If your company screens resumes with software, runs a chatbot on its website, or uses a tool that scores applications or flags accounts for review, Texas has had a law on the books about that since the first of the year. Most business owners in Collin and Denton counties have not heard of it, and the ones who have tend to have heard the alarming version rather than the accurate one.
The Texas Responsible Artificial Intelligence Governance Act, House Bill 149, took effect January 1, 2026. It is worth ten minutes of your attention, both because it reaches further than people expect and because what it actually prohibits is narrower than the headlines implied.
Who the law applies to
The statute reaches any person conducting business in Texas who develops, deploys, or offers an artificial intelligence system in this state. That phrasing is doing a lot of work. You do not have to build AI to be covered. You only have to use it.
In practice that sweeps in a large share of North Texas employers. A staffing company running applicant tracking software with automated ranking is deploying an AI system. So is a medical practice using an intake tool that triages patient messages. So is a distributor whose customer service runs through a chatbot, and a lender using an automated risk score. None of these companies think of themselves as AI businesses. Under HB 149 the label does not matter.
The law also applies to governmental entities, with some prohibitions that reach only them. Those provisions on social scoring and biometric identification without consent do not apply to private employers, which is a distinction worth understanding before you read a summary that blurs the two.
What the law actually prohibits
Here is where the early coverage got ahead of the statute. HB 149 is not a general AI regulation imposing audits, impact assessments, or disclosure obligations on ordinary commercial use. It prohibits a specific and fairly narrow set of things.
It bars developing or deploying an AI system that intentionally aims to incite or encourage a person to commit physical self-harm, harm another person, or engage in criminal activity. It bars developing an AI system with the sole intent of infringing, restricting, or otherwise impairing rights guaranteed under the United States Constitution. It bars developing or deploying an AI system with the intent to unlawfully discriminate against a protected class. And it bars systems designed to produce child sexual abuse material or to simulate sexual conduct involving a minor.
For the governmental entities the statute reaches, it separately prohibits using AI to assign social scores based on social behavior or personal characteristics that result in detrimental treatment, and prohibits using AI for biometric identification of individuals without consent.
Read that list again with your own operations in mind. A company using ordinary commercial AI tools in good faith is not doing any of it.
The intent standard is the whole ballgame
This is the provision that should shape how you think about compliance, and it is the one most summaries mention in passing.
HB 149 requires intentional conduct. And on the discrimination prohibition specifically, the statute says that a disparate impact is not by itself sufficient to demonstrate an intent to discriminate.
That single sentence separates Texas from the approach several other states have taken. Under a disparate impact framework, an employer could face liability because a screening tool produced statistically uneven outcomes across protected groups, regardless of what anyone intended. Texas rejected that. Under HB 149, uneven outcomes alone do not establish a violation. Someone has to have meant to discriminate.
This does not make your hiring tool risk free. Federal employment law still applies, and Title VII disparate impact analysis has not gone anywhere. It means that this particular Texas statute is not the thing that turns a well-intentioned vendor tool into a violation.
Enforcement, penalties, and the cure period
Three structural features matter more to a business owner than the prohibited conduct list, because they determine what actually happens if a question arises.
First, enforcement sits exclusively with the Texas Attorney General. There is no private right of action. A customer, a competitor, or a rejected applicant cannot sue your company under this statute. That is a meaningful limitation on your exposure, and it is unusual enough among recent technology statutes to be worth noting.
Second, there is a cure period. The Attorney General must provide written notice, and you have 60 days to remedy the alleged violation. Compliance problems under this law do not arrive as a lawsuit. They arrive as a letter with a clock attached.
Third, the penalty structure distinguishes between violations that get cured and violations that do not. Curable violations that are actually cured within the window carry civil penalties in the range of $10,000 to $12,000. Violations that are not cured, or are not curable, run from $80,000 to $200,000. Continuing violations carry additional daily penalties between $2,000 and $40,000.
The gap between the cured and uncured tiers is roughly an order of magnitude. That is a deliberate design choice, and it tells you what the statute wants from you: not perfection, but responsiveness.
The safe harbor most companies should be using
HB 149 provides an affirmative protection from civil penalties for entities that comply with a recognized artificial intelligence risk management framework, including the framework published by the National Institute of Standards and Technology.
The NIST AI Risk Management Framework is a voluntary standard organized around governing, mapping, measuring, and managing AI risk. It is not a certification you buy. It is a structure you adopt and document.
For a mid-sized North Texas company, adopting it in a meaningful way is not a six figure project. It generally means knowing which AI tools are in use across the business, understanding what data each touches and what decisions each influences, documenting who is accountable for them, and reviewing that inventory on a set schedule. Companies that do that work and can show it have a statutory argument available to them that companies operating informally do not.
Where to start
If you take one action from this article, make it an inventory.
Most companies we talk to cannot produce a list of the AI systems operating inside their business. Tools arrive through vendors, through software updates that quietly add an AI feature, and through individual employees adopting something useful without telling anyone. The marketing team signs up for a content tool. HR turns on the screening feature that came with the applicant tracking system. Customer service enables a suggested-reply function.
None of that is improper. But you cannot assess exposure under a statute that turns on intent and deployment if you do not know what your company has deployed.
A workable first pass asks four questions of every department. What software are you using that makes a recommendation, a ranking, a score, or a decision? What data goes into it? What does the output affect, and does a person review it before it takes effect? Who is the vendor and what do their terms say about how the model was trained?
That exercise usually takes a few weeks, surfaces two or three tools nobody at the leadership level knew about, and gives you the foundation for both the NIST safe harbor and any conversation with counsel that follows.
What this means going forward
HB 149 is the first comprehensive artificial intelligence statute Texas has enacted, and it will not be the last word. The Legislature meets again in 2027, federal activity continues, and the practical scope of the statute will get clearer as the Attorney General’s office begins enforcing it.
For now, the sensible posture for a North Texas business is neither alarm nor indifference. The prohibited conduct list is narrow and intent based. The enforcement structure is forgiving to companies that respond promptly. And there is a documented path to a statutory safe harbor for companies willing to organize their AI use rather than let it accumulate.
The businesses that will have trouble under this law are the ones that cannot answer basic questions about what they are running. That is a solvable problem, and it is much cheaper to solve before a letter arrives than after.
If you want help building that inventory or evaluating where your company stands, the business attorneys at Hanshaw Kennedy Hafen work with companies across Frisco, Plano, McKinney, and the surrounding North Texas communities. Visit our Business Law page to learn more.