthcare Business OwnerService operations, regulated environment, real payroll.
Search Fund OperatorEvaluated 100+ businesses on operations and risk, not deck talk.
Service Business OperatorMoving and junk removal. Phones, scheduling, cash. The unglamorous fundamentals.
Halan DigitalFractional AI officer engagements for regulated and operating-heavy firms.

Section 7

Frequently Asked Questions

Does this apply to my firm if we are out of state but serve Texas clients?

Yes. HB 149 reaches any firm that promotes, advertises, or conducts business in Texas, or whose products or services are used by Texas residents. The Texas Attorney General can bring an action against an out-of-state firm whose AI system affects Texas residents. Your physical office location is not the gate; your client base is.

My CRM has AI features I never turned on. Am I a deployer?

If the feature is active in your tenant, you are deploying it. Salesforce Einstein, HubSpot Breeze, Clio Duo, and similar embedded AI features fall in scope the moment they touch a client interaction or a consequential decision (intake routing, lead scoring, document drafting). The NIST mapping work covers exactly this gray zone, where firms have AI running without knowing they own the documentation burden.

How is TRAIGA different from the EU AI Act or Colorado SB 205?

EU AI Act and Colorado SB 205 are risk-tier-based: a system is categorized as high-risk and then specific obligations attach. TRAIGA is intent-based: liability turns on what the firm meant to do. That is friendlier to good-faith operators but harsher when documentation does not exist, because the AG can argue intent from circumstances. The NIST AI RMF safe harbor is the documented intent layer.

Is the NIST AI RMF safe harbor court-tested yet?

No. The law took effect January 1, 2026. There is no published TRAIGA enforcement action yet, and no case law interpreting the affirmative defense. That is the honest answer. The reasonable read is that documented good-faith compliance with NIST AI RMF substantially reduces enforcement risk, but firms should expect that reading to be tested as the AG portal generates its first cohort of complaints.

Do I still need a law firm in addition to this?

Yes. The mapping sprint is operating-side scaffolding. Your outside counsel should review the policy language, advise on specific exposure scenarios, and represent the firm if the AG ever sends a civil investigative demand. The sprint makes counsel's job cheaper and faster because the documentation already exists.

What does the 30-minute call cover?

Where your firm is on the Texas nexus question, which AI tools you already have in active use, where your governance posture sits today, and what a defensible mapping looks like for your specific situation. If the sprint is the right move, we talk scope and pricing. If it is not, you leave with a clearer read of where your real exposure lives. No pitch deck.