Status: Enacted — Signed by Governor Greg Abbott on June 22, 2025. Effective January 1, 2026.

Bill Number: Texas HB 149 (89th Legislature, Regular Session)

Jurisdiction: Texas

Category: AI Governance, Biometric Privacy, Consumer Protection

Industries: All Texas-operating businesses deploying AI; particular relevance for Physical Security, Healthcare, K-12, Higher Education, Retail, and any operator using camera-based AI

Enacted Date: June 22, 2025

Effective Date: January 1, 2026

Summary: The Texas Responsible Artificial Intelligence Governance Act (TRIAGA), codified through HB 149, establishes the first comprehensive state-level AI governance framework in Texas. Unlike Colorado's original AI Act, TRIAGA takes a narrower approach focused on prohibited uses, consumer disclosure, and government-deployer transparency. The statute also materially amends Texas's Capture or Use of Biometric Identifier Act (CUBI) to clarify how biometric data may be processed in AI training and to create explicit exemptions for AI systems used for safety, security, and law enforcement purposes — provided those systems are not used or deployed to uniquely identify a specific individual. The Texas Attorney General holds exclusive enforcement authority and must provide a 60-day cure period before pursuing action.

Key Provisions:

Prohibited Uses: Bans AI systems intended to incite self-harm, infringe constitutional rights, or unlawfully discriminate against protected classes.
Government-Deployer Disclosure: State agencies that deploy AI to interact with the public must clearly disclose AI involvement to consumers.
CUBI Security Carveout: Amends the Capture or Use of Biometric Identifier Act to exempt from notice and consent requirements (a) the training, processing, or storage of biometric identifiers used to develop, evaluate, or offer AI models or systems, and (b) the development or deployment of AI models or systems for security purposes or to prevent illegal activity — unless the system is used to uniquely identify a specific individual.
Publicly Available Media Clarification: Clarifies that consent is not implied solely because biometric identifiers appear in publicly available media unless the individual themselves made the media public.
Preemption: Expressly nullifies city and county AI ordinances to prevent a local patchwork.
Enforcement & Penalties: Exclusive AG enforcement authority; 60-day cure period; civil penalties tiered as: $10,000–$12,000 per curable violation, $80,000–$200,000 per uncurable violation, and $2,000–$40,000 per day for continuing violations.
No Private Right of Action: Consumers cannot sue directly under TRIAGA.

Affected Entities: Any business deploying AI in Texas or directed at Texas residents, including physical security operators, biometric data processors, healthcare systems, K-12 districts, and retailers. State and local government deployers face additional disclosure requirements.

Compliance Outlook: TRIAGA's security and safety carveout is one of the most operator-friendly biometric regimes in the country — explicitly recognizing that camera-based AI used to prevent harm should not be regulated identically to biometric systems used to uniquely identify people for commercial purposes. Organizations evaluating AI physical security platforms in Texas should confirm vendor positions on (1) whether the system retains biometric templates, (2) whether the system attempts to uniquely identify individuals, and (3) whether the deployment qualifies as a security or safety use under the CUBI carveout. The Texas AG's exclusive enforcement authority and the 60-day cure period reduce litigation risk relative to states with private rights of action under biometric privacy statutes.

Enforcement Status (Updated May 2026): Five months after taking effect, TRIAGA's enforcement infrastructure is still being built rather than actively prosecuted. The Texas Office of the Attorney General has not yet filed a formal TRIAGA enforcement action, and no civil investigative demands have been publicly reported. The statute requires the AG to stand up a consumer complaint portal on its website, with a statutory deadline of September 1, 2026; that portal is currently in development. Practical takeaway for Texas deployers: the 60-day cure period and absence of a private right of action have produced a measured early-enforcement posture, but operators should treat the September 1, 2026 portal launch as the realistic start of routine complaint-driven enforcement and have their CUBI security carveout documentation in order before that date.

IntelliSee Relevance: Direct — High. TRIAGA's CUBI security carveout aligns directly with IntelliSee's architecture. The platform analyzes camera streams in real time to detect visible firearms, falls, unauthorized access, and aggressive behavior without persisting biometric templates and without facial recognition. IntelliSee does not attempt to uniquely identify individuals, which positions the platform within TRIAGA's security carveout and outside CUBI's notice-and-consent regime. For Texas operators — particularly hospitals already navigating SB 240 healthcare workplace violence obligations and K-12 districts evaluating school safety investments — IntelliSee provides AI-powered detection that satisfies safety objectives without triggering biometric consent burdens. See the 2026 Biometric Privacy Compliance Briefing for full vendor-evaluation context.

Texas Responsible Artificial Intelligence Governance Act (HB 149 / TRIAGA, 2025)

Related Legislation & Resources

Turn Legislative Mandates Into a Working Safety Program