Texas is getting into the AI action, with a new law (the Texas Responsible Artificial Intelligence Governance Act) that will place restrictions not only on AI use by government agencies, but businesses as well. In particular, it will apply to businesses (a) operating in Texas, (b) those that have products or services used by those in the state, or (c) those that develop or deploy AI systems in Texas. The requirements of the law will take effect January 1, 2026. Some things for companies to keep in mind about the law’s requirements:

• Appropriate uses: The law will require that companies take steps to ensure that AI systems are not used, among other things to intentionally incite or encourage criminal activity, self-harm, or harm to others. Covered businesses will also have to review AI system use to make sure it does not violate state of federal discrimination laws. AI systems also cannot, under the law, be used to impair someone’s constitutional rights. AI also cannot be used to develop content that simulates child pornography or explicit deepfake imagery.
• Biometric data: The new law will modify the state’s existing biometric law to incorporate additional AI provisions. If companies intend to input or otherwise biometric identifiers (e.g., fingerprints, retina scans, facial geometry) in connection with AI for commercial purposes, they will need to get proper consent. These commercial purposes might include, for example, using biometric data to train AI. Data will also need to be destroyed within one year after the purpose for collection expires.
• Healthcare providers: Once in effect, healthcare providers that use AI tools as part of their provision of treatment will need to notify patients of this before starting treatment (or as soon as possible in emergencies). This is similar to Utah’s law that requires disclosures for those in regulated professions, including healthcare.
• New “regulatory sandbox” program: The law creates a “regulatory sandbox” program that allows approved businesses to test innovative AI systems for 36-month periods. The intent is to allow companies to create and test AI systems in the state. Among other things, as part of the program the Attorney General will not be able to file or pursue charges if a program participant has violated the new AI law during the testing period.

The law will be enforced by the Texas attorney general and does not include a private right of action. There is also a safe-harbor provision in the law: if a company discovers a violation and promptly remediates it, it can avoid liability. There will also be a rebuttable presumption of care if a company follows industry-recognized standards like NIST’s AI Risk Management Framework. Finally, the law establishes an AI council, which will provide guidance on AI development and use.

Putting it Into Practice: In the months before this law goes into effect, covered businesses may want to review their use of AI systems to assess the extent to which these new laws requirements might apply. This includes training AI on biometric data, as well as -for healthcare providers- using AI as part of the provision of health care services.

Listen to this post

James O'Reilly also contributed to this article.