AI Regulation Tracker  /  Enforcement

Texas Attorney General's TRAIGA Enforcement Powers Are Now Live

On January 1, 2026, the Texas Responsible AI Governance Act took effect, switching on the enforcement machinery the legislature signed into law in 2025. The Texas Attorney General now holds exclusive authority to police AI use in Texas, with civil penalties that run up to $200,000 per uncurable violation, civil investigative demands, and a 60-day window to fix problems before a suit can land.

By Anthony Guerriero  ·  The Leveraged Years Regulatory Research  ·  Published July 16, 2026  ·  Last updated July 16, 2026

Here is the plain version. Texas passed a broad AI governance law in 2025. The signing was the headline last year. The date that actually matters for enforcement is January 1, 2026, and that date has now passed. As of the start of this year, the parts of the law that give the Attorney General teeth are operative. That is the story: not a new bill, but the moment an existing bill started to bite.

Who enforces it, and how

The act puts enforcement in one place. The bill analysis states that "the attorney general has exclusive authority to enforce this chapter," subject to a narrow exception in the statute. There is no shared enforcement with other Texas agencies as a general matter, and, importantly, no path for private plaintiffs. The statute is direct on that point: "this chapter does not provide a basis for, and is not subject to, a private right of action for a violation of this chapter." If you are worried about TRAIGA, the party you are answering to is the state, not a class of consumers.

The AG also has an investigative tool that matters in practice. When a complaint comes in through the online mechanism the act sets up, the AG can "issue a civil investigative demand to determine if a violation has occurred." A civil investigative demand is the compulsory information request that turns a complaint into a real inquiry. Guidance around the act describes the AG being able to ask for a high-level description of an AI system's purpose and intended use, the types of data used to train it, the inputs and outputs, the metrics used to evaluate performance and known limitations, and how the deployer monitors the system after launch. If you cannot answer those questions cleanly, the demand is where that shows up.

The penalty schedule

The statute does not set a single penalty number. It sets ranges tied to how the court characterizes the violation. Read them in order, because the jump between tiers is the whole point.

• Curable violations, or a breach of a statement the person submitted to the AG: "not less than $10,000 and not more than $12,000."
• Uncurable violations: "not less than $80,000 and not more than $200,000."
• Continuing violations: "not less than $2,000 and not more than $40,000 for each day the violation continues."

The design rewards fixing the problem and punishes leaving it. A violation you cure sits in the low band. A violation the court finds uncurable sits in the high band, up to $200,000. And a violation you let run keeps accruing every day it continues. On top of the penalties, the AG can seek injunctive relief to stop the offending system, plus attorney's fees and reasonable investigative costs. The financial exposure is not just the headline number. It is the number multiplied by conduct that keeps going.

The cure period is the safety valve

The act builds in a chance to fix things before a suit. The AG is barred "from bringing an action against the person before the 60th day after the date the attorney general provides the notice." So the sequence is notice first, then a 60-day window. Inside that window, the intended move is to cure the violation and document it for the AG. A complete and timely cure keeps you out of the higher penalty tiers, because the statute reserves the $80,000 to $200,000 band for violations the court determines to be uncurable. Miss the window, or fail to actually fix the problem, and the cheaper path closes.

I want to be precise about what this window is and is not. It is procedural breathing room, not a free pass. It runs only after the AG has already decided to send notice, which usually means an investigation has already found something. Treating the cure period as your compliance plan is backward. It is the last exit, not the first one.

Why this reaches beyond Texas

TRAIGA is one of the broadest state AI governance statutes in the country, and that breadth is the reason a Texas enforcement date is national news. The act reaches persons who develop, deploy, or make AI systems available in Texas, which pulls in plenty of companies that do not think of themselves as Texas businesses but whose products touch Texas residents. If your AI system is used in the state, the AG's authority can reach you regardless of where your headquarters sits.

There is also a pattern worth watching. When one large state builds a real enforcement apparatus, exclusive AG authority, a defined penalty schedule, a cure period, and compulsory investigative demands, other states tend to borrow the machinery. The specific dollar figures and the cure window are the kind of concrete design choices that get copied. Texas has now moved this from statute on paper to enforcement in operation, and that is the version other legislatures study.

What this means for finance and compliance teams

For US CPAs and finance leaders, the direct question is exposure. If your organization uses AI in any way that touches Texas, the enforcement side of TRAIGA is now live, and the party with authority is a state attorney general armed with investigative demands and a penalty schedule that tops out at $200,000 per uncurable violation before daily penalties are added. That is not an abstraction anymore. The effective date passed.

The practical work is the same work good governance always asks for, and it maps almost exactly onto what a civil investigative demand would request. Can you describe what each AI system is for and how it is used. Do you know what data trained it and what it takes in and puts out. Do you track its performance and its known limits. Do you monitor it after deployment. If the answers to those are written down and defensible before a complaint ever arrives, the cure period is a backstop you may never need. If they are not, the demand is where the gaps become expensive.

One more point on the cure period, because it is easy to misread. It is real relief, and a documented cure keeps you out of the top penalty band. But it starts only after the state has already flagged you. The teams that come out of this well are the ones that treat January 1, 2026 as the date the risk went live and build their controls now, not the ones counting on 60 days to save them later.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how TRAIGA or any statute applies to your situation with qualified counsel licensed in the relevant jurisdiction.