The Texas Responsible AI Governance Act took effect 1 January 2026. Many smaller businesses fall under its small-business exemption, but the law matters anyway: it grants a safe harbor to organizations that document AI risk management against the NIST AI framework.
Two things are true at once. First, if your company qualifies as a small business under SBA definitions, most of TRAIGA's direct obligations likely do not apply to you. Second, that exemption does not travel: your larger customers, your insurer, and the enterprises you sell to are covered, and their obligations arrive at your door as contract clauses and security questionnaires.
The law's safe harbor is unusual. Most regulation tells you afterwards what you did wrong. This one says in advance: document how you manage AI risk against the NIST AI Risk Management Framework, and that documentation protects you. It is a finite piece of work with a defined finish line, and it doubles as the answer to the AI questions now appearing in enterprise procurement.
We produce that documentation as part of every assessment we run for a company doing business in Texas.
Legal analysis: Norton Rose Fulbright on TRAIGA.