Texas TRAIGA Complaint Portal Is Live: What Changes for AI Teams Now
Photo: Unsplash, used under the Unsplash License.
The Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149) took effect January 1, 2026. Section 8 of the act gave the attorney general until September 1, 2026 to post an online mechanism through which consumers can submit complaints. That mechanism exists: the office's Consumer AI Rights page ends with a "File An AI Complaint" button, and the Internet Archive captured the page with that button on July 2, 2026, two months before the deadline.
TL;DR: Texas consumers can file TRAIGA complaints through the attorney general's Consumer AI Rights page, which was live by July 2026. A complaint lets the AG issue a civil investigative demand. If the AG finds a violation, it must give written notice and wait 60 days; a documented cure in that window blocks a lawsuit. Write your response runbook before a demand arrives.
We couldn't find an official launch date or any public TRAIGA enforcement action. The office's news releases aren't searchable by statute, so we can't rule out one we missed.
What the portal actually is
Screenshot: Office of the Texas Attorney General, Consumer AI Rights page. Captured October 31, 2026.
| Element | Detail |
|---|---|
| Statutory deadline | September 1, 2026 (HB 149, Section 8) |
| Statute section | Tex. Bus. & Com. Code Section 552.102 |
| Location | Consumer AI Rights page; the button opens the office's general consumer complaint portal |
| Who can file | Consumers: Texas residents acting only in an individual or household context |
| Who the definition leaves out | People acting in a commercial or employment context |
| What filing allows | A civil investigative demand under Section 552.103, at the AG's discretion |
The consumer definition matters. A customer who thinks your chatbot pushed them toward self-harm, or a resident targeted by a sexual deepfake, fits it. A business partner or an employee complaining about workplace AI doesn't. The act gives the attorney general exclusive enforcement authority and no private right of action, and the demand power in Section 552.103 is written around complaints received through this mechanism.
What happens after a complaint is filed
Photo: Unsplash, used under the Unsplash License.
The sequence, as the statute lays it out:
- Complaint. A consumer submits it through the online mechanism.
- Civil investigative demand (CID), optional. Under Section 552.103(a), the AG "may issue a civil investigative demand to determine if a violation has occurred," following the procedures in Section 15.10. Section 552.103(b) lists what it can ask for: a high-level description of the system's purpose, intended use and deployment context; the type of data used to train it; input and output categories; performance metrics; known limitations; post-deployment monitoring and user safeguards; and other documentation reasonably necessary for the investigation.
- Written notice. If the AG determines you violated the chapter, it must notify you in writing and identify the specific provisions.
- 60-day cure window. The AG can't sue before the 60th day after notice, or at all if within that window you cure the violation and send a written statement that you cured it, provided supporting documentation, and made the internal policy changes needed to prevent a repeat (Section 552.104).
- Penalties. For violations not cured, Section 552.105(a) sets $10,000 to $12,000 per violation the court finds curable (or per breach of a cure statement), $80,000 to $200,000 per violation found uncurable, and $2,000 to $40,000 per day for a continued violation.
Every step runs through the attorney general's office. That's why the intake page matters: it's the documented route by which a TRAIGA investigation starts.
The complaint-response runbook
The CID list in Section 552.103(b) is the best guide to what you should be able to produce on short notice. This runbook is our recommendation, built around that list and the cure statement in Section 552.104.
Step 1: Assign an owner. Name one person, counsel, a compliance lead or the founder, who coordinates the response if a CID or notice arrives and who tracks the 60-day clock from the date of notice.
Step 2: Keep a system inventory that answers the CID list. For every AI system used by Texas residents, keep the eight items Section 552.103(b) names: purpose and deployment context, training data type, input and output categories, metrics, known limitations, and monitoring and safeguards. If that sheet exists, the first week of a CID is assembly, not research.
Step 3: Record your prohibited-use review. Keep the review itself, not just the conclusion: the date, what you checked against Sections 552.052 to 552.057, and who signed off. A cure statement needs supporting documentation, and so does any defense.
On r/sysadmin, discussing AI rollouts at a HIPAA-covered company, u/Frothyleet described the habit this step depends on: "you warn the business, commit your warnings to paper, have whoever is your designated compliance officer acknowledge, and then enable whatever they tell you." The same paper trail is what you'd attach to a cure statement.
Step 4: If you want the internal-review defense, keep that record current. Section 552.105(e) says a defendant can't be found liable for a violation it discovers through, among other routes, an internal review process while substantially complying with the most recent NIST Generative AI Profile or another recognized AI risk framework. The defense turns on what your reviews found and what you changed, with dates. Naming the framework in a policy isn't the same thing.
Step 5: Draft a 60-day cure template now. It needs four parts that mirror Section 552.104(b)(2): stop the conduct, document the fix with dates and owners, change the internal policy that failed, and write the statement to the AG covering all three.
Step 6: Watch the outcomes a consumer can see. Consumers file about what they experience: a chatbot's replies, a deepfake, a decision that affected them. Put your review effort on the systems where a bad outcome reaches the person it happens to.
In this Shields Legal Group session, attorney Sasha Begovic covers TRAIGA and SB 2610 for Texas small and mid-sized businesses:
What this does not change
TRAIGA doesn't impose developer-to-deployer documentation packages, mandatory impact assessments or a general consumer notice duty on private companies. The obligations that apply to most businesses are narrower: stay clear of the prohibited uses, disclose AI use to patients if you provide health care services (Section 552.051(f)), and keep the internal-review record if you want the Section 552.105(e) defense. The act applies to anyone who promotes, advertises or conducts business in Texas, produces a product or service used by Texas residents, or develops or deploys an AI system in Texas (Section 551.002); there's no size threshold.
Federal preemption hasn't arrived. Executive Order 14365 (December 11, 2025) asked for "a legislative recommendation establishing a uniform Federal policy framework for AI that preempts State AI laws that conflict" with its policy. An executive order doesn't preempt a state statute on its own, and as of October 31, 2026 none of the public laws of the 119th Congress published on govinfo, through Public Law 119-136 (October 22, 2026), is an AI preemption law.
Our take
The portal doesn't change what TRAIGA prohibits; it's the documented front door for enforcement. The most useful thing a small team can do is keep the Section 552.103(b) answers on file for each system, plus the review record and a cure template. If a demand arrives, you'll be assembling documents you already have instead of reconstructing decisions inside a 60-day window.
Correction (October 31, 2026): Earlier versions said the portal opened September 1, 2026 and that for eight months Texas had no way for anyone to file. The statute set September 1 as a deadline, and the Consumer AI Rights page with its File An AI Complaint button was archived on July 2, 2026. We also removed unsourced statements that the attorney general spent that period standing up sandbox rules, staffing an enforcement team and training agency staff, a claim about Texas's economic rank, a description of the page's launch messaging, and a statement that the AG can open a TRAIGA investigation on its own initiative; the statute ties the demand power to complaints received through the mechanism.
Correction (October 20, 2026): Earlier versions said documented compliance with the NIST AI Risk Management Framework is an affirmative defense under TRAIGA. Section 552.105(e) names NIST's Generative AI Profile or another recognized framework, as part of an internal review through which the defendant discovers a violation (enrolled text). We also corrected the prohibited-use list (the constitutional-rights ban covers any person, and the deepfake ban covers sexual deep fakes), said health care providers do owe a patient disclosure, removed an unsourced reference to an earlier draft bill, and fixed two FAQ answers: the court, not the AG, decides whether a violation is curable, and the law doesn't say the AG can investigate without a portal complaint.
Related reading
- Texas TRAIGA Compliance Checklist 2026
- Texas TRAIGA Safe Harbor: What the NIST Defense Covers
- Texas TRAIGA Biometric AI Hiring Compliance
- US State AI Law Tracker: Which Laws Are in Force, Pending, or Repealed
- Multi-State AI Compliance Strategy 2026
- State AI Law Private Right of Action
References
- Texas Legislature, HB 149, enrolled text
- Office of the Texas Attorney General, Consumer AI Rights
- Internet Archive, Consumer AI Rights, capture of July 2, 2026
- Federal Register, Executive Order 14365
