Governor Greg Abbott has signed the Texas Responsible Artificial Intelligence Governance Act (TRIAGA) into law, making Texas the second state (after Colorado) to pass a comprehensive AI statute applicable to both public and private actors. But unlike Colorado’s broad requirements, Texas kept it tight, focusing on a few specific, high-risk uses of AI rather than sweeping regulation.

If you’re working with facial authentication, security systems, or AI-based decision tools, this law should be on your radar. Below, we break down what’s in it, how it interacts with Texas’ biometric privacy law (CUBI), and why this might be the most startup-friendly AI legislation in the country.

 At a Glance

• Effective Date: January 1, 2026

• Applies to: Government, businesses, individuals

• Focus: Harmful behavior, biometric misuse, transparency

• Key Update: Major clarification of biometric privacy law (CUBI)

• Enforcement: Texas Attorney General only (no private lawsuits

Legislative Background: A Targeted Response to Targeted Concerns

TRIAGA didn’t show up out of nowhere. It followed national conversations around AI misuse—deepfakes, discriminatory algorithms, and opaque government systems. But it also followed serious engagement from technologists and privacy advocates.

At the Texas Capitol, developers asked for clarity. Privacy organizations wanted meaningful guardrails. Legislative testimony and committee reports reflect a balance between those camps. Importantly, state legislators clarified during hearings that tools like facial authentication used for security—especially with notice—are not the focus of this law.

Legislative analysis, including the Texas House Research Organization’s report, emphasized avoiding the EU’s overreach while still creating enforceable rules. Testimony also led to a clearer carveout for security tools, which helped keep common applications, like facial recognition for building access, out of the penalty box.

The House Research Organization’s bill analysis highlighted TRIAGA’s intent: Limit harmful or rights-infringing AI but make room for tools that help Texans live and work more safely.

What TRIAGA Covers: Two Tracks, One Goal

TRIAGA regulates both the public and private sectors, but not identically. It outlines specific prohibited uses of AI that apply to all persons and adds a few extra restrictions for governmental entities.

Key Rules That Apply to Everyone

These are targeted, outcome-focused prohibitions. If you're not using AI for harm, you're likely in the clear.

Extra Rules That Apply to Governmental Entities

Let’s drill into that last one, because it's where confusion tends to live

Biometrics: Permitted if Rights Are Respected

TRIAGA does not ban biometrics, facial recognition, or facial authentication by government entities. It only restricts how they use it:

A governmental entity may not develop or deploy an artificial intelligence model for the purpose of uniquely identifying a specific individual using biometric data… without the individual’s consent if the gathering would infringe on any right under the U.S. or Texas Constitution or any other law. (§ 552.054)

Plain English:

• You can use AI with biometrics if it doesn’t violate rights and you’ve given notice or obtained consent where needed.

• Uses for security, access control, and safety are permitted, especially if accompanied by a privacy policy or signage.

This is consistent with the legislative history, which emphasizes keeping high-value government tech uses intact while avoiding China-style surveillance.

Here’s a better breakdown of how TRIAGA treats common government use cases:

So, facial authentication for facility access or security screening? That’s 100% permitted, especially with notice and safeguards in place.

The Subtlety of Section 552.054: Consent “If” Rights Are Violated

One of the most legally nuanced provisions is Section 552.054. It states:

“A governmental entity may not develop or deploy an artificial intelligence system for the purpose of uniquely identifying a specific individual using biometric data or the targeted or untargeted gathering of images or other media from the Internet or any other publicly available source without the individual’s consent, if the gathering would infringe on any right of the individual under the United States Constitution, the Texas Constitution, or a state or federal law.”

Translation: Government agencies are not prohibited from using AI for biometric identification without consent—unless that use infringes on rights under the U.S. Constitution, Texas Constitution, or any state or federal law.

Important: It does not include "any other state's law." TRIAGA limits this to Texas and U.S. law, so California’s BIPA or Illinois' biometric law would not trigger this clause unless adopted by Texas.

This is a conditional restriction, not a categorical ban. It requires careful legal interpretation of whether a given use crosses a rights threshold (e.g., unreasonable search, due process violation, etc.).

The only enforcement authority, the Texas Attorney General, has broad discretion in how this is applied.

What About CUBI — Texas’ Biometric Privacy Law?

CUBI (the Capture or Use of Biometric Identifier Act) has existed since 2009. It says private entities can’t collect biometric data without consent. But it’s had gray areas, particularly what is and isn’t a “commercial purpose” triggering CUBI requirements. TRIAGA brings some clarity:

✅ Security/Safety Exemption

Under a new clarification added under TRIAGA, CUBI does not apply to biometric data used for a security or safety purpose.

So if you’re using facial authentication to protect access to facilities, systems, or physical spaces, CUBI likely doesn’t apply.

✅ AI Training Carveout

CUBI also doesn’t apply to biometric data used to train an AI model, as long as the data isn’t being used to identify a real person in the process.

These two changes make CUBI more navigable for innovators and those purchasing the innovation. 

Are Government Entities Bound by CUBI? TRIAGA?

Generally, no. CUBI applies to “commercial purposes.” State agencies, local governments, and public colleges and hospitals in Texas are generally considered governmental entities rather than private entities. As such, they are typically not engaged in activities for a “commercial purpose” as contemplated by CUBI. 

So:

Enforcement and Judicial Clarity

Under TRIAGA, there is no private right of action. Enforcement is exclusive to the Texas Attorney General, and violators have 60 days to fix the problem before penalties kick in.

That matters. It means the law is meant to guide, not punish. And it gives companies a chance to learn and adapt.

Yes, courts may still have to interpret terms like “interact,” “publicly available,” or “social scoring.” But the plain language gives us a lot to work with.

Under Texas law, when a statute doesn’t define a term, courts typically look first to the plain language—the ordinary, everyday meaning—of the word. That’s why it’s important to be clear about how these key terms are likely to be interpreted:

Similarly, HB 149 doesn't define security or safety, but by plain language, legislative context, and analogy, it likely includes:

These definitions help reduce legal ambiguity while providing compliance clarity for product and security teams.

No Portland-Style Bans in Texas

Remember when Portland banned private companies from using facial recognition—even for basic security? Yeah, Texas didn’t do that.

Thanks to a preemption clause in TRIAGA, local governments can’t pass their own AI laws that are stricter than the state’s:

“A political subdivision of this state may not adopt or enforce a law… that conflicts with or is more stringent than this subchapter.” (Texas Gov’t Code § 552.059)

That means:

• ✅ No city-by-city patchwork

• ✅ One consistent statewide standard

• ✅ More legal clarity for developers and buyers

In other words: Texas won’t let cities go rogue on AI policy.

The Sandbox: Innovation Gets a Launchpad

TRIAGA doesn’t just restrict bad behavior—it encourages innovation with a regulatory sandbox. If you're developing new AI products, especially those that need real-world testing, this is a big deal.

How It Works:

• Administered by the Texas Department of Information Resources (DIR)

• You apply, describe your use case, and show public benefit

• If approved, you get temporary regulatory relief to test your AI responsibly

• You’re still under oversight and transparency rules

This is modeled on fintech and health sandboxes. Texas wants you to test smart ideas here, not somewhere else.

So if you’re building something new and important but don’t want to trip over unclear rules, this is the off-ramp you need.

Final Take: Texas Built a Law That Balances Innovation and Accountability

TRIAGA isn’t perfect, but it’s practical. If you’re developing or deploying AI in Texas, especially in facial authentication, identity security, or automation, this law:

✅ Defines what’s clearly off-limits
✅ Leaves space for practical tools
✅ Adds a sandbox for next-gen ideas
✅ Aligns CUBI with real-world development needs

Texas didn’t say “no” to AI. It said, “Do it right.”

Need help navigating TRIAGA, CUBI, or putting together a sandbox application? Unified Law works with AI and biometric companies across sectors. Let’s build responsibly—without red tape.

Contact us to learn more.