Texas TRAIGA Complaint Portal Is Live: What AI Teams Do Now

Texas TRAIGA Complaint Portal Is Live: What Changes for AI Teams Now

For eight months, Texas had an AI law with teeth on paper and no way for anyone to actually pull the trigger. The Responsible AI Governance Act (TRAIGA, HB 149) took effect January 1, 2026, but the statute also gave the attorney general a separate deadline, September 1, 2026, to stand up a public complaint mechanism. That deadline has now passed. The portal is live.

TL;DR: The Texas Attorney General's statutory deadline to launch a public TRAIGA complaint mechanism was September 1, 2026, and the portal is now live under the Consumer AI Rights page. Texas residents (acting in an individual or household context) can now file complaints against any AI developer or deployer they believe violated the Responsible AI Governance Act. A complaint can trigger a civil investigative demand for your records, followed by written notice, a 60-day cure window, and penalties of $10K-$12K per curable violation up to $80K-$200K per uncurable one. Until now, TRAIGA had no live intake mechanism, so enforcement was theoretical. It no longer is.

This matters more than another compliance-deadline headline. TRAIGA has been enforceable since January, but enforcement needs a starting point, and for eight months that starting point did not exist. The AG's office spent that window building enforcement infrastructure rather than investigating anyone: standing up sandbox program rules through the Texas Department of Information Resources, staffing an enforcement team, and training state agency staff on AI disclosure obligations. No formal actions, no public civil investigative demands, no notices of violation. That was the calm part of the timeline. The portal opening is the part where it stops being calm.

What the portal actually is

The complaint mechanism lives on the Texas Attorney General's Consumer Protection division, under a Consumer AI Rights page. It is a plain-language overview of TRAIGA's prohibitions with a "file an AI complaint" route into the office's standard complaint intake.

The narrow "individual or household context" language matters for small teams building B2B or B2C products differently. A consumer who feels manipulated by your chatbot, discriminated against by your screening tool, or targeted by a deepfake of themselves can file directly. A business partner who thinks your vendor disclosures are inadequate, or an employee who thinks your internal AI use violates their rights, cannot use this specific channel, though the AG retains authority to open an investigation on its own initiative regardless of how a lead reaches the office.

What happens after a complaint is filed

A complaint landing in the portal is not a lawsuit and is not even automatically an investigation. Here is the actual sequence, as the statute lays it out:

1. Complaint intake. The complaint enters the AG's standard Consumer Protection queue alongside every other consumer complaint the office handles.
2. Discretionary civil investigative demand (CID). Under Section 552.103(a), the attorney general may issue a CID to determine whether a violation occurred. This is a records request, not a court filing, issued under the CID procedures in Chapter 15.10 of the Business and Commerce Code. It can ask for system documentation, risk assessments, internal policies, and communications relevant to the complaint.
3. Written notice of violation. If the AG concludes a violation likely occurred, it must issue written notice before it can sue.
4. 60-day cure window. From the date of written notice, you have 60 days to cure the violation, document what you fixed, and describe the policy changes that prevent recurrence. Cure a violation properly within that window and the AG cannot sue over it.
5. Penalty exposure if uncured, or for uncurable violations. Penalties run $10,000 to $12,000 per curable violation not cured, the same range for a false statement about how a violation was cured, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for a continuing violation. These figures come from Tex. Bus. & Comm. Code Section 552.105(a).

There is no private right of action anywhere in this chain. Every step runs through the attorney general's office. That concentration is exactly why the portal opening matters: before September 1, the AG's own complaint volume was effectively zero because there was no formal channel for consumers to reach it about AI specifically. Now there is one, and Texas is the eighth-largest economy in the world. A dormant law with a live intake page is a different risk posture than a dormant law with no intake page at all.

Why this is not the same story as the law taking effect

It is tempting to file this under "Texas AI law, already covered" and move on. Two things are genuinely new as of this week that were not true in January.

First, the enforcement funnel now has an entry point. A statute with an intent standard, a narrow set of prohibited uses, and no private right of action is, in practice, only as active as its complaint pipeline. For eight months, TRAIGA's pipeline had no public inlet. Complaints could only reach the AG through channels the office built itself, referrals, or whatever informal tips came in. A dedicated, publicized "file an AI complaint" page changes the volume math, because it is now something a frustrated customer can find by searching, not something they have to know to ask for.

Second, the AG's own public messaging changed with the launch. The Consumer AI Rights page frames TRAIGA in plain language for ordinary consumers, not just compliance professionals. That framing is itself a signal: the office built a page designed to be found and used, not a bureaucratic form buried three clicks deep. Offices that want low complaint volume do not optimize their intake pages for consumer discovery.

Neither of these changes what TRAIGA prohibits. The prohibited-use list (AI that intentionally aims to push people toward self-harm, harming others or crime; intentional unlawful discrimination; AI built with the sole intent to infringe constitutional rights; sexual deepfakes and child sexual abuse material) is unchanged, and the intent standard that limits liability to designed misuse rather than accidental harm is unchanged too. What changed is the odds that someone who believes you crossed one of those lines now has a fast, visible way to say so.

The complaint-response runbook

Most small AI teams have never had to respond to a state AG civil investigative demand. Waiting until one arrives to figure out the process costs you days you do not have inside a 60-day cure window. Build this now.

Step 1: Assign an owner before you need one. Name a single person, general counsel, a compliance lead, or the founder if you have neither, who is responsible for coordinating a response if a CID arrives. Not a committee. One person who knows the clock starts the day notice is received.

Step 2: Keep a standing AI system inventory. List every AI system you develop or deploy that touches Texas residents, what it does, and who owns it internally. A CID response starts with "which system is this even about," and that should take minutes, not a week of internal archaeology.

Step 3: Document your prohibited-use review, not just your outcome. If you have already reviewed your systems against TRAIGA's prohibited-use list, keep the review notes, not just the conclusion that you passed. "We are compliant" is not evidence. "Here is the review we ran on [date], here is what we checked, here is who signed off" is evidence, and it is what a cure statement needs to look like if you ever have to file one.

Step 4: If you want the internal-review defense, keep the review record current. Section 552.105(e) says a defendant can't be found liable for a violation it discovers through, among other routes, an internal review process while substantially complying with the most recent NIST Generative AI Profile or another recognized AI risk framework. That defense rewards findings: dated reviews, what they caught and what you changed. Citing the framework's name in a policy document isn't the same thing. If a complaint arrives, the strength of your defense is the record you already have, not what you can produce after the fact.

Step 5: Write a 60-day cure checklist now, before you are inside one. A basic version covers: stop the violating conduct immediately, document the fix with dates and responsible owners, update the internal policy that failed to prevent it, and draft the written statement to the AG describing all three. Teams with no governance documentation cannot move fast enough inside 60 days because they cannot show what changed from what baseline. Teams with a baseline can.

Step 6: Monitor for your own complaint exposure, not just your compliance status. The categories most likely to generate a consumer complaint are the ones a consumer can actually notice: a chatbot that manipulates rather than assists, a hiring or lending tool that produces a discriminatory outcome someone can point to, a deepfake of a real person. Internal documentation gaps rarely trigger complaints on their own, because consumers do not see your paperwork. They see outcomes. Prioritize review of the systems where a bad outcome is visible to the person it happens to.

What this does not change

Federal preemption has still not arrived. The Trump administration's December 2025 executive order directed work toward a federal AI framework that would preempt inconsistent state laws, but as of this writing no statute implementing that preemption has passed Congress. TRAIGA is in force, the Texas AG now has a working intake mechanism for it, and treating federal preemption as a live shield is premature.

TRAIGA also doesn't impose developer-to-deployer documentation packages, mandatory impact assessments or a general consumer notice duty on private companies. If a vendor tells you TRAIGA requires a formal impact assessment for every deployment, ask which section. The obligations that exist are narrower: stay clear of the prohibited uses, disclose AI use to patients if you provide health care (Section 552.051(f)), and keep the internal-review record if you want the Section 552.105(e) defense. The portal changes how those obligations get enforced. It does not add new ones.

Practical next steps

1. Confirm TRAIGA applies to you: any entity developing or deploying AI used by Texas residents, or doing business in Texas using AI, is in scope regardless of company size or headquarters location.
2. Run the prohibited-use review this week if you have not documented one, focusing on the outward-facing systems a consumer would actually notice.
3. Assign the CID response owner and write down the six-step runbook above somewhere your team can find it under pressure.
4. If you haven't set up an internal AI review mapped to NIST's Generative AI Profile (or another recognized framework), start now. The Section 552.105(e) defense only helps with violations your own review, testing or feedback channel finds.
5. Watch the AG's enforcement activity over the next two quarters. The portal opening does not guarantee an immediate wave of CIDs, but it removes the structural excuse for there being none.

Correction (October 20, 2026): Earlier versions said documented compliance with the NIST AI Risk Management Framework is an affirmative defense under TRAIGA. Section 552.105(e) names NIST's Generative AI Profile or another recognized framework, as part of an internal review through which the defendant discovers a violation (enrolled text). We also corrected the prohibited-use list (the constitutional-rights ban covers any person, and the deepfake ban covers sexual deep fakes), said health care providers do owe a patient disclosure, removed an unsourced reference to an earlier draft bill, and fixed two FAQ answers: the court, not the AG, decides whether a violation is curable, and the law doesn't say the AG can investigate without a portal complaint.

Related reading

• Texas TRAIGA Compliance Checklist 2026
• Texas TRAIGA Safe Harbor: What the NIST Defense Covers
• Texas TRAIGA Biometric AI Hiring Compliance
• US State AI Law Tracker: Which Laws Are in Force, Pending, or Repealed
• Multi-State AI Compliance Strategy 2026
• State AI Law Private Right of Action

References

1. Texas Legislature, Responsible Artificial Intelligence Governance Act (HB 149)
2. Texas Attorney General, Consumer AI Rights
3. Norton Rose Fulbright, The Texas Responsible AI Governance Act: What your company needs to know before January 1
4. DLA Piper, Texas adopts the Responsible AI Governance Act