Table of Contents
Ready to See Results?
From strategy through execution, Atlantic Health Strategies integrates compliance, operations, and growth into durable, measurable results. Let’s put our expertise to work for your organization.
The short answer, and why the clock started January 1
If you run a treatment center in Texas, license a digital intake tool, or contract with a vendor whose chatbot reaches a Texas resident, the Texas Attorney General can now investigate you under TRAIGA. The Act took effect January 1, 2026, and civil penalties run from $10,000 to $200,000 per violation with a 60-day cure period. That is the whole answer. The rest is documentation.
The statutory language on behavioral manipulation is unusually short. Section 552.052 prohibits a person from developing or deploying an AI system in a manner that intentionally aims to incite or encourage a person to commit physical self-harm, including suicide, harm another person, or engage in criminal activity. Norton Rose Fulbright’s team confirms that TRAIGA prohibits developing or deploying AI systems that manipulate behavior to incite self-harm, harm to others or criminal activity, and that the Act is broadly construed. The word “harm” is likely to be interpreted liberally. Norton Rose Fulbright’s analysts also note that TRAIGA’s prohibition on harm could be quite broad and apply to many different harmful outcomes, for example, monetary harm.
The reach is wider than most treatment center CEOs assume. TRAIGA applies to anyone who promotes, advertises or conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an AI system in Texas. Out-of-state operators whose tools reach Texas users are inside the statute. If your alumni app engages a former patient who moved to Austin, the statute reaches you.
The penalty math and who enforces it
The Texas Attorney General holds exclusive enforcement authority under Tex. Bus. & Comm. Code § 552.101, and there is no private right of action. The AG may also seek injunctive relief and recover attorney’s fees, court costs, or investigative expenses.
Licensed treatment operators face an extra layer. For a Texas treatment center, the Texas Health and Human Services Commission and the Texas Medical Board sit on the same enforcement pipeline as the AG. One structural point operators miss: TRAIGA does not require an AI system to have been built for a harmful purpose to be worth scrutinizing. Intent is the legal standard. Capability is the investigative trigger.
The Transparency Coalition observed of the statutory text that a developer or deployer would be in violation of the Act only if it can be shown that they intended the AI system to cause harm, which would be very hard to prove. Hard to prove cuts both ways. The AG still builds the record. And the AG will operate an online reporting mechanism to allow individuals to submit concerns about improper AI use. That portal is the practical deadline.
Why this hits behavioral health harder than other sectors
Conversational AI, symptom-triage chatbots, peer-support companions, and EHR-embedded clinical decision support all fit inside TRAIGA’s definition. TRAIGA defines an AI system as any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments. That captures the predictive risk-stratification tool your EHR vendor bolted on last quarter.
Federal regulators are already moving on the underlying harm pattern. On September 11, 2025, the FTC issued 6(b) orders to seven companies operating consumer-facing AI chatbots to examine how those firms measure, test, and monitor potentially negative impacts of the technology on children and teens. FTC Chairman Andrew Ferguson said, “Protecting kids online is a top priority for the Trump-Vance FTC”. The seven recipients were Alphabet, OpenAI, Character Technologies, Instagram, Meta Platforms, Snap, and X.AI.
The consumer-facing volume is not slowing. A Common Sense Media study using a nationally representative sample of 1,060 teens aged 13 to 17 found that 72 percent have used AI companions at least once, while 52 percent interact with such platforms a few times per month. Character.AI is being sued over a teen’s suicide in Florida and for promoting violence in Texas. Volume up. Scrutiny up. Civil discovery record being built right now.
For Texas-based residential programs, PHP (ASAM Level 2.5, an outpatient level of care), and IOP operators, the implication is direct. If your patient engagement platform sends automated check-ins, if your intake bot screens for suicidal ideation, if your alumni app uses an LLM to respond to cravings or crisis disclosures, then the Texas AG, HHSC, the Texas Medical Board, and CMS surveyors evaluating Conditions of Participation can all ask how you documented the safeguards. Joint Commission and CARF surveyors are pulling on the same thread during accreditation review.
What operators should do before the first enforcement action lands
TRAIGA gives compliance officers something they rarely get: a defensible path. Sheppard Mullin confirms that affirmative defenses are available for companies that self-detect and remedy issues through internal audits, employ third-party testing, or adhere to recognized standards such as the NIST AI Risk Management Framework. Operators who documented their framework alignment on January 1 are already inside the safe harbor. Everyone else is exposed.
What AHS recommends to behavioral health clients operating in Texas:
- Inventory every AI touchpoint. Intake, EHR modules, marketing chatbots, alumni apps, payer-facing utilization management automations. If it infers and generates, it counts. Sheppard Mullin’s practical guidance is to create a comprehensive list of AI tools used across human resources and business operations, including hiring algorithms, resume screeners, chatbots, scheduling tools, and performance metrics engines.
- Document intent for each system. Write the legitimate clinical or operational purpose. Write what the tool is not designed to do. Date it. File it.
- Map escalation pathways for self-harm language. Every conversational system should hand off to a human clinician on detection, and the handoff should be logged. Align the logic with SAMHSA’s 988 protocols where applicable.
- Update vendor MSAs. Add TRAIGA-specific representations, audit rights, and indemnification. Vendor assurance letters are not a defense.
- Align governance with the NIST AI RMF. That framework is the affirmative defense the statute names.
- Confirm healthcare disclosure compliance under Texas SB 1188 and layer that on top of HIPAA and 42 CFR Part 2 obligations enforced by HHS OCR and SAMHSA.
Compliance officers should have documentation defensible by the date the AG publishes the complaint portal, not by some later date the AG chooses to investigate. An online reporting mechanism will allow individuals to submit concerns about improper AI use.
The bigger picture for multi-state operators
Texas joined Colorado and Utah as one of the earliest states to enact comprehensive AI legislation. As the EM3 Law blog summarizes, TRAIGA makes Texas one of the first U.S. States (after Colorado and Utah) to adopt a broad AI governance statute, and it preempts local regulations so cities and counties cannot impose their own AI rules. Other states are watching.
Multi-state operators running facilities in Florida, Texas, and Tennessee cannot rely on one AI governance policy and assume it travels. CEOs and compliance officers should treat TRAIGA as a live enforcement regime, not a future risk. Pull the AI inventory this quarter. Get the documentation defensible before the AG’s complaint portal goes live.
The penalty math is too steep, and the reputational exposure for a behavioral health operator tied to an AI-induced harm allegation will outlast the fine by years, especially if CMS, the DEA, or a Joint Commission surveyor cross-references the finding during a separate review. AHS works with treatment center operators on AI governance reviews, vendor MSA updates, and NIST AI RMF alignment. If you run a facility in Texas and you have not inventoried your AI touchpoints, that is the first call to make this month.
Frequently asked questions
When did TRAIGA take effect and who does it apply to?
TRAIGA took effect January 1, 2026. Per Norton Rose Fulbright’s analysis of Tex. Bus. & Comm. Code § 551.002, it applies to anyone who promotes, advertises or conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an AI system in Texas. Out-of-state behavioral health operators whose AI tools reach Texas users are within scope.
What are the civil penalties under TRAIGA?
Per the National Law Review’s analysis of Tex. Bus. & Comm. Code § 552.105, civil penalties range from $10,000 to $200,000 per violation and the statute provides a 60-day cure period. The Texas AG holds exclusive enforcement authority under § 552.101 and may also seek injunctive relief plus attorney’s fees, court costs, and investigative expenses. There is no private right of action.
Does Section 552.052 apply to clinical chatbots and patient engagement tools used by treatment centers?
Yes, if the system could be interpreted as intentionally inciting or encouraging self-harm, harm to others, or criminal activity. TRAIGA’s AI system definition is broad enough to cover symptom-triage bots, peer-support companions, alumni engagement apps, and EHR-embedded clinical decision support. The FTC’s September 11, 2025 Section 6(b) orders to Alphabet, Character Technologies, Instagram, Meta, OpenAI, Snap, and X.AI have widened the underlying evidentiary record on chatbot harm to minors.
What is the safest compliance posture for a Texas behavioral health operator?
Per Sheppard Mullin’s analysis, substantial adherence to the NIST AI Risk Management Framework, combined with internal audits and third-party testing, serves as an affirmative defense against TRAIGA enforcement. Operators should inventory every AI touchpoint, document intent and design decisions for each system, log self-harm escalation pathways aligned with SAMHSA’s 988 protocols, update vendor MSAs with TRAIGA-specific representations and audit rights, and confirm healthcare AI-use disclosures on top of HIPAA and 42 CFR Part 2 obligations.
References
- Texas Legislature: HB 149 (TRAIGA) Bill Analysis, Sec. 552.052
- Norton Rose Fulbright: The Texas Responsible AI Governance Act
- National Law Review: Texas Joins the AI Regulation Wave
- Sheppard Mullin: Employer Takeaways from TRAIGA
- Latham & Watkins: Texas Signs Responsible AI Governance Act Into Law
- FTC Press Release: FTC Launches Inquiry into AI Chatbots Acting as Companions (Sept. 11, 2025)
- Common Sense Media: Nearly 3 in 4 Teens Have Used AI Companions
- Transparency Coalition: Analysis of TRAIGA
- EM3 Law: Texas Enacts Comprehensive AI Law
- Texas Bar Practice: TRAIGA Readiness