Texas flipped the switch. On September 1, the Attorney General’s AI complaint portal went live under the Consumer Protection division — a “Consumer AI Rights” page with a plain-language overview of the law and a “File an AI Complaint” route. For eight months, TRAIGA (HB 149) has been a statute with duties, prohibitions, and penalties running to $200,000 per violation, but no visible way for anyone outside the AG’s office to set it in motion.
That changed on September 1. And this is not administrative housekeeping.
What the portal actually does
The complaint mechanism is not a convenience for consumers. Read alongside Section 552.103, it is the statutory precondition for the Attorney General’s investigative power. Complaints flow in from job applicants who believe an AI screener rejected them, tenants who think an algorithm denied their lease, customers who suspect an AI system denied them service, patients who were never told AI touched their care.
Each complaint is the on-ramp to an investigation — and an investigation means the AG demanding documentation: system purpose, training data, inputs, outputs, performance metrics, known limitations, post-deployment safeguards. TRAIGA applies to any business that develops, deploys, or substantially modifies an AI system used in Texas. If your sales team uses a chatbot, your HR team runs résumés through an AI screener, or your hospital’s EHR has AI features you never labeled, you are in scope.
The duties began in January. The machinery that turns a duty into a demand for your model documentation began in September.
The safe harbor nobody’s reading
Here’s the part that should make every Texas operator stop scrolling. Section 552.105(e) removes liability for a civil penalty action when the violation was discovered through one of the named channels:
- Adversarial or red-team testing of your own system
- Feedback channels and following state agency guidance
- Substantial compliance with the NIST Generative AI Profile — alongside a maintained internal review process
Read that list again. The statute tells you exactly what kind of proof works: you found the problem yourself through structured testing, or you can show framework-conformant governance with an internal review cadence behind it. A written AI policy alone won’t do it — the law requires substantial compliance with the framework’s structure plus a recurring review process, not a document.
This is the opposite of most compliance regimes, which tell you what’s prohibited and leave the proof to you. Texas wrote the answer key into the statute: test your systems adversarially, document it, align to NIST, and review it on a cadence. The safe harbor is a validation-evidence sale wearing a legal costume.
What to do before a complaint names you
The 60-day cure window starts after written notice — but only for the penalty, not the investigation itself, which is public, costly, and disruptive. Between now and then:
- Inventory every AI system touching your Texas operations — including the ones inside vendor products you never labeled as AI.
- Run adversarial testing on your highest-risk systems now. Whatever you find through your own red-team exercise is your safe-harbor path; whatever a complainant finds first is your exposure.
- Map to the NIST Generative AI Profile and stand up the internal review process — quarterly, documented, with evidence, not aspirations.
- Stress-test your vendors. Under Section 552.103, the AG can demand system documentation on short notice. Vendors that can’t produce it are your compliance gap.
Validated, not just documented
Texas didn’t just give its AG a complaint portal. It published the grading rubric: documented adversarial testing, NIST conformance, internal review. The companies that can produce that evidence on demand get the safe harbor. The ones with a policy PDF and good intentions get the investigation.
We run hands-on IQ/OQ/PQ validation on AI systems — adversarial testing, framework-mapped evidence packages, the kind of proof a TRAIGA inquiry is built to ask for. If you’re a Texas company running AI and you can’t produce that list today, let’s fix that before a complaint does.