JD Key Consulting Logo
HB149

Regular Session

Relating to regulation of the use of artificial intelligence systems in this state; providing civil penalties.

Critical
High Cost
Effective:2025-06-22
Enforcing Agencies

Department of Information Resources (Sandbox Program & AI Council oversight) • Office of the Attorney General (Exclusive authority for Chapter 552) • State Licensing Agencies (e.g., Medical Board, Dept of Licensing and Regulation) for professional sanctions • Texas Artificial Intelligence Council (Advisory & Sandbox consultation)

HB149
Relating to regulation of the use of artificial intelligence systems in this state; providing civil penalties.
Critical Urgency
Passed with Opposition
House Vote146 - 3
YEA
98% in favor149 voting
Senate Vote31 - 0
YEA
100% in favor31 voting
3
Total Opposition Votes
Cost Impact
High
Effective
2025-06-22
Enforcing Agencies
Department of Information ResourcesOffice of the Attorney GeneralState Licensing AgenciesTexas Artificial Intelligence Co...
Primary Author: Rep. Giovanni Capriglione
89th Texas Legislature
jdkey.com
01

Compliance Analysis

Key implementation requirements and action items for compliance with this legislation

Implementation Timeline

  • Effective Date: January 1, 2026
  • Compliance Deadline: January 1, 2026. All consumer disclosures (chatbots/medical) and internal documentation protocols must be active on this date.
  • Agency Rulemaking:
  • September 1, 2026: The Attorney General will launch the online consumer complaint portal. Expect an immediate surge in Civil Investigative Demands (CIDs) following this launch.
  • TBD (Immediate): The Department of Information Resources (DIR) will promulgate rules and application forms for the "Regulatory Sandbox" program.

Immediate Action Plan

  • 1. Map Your Stack: Conduct an immediate inventory of all software that makes automated decisions or generates content.
  • 2. Adopt NIST RMF: Formally adopt the NIST AI Risk Management Framework as corporate policy to trigger the liability affirmative defense.
  • 3. Implement Disclosures: Program all chatbots and automated customer service tools to display a clear AI disclosure *before* the consumer interacts.
  • 4. Scrub Biometrics: Verify no current systems are training on non-consensual biometric data scraped from the internet.
  • 5. Renegotiate MSAs: Send contract addendums to all AI vendors requiring data lineage disclosure and indemnification.

Operational Changes Required

Contracts

You must immediately audit and amend Master Services Agreements (MSAs) with software vendors.

  • Indemnification: Shift liability. Require vendors to indemnify your company for violations of HB149 caused by the software's architecture.
  • Data Transparency: Mandate that vendors provide the "data lineage" and "training data descriptions" required by Sec. 552.103. If a vendor refuses to disclose how their AI works, you cannot legally deploy it under Texas law.
  • Processor Duties: Cite the amendments to the Business & Commerce Code to compel data processors to assist in your security compliance assessments.

Hiring/Training

  • AI Governance Lead: Designate a specific officer responsible for maintaining the "System Inventory" and "Performance Metrics."
  • Staff Training: Employees using AI (HR recruiters, customer service managers) must be trained on the new disclosure mandates.
  • Prohibited Actions: Strictly forbid marketing and security teams from using tools that scrape biometric data (facial recognition) from social media or open web sources without explicit consent.

Reporting & Record-Keeping

To utilize the "Right to Cure" (avoiding penalties), you must be able to produce the following upon AG demand:

  • System Inventory: A catalog of every AI tool in use, its purpose, and intended benefits.
  • Data Lineage: Documentation of the data categories used to train the system.
  • Performance Metrics: Written records of how you test the system for accuracy and bias.
  • Post-Deployment Monitoring: Proof of human oversight.

Fees & Costs

  • Civil Penalties:
  • Curable: $10,000 - $12,000 per violation.
  • Uncurable: $80,000 - $200,000 per violation.
  • Continuing: Up to $40,000 per day.
  • Budget Impact: The Legislature has appropriated over $4 million annually for the AG to hire expert witnesses and machine learning engineers. They are funded to litigate; budget for increased legal defense and Tech E&O insurance premiums.

Strategic Ambiguities & Considerations

  • "Intent" to Discriminate: The law states disparate impact alone proves no intent, but internal communications can. If your internal testing shows bias and you deploy anyway, the AG may treat this as "intentional" discrimination, triggering maximum penalties.
  • Definition of "AI System": The definition ("infers from inputs") is broad. While simple spreadsheets are likely excluded, "Automated Decision Making" (ADM) tools in loan origination, insurance underwriting, or resume filtering are definitely included. When in doubt, treat it as AI.
  • NIST Safe Harbor: The law provides an affirmative defense if you comply with the NIST AI Risk Management Framework. However, "substantial compliance" is undefined. You must document adherence to NIST standards meticulously to claim this shield.

Need Help Understanding Implementation?

Our government affairs experts can walk you through this bill's specific impact on your operations.

Schedule Consultation

Information presented is for general knowledge only and is provided without warranty, express or implied. Consult qualified government affairs professionals and legal counsel before making compliance decisions.

02

Legislative Timeline

This bill's path through the Texas Legislature

Filed
Mar 14, 2025
Passed House
Apr 23, 2025
Passed Senate
May 23, 2025
Signed
Jun 22, 2025
TopicsArtificial IntelligenceBusiness & CommerceBusiness & Commerce--trade PracticesConsumer ProtectionElectronic Information SystemsGovernorHuman RelationsState Agencies, Boards & CommissionsState Agencies, Boards & Commissions--newly ProposedTexas Responsible Artificial Intelligence Governance ActBiometric Identifiers & VoiceprintsComputers & SoftwareDiscriminationInternetLieutenant GovernorSpeaker of the HouseStaff Development & TrainingArtificial Intelligence Council, TexasAttorney GeneralInformation Resources, Department ofHealth Care ProvidersProtection of Personal Information
03

House Authors

Rep. Giovanni CapriglioneRepublican · Primary Author
Joint Authors
Coauthors (5)

Senate Sponsors

Sen. Charles SchwertnerRepublican · Primary Sponsor
Cosponsors (1)

Bill Text(with markup)

Showing first 50k characters.

View bill text in multiple formats on Texas Legislature website

Fiscal NoteView Original

Related Legislation

Explore more bills from this author and on related topics

More from Rep. Giovanni Capriglione

View all bills by Rep. Giovanni Capriglione

Related by Topic

View more Artificial Intelligence legislation
Quick Reference

Frequently Asked Questions

Common questions about HB149

Q

What does Texas HB149 do?

HB149 fundamentally shifts liability from software vendors to Texas businesses ("Deployers") using AI for hiring, healthcare, finance, and customer service. Effective January 1, 2026, the law mandates strict disclosure protocols, bans non-consensual biometric scraping, and empowers the Attorney General to levy civil penalties of up to $200,000 per violation against companies that fail to maintain specific documentation and oversight. Implementation Timeline Effective Date: January 1, 2026 Compliance Deadline: January 1, 2026.

Q

Who authored HB149?

HB149 was authored by Texas Representative Giovanni Capriglione during the Regular Session.

Q

When was HB149 signed into law?

HB149 was signed into law by Governor Greg Abbott on June 22, 2025.

Q

Which agencies enforce HB149?

HB149 is enforced by Department of Information Resources (Sandbox Program & AI Council oversight), Office of the Attorney General (Exclusive authority for Chapter 552), State Licensing Agencies (e.g., Medical Board, Dept of Licensing and Regulation) for professional sanctions and Texas Artificial Intelligence Council (Advisory & Sandbox consultation).

Q

How urgent is compliance with HB149?

The compliance urgency for HB149 is rated as "critical". Businesses and organizations should review the requirements and timeline to ensure timely compliance.

Q

What is the cost impact of HB149?

The cost impact of HB149 is estimated as "high". This may vary based on industry and implementation requirements.

Q

What topics does HB149 address?

HB149 addresses topics including artificial intelligence, business & commerce, business & commerce--trade practices, consumer protection and electronic information systems.

Legislative data provided by LegiScanLast updated: November 25, 2025

Need Strategic Guidance on This Bill?

Need help with Government Relations, Lobbying, or compliance? JD Key Consulting has the expertise you're looking for.