Does Texas's AI law apply to your business?

The Texas Responsible Artificial Intelligence Governance Act took effect in January 2026 and added Chapter 552 to the Business and Commerce Code. Its structure is unusual among state AI laws and worth understanding, because it decides how much work a business actually has to do: it is built on prohibited intentional conduct rather than on a risk management regime. Developing or deploying a system with the specific intent to unlawfully discriminate against a protected class is prohibited, and the statute is explicit that disparate impact alone does not establish the intent. There is no duty to conduct impact assessments, no algorithmic discrimination duty of care, and no filing.

That means most ordinary commercial uses — drafting, summarising, scheduling, routing, quoting, support — are not in scope of the prohibitions at all, and a business whose compliance instinct is to build a governance programme has probably misread the statute. The obligations that do bite are narrower and specific: a health care provider using AI in a patient's diagnosis or treatment must disclose that to the patient or their representative, and government use carries its own requirements.

Enforcement sits exclusively with the attorney general, with a sixty-day cure period after notice and no private right of action. The absence of a private right of action is the single most consequential feature for a small business, because it means exposure arrives through an enquiry rather than through a plaintiff's firm, and it makes the cure period a real remedy rather than a formality.

The law that actually reaches most Texas businesses is the state's privacy statute, and it reaches them because of what it does not have. Where other states set thresholds by revenue or by numbers of consumers, Texas exempts businesses that qualify as small under the federal small business standards — which vary by industry and are defined by employee counts or receipts specific to that industry rather than by a single figure. A business above its own industry's standard is covered however modest it looks against a national revenue threshold, and even a business below it cannot sell sensitive personal data without consent.

For AI use, being covered means the ordinary privacy obligations follow the data into the tool: notice of what is collected and shared, a route for consumers to exercise their rights, a contract with any processor, and consent before sensitive categories are processed. A vendor receiving personal data to perform a service is a processor, and the contract with them is a requirement rather than good practice.

The practical order of work is therefore the reverse of the one the headlines suggest. Establish whether the privacy statute covers you, because the answer is not obvious and the obligations are continuous. Then check the AI statute against your actual uses, which for most businesses takes an afternoon and ends with a short list of things nobody was doing anyway — plus, in health care, one disclosure that has to be built into how patients are communicated with.