Texas's AI Law Changed What Your AI Vendors Owe You. TRAIGA's TDPSA Amendments Have Been in Effect Since January.

If your compliance team has been watching federal AI regulation, you may have missed what Texas did. The Texas Responsible AI Governance Act — TRAIGA — took effect January 1, 2026. It is already in effect. The clock on compliance was not a future deadline. It ran out nine months ago.

For most financial services companies, the immediate response to TRAIGA news was to check the exemption: We’re a federally insured financial institution. The GLBA exemption covers us. That response is partially correct and meaningfully incomplete.

The GLBA exemption under TRAIGA covers one thing: the non-discrimination rules. For everything the TRAIGA-amended TDPSA requires from processors — the entities handling personal data through AI systems — the exemption does not apply. Your AI vendors, and the data you hand them, may be inside the statute’s scope whether or not the discrimination carve-out protects your core financial activities.

TL;DR

• Texas Responsible AI Governance Act (TRAIGA, HB 149) took effect January 1, 2026, amending the TDPSA to impose AI processor obligations.
• Federally insured financial institutions get a carve-out from TRAIGA’s non-discrimination rules — not from the TDPSA processor amendment.
• AI vendors processing Texas residents’ personal data outside GLBA’s scope need new contract provisions; this is a vendor management problem, not just a legal one.
• The Texas AG is enforcing — Allstate and Arity were sued under the TDPSA, and Texas is part of an eight-state AG enforcement consortium that shares investigative intelligence.

What TRAIGA Actually Is

Texas had the TDPSA before TRAIGA. What the TDPSA lacked was explicit treatment of AI systems as a distinct processing context. TRAIGA changed that.

The core structure of TRAIGA breaks into two pieces:

The non-discrimination provision. TRAIGA prohibits AI systems from producing discriminatory outputs based on protected characteristics. This is where the financial institution carve-out lives: federally insured banks and credit unions are deemed compliant with this provision if they comply with applicable federal and state banking laws and regulations — a category that includes fair lending, ECOA, and federal banking AI guidance.

The TDPSA processor amendment. This is the provision that doesn’t come with the carve-out. TRAIGA amended the TDPSA to require processors — entities handling personal information on behalf of a controller — to assist the controller in protecting personal data that is processed through an AI system. Processors must support the controller’s compliance with applicable data protection requirements for AI-processed data on request.

The practical effect: your AI vendor, operating as a processor, now has obligations under Texas law. Those obligations belong to both you (as the controller, to ensure your vendor meets them) and your vendor (as the processor, to actually meet them).

The GLBA Exemption Map for Texas

Before deciding that TRAIGA and the TDPSA don’t apply to your institution, run the actual GLBA exemption analysis. The TDPSA exemption, like California’s CCPA exemption, is a data-level exemption — not an entity-level exemption.

Data that is subject to GLBA — collected in connection with providing financial products and services, and protected under Regulation P as nonpublic personal information — is exempt from the TDPSA. That covers a significant chunk of what a bank or fintech does.

What it doesn’t cover:

Employee and applicant data. HR records, onboarding data, applicant assessment data — none of this is GLBA NPI. If your bank uses an AI system for employee scheduling, hiring assessment, or workforce analytics that processes Texas residents’ data, the TDPSA applies.

Website behavioral data. Analytics, session recording, advertising targeting data collected on your website falls outside GLBA’s NPI definition in most cases. If you deploy AI tools for website personalization or digital marketing against Texas visitors, that data may be in scope.

Customer data outside the financial relationship. Data collected about customers that is not part of providing a financial product or service — social media, loyalty program activity, survey responses — may not qualify for the GLBA exemption.

Marketing and prospecting data. Data about prospects who are not yet customers, collected for marketing purposes, is not protected by GLBA’s NPI rules.

For most banks and virtually all fintechs, the honest answer to “does TRAIGA apply to us?” is: some of our AI-processed data is inside GLBA’s scope and exempt, and some isn’t. The question is whether your AI vendor contracts address the non-exempt portion.

What the Processor Amendment Requires From Your Vendors

TRAIGA’s TDPSA amendment requires processors to help controllers protect personal information processed by AI systems. The specific obligation is to support the controller’s compliance on request.

In practical terms, this means your AI vendor agreements need to be updated. Vendor contracts that predate TRAIGA — contracts entered in 2024 or before — almost certainly do not include language addressing AI processor obligations under the TDPSA.

What the updated contract language should cover:

AI system identification. The contract should identify which AI systems the vendor operates that process Texas residents’ personal data on your behalf. Vendors who deploy AI broadly may not have designed their agreements to describe AI processing specifically.

Processor assistance obligations. The vendor must agree to assist you in protecting the personal data processed through the AI system, and to support your compliance with applicable requirements on request. This is the core TRAIGA processor obligation translated into contract language.

Data classification. Which personal data processed by the AI system is GLBA-covered, and which isn’t? Both you and your vendor need to understand the boundary so you can assess where the TDPSA applies.

Consumer rights support. If the non-GLBA data includes data subject to TDPSA consumer rights (access, deletion, correction), the vendor needs to support you in honoring those requests.

Incident notification. For AI processing incidents that could affect Texas residents’ data, what notification does the vendor provide you, and on what timeline?

This is vendor management work. If you work in third-party risk management at a financial institution and haven’t reviewed AI vendor contracts for TRAIGA compliance, that review is now overdue.

The Texas Enforcement Reality

The TDPSA is not theoretical risk. The Texas Attorney General sued Allstate and its subsidiary Arity over the collection and sale of geolocation and driving data — alleging collection without adequate notice or opt-out in violation of the TDPSA and the Texas Insurance Code. The AG didn’t wait for a consumer complaint. The AG investigated.

Texas is also a founding member of the AG Privacy Enforcement Consortium: California, Colorado, Connecticut, Delaware, Indiana, New Jersey, and Oregon are members alongside Texas. Evidence gathered in a California investigation can inform a Texas AG action. A California CPPA examination of your AI vendor can surface material that becomes relevant to a Texas enforcement inquiry.

Secondary sources report that TDPSA enforcement has already affected over 100 companies across industries — that figure should be treated carefully since it comes from vendor blogs, not the AG’s office, but the Allstate/Arity action is public and establishes the AG’s enforcement posture.

Penalties under the TDPSA: $7,500 per violation. There’s a 30-day cure period, but it’s a cure window after notice, not a guarantee that enforcement won’t follow. The cure period didn’t stop the Allstate suit once the AG determined a cure wasn’t forthcoming.

The Interaction With Federal Regulatory Expectations

Financial institutions subject to OCC, FDIC, or Federal Reserve supervision face separate expectations around AI governance that layer on top of TRAIGA. SR 26-2, the CFPB’s fair lending AI guidance, and OCC examination expectations for model risk management each create federal-level obligations that interact with — but don’t preempt — Texas law.

The TRAIGA non-discrimination carve-out for financial institutions deems them compliant with TRAIGA’s discrimination provision if they comply with applicable banking laws and regulations. That carve-out does two things: it reduces the redundancy between federal fair lending compliance and TRAIGA’s non-discrimination rule, and it makes clear that a bank that isn’t complying with federal fair lending requirements can’t claim the TRAIGA carve-out.

If your fair lending compliance program has gaps in AI decisioning oversight, TRAIGA is another reason to close them — not the only one, but an additional one.

What a $100M Fintech With Texas Customers Should Do Right Now

Most fintechs serving Texas customers are not $100 billion banks with dedicated legal and compliance teams for each state AI regulation. Here is a scaled, practical approach:

Step 1: Data inventory for Texas AI processing. Identify every AI system your company uses that processes personal data of Texas residents. Document which data is GLBA-covered and which isn’t.

Step 2: Vendor contract audit. For each AI vendor handling non-GLBA personal data of Texas residents, check whether the contract includes language addressing processor obligations under Texas law. Note: most contracts signed before January 2026 won’t have this language.

Step 3: Contract update prioritization. Prioritize vendors based on data sensitivity and volume. AI systems used for credit decisioning, fraud detection, customer service, and marketing analytics that process Texas consumer data are the highest-priority contracts to update.

Step 4: Consumer rights infrastructure check. For non-GLBA personal data processed by AI systems, do you have a mechanism to honor TDPSA consumer access, deletion, and correction requests? If a Texas resident asks what AI-based decisions you made about them using non-GLBA data, can you answer?

Step 5: Internal accountability. TRAIGA and the TDPSA require documented policies and procedures for AI data processing. Even without a formal risk assessment mandate under Texas law (unlike California’s CPPA), having documented governance around your AI processing shows regulators that your program is deliberate.

The Data Privacy Compliance Kit at RiskTemplate covers GLBA exemption mapping across 23 state privacy laws, data inventory structure, and vendor contract requirements — a practical starting point for fintechs trying to build one compliance framework that addresses the multi-state patchwork.

So What?

Nine months have passed since TRAIGA took effect. Most financial institutions completed a quick GLBA exemption check and moved on. The ones that need to take another look are those using AI vendors whose systems process Texas consumer data that falls outside GLBA’s data-level exemption — and that’s a broader population than the exemption check suggests.

The TDPSA processor amendment is a vendor management problem as much as a legal one. The contracts need to change, and the vendor oversight function needs to include TRAIGA compliance. If your TPRM team hasn’t reviewed AI vendor agreements since January 2026, that’s the gap.

Related reading:

• Montana and Connecticut Just Narrowed the GLBA Exemption
• State Privacy Law Enforcement in 2026: Texas, California, and the AG Consortium
• AI Governance Exception Process: How to Handle Use Case Testing and Gaps

Sources:

• Texas Enacts Responsible AI Governance Act — Alston Privacy
• Texas Responsible AI Governance Act Enacted — Wiley Law
• The Texas Responsible AI Governance Act: What Your Company Needs to Know — Norton Rose Fulbright
• Texas Data Privacy Enforcement: AG Penalties and Compliance Guide — TDPSA.org
• Privacy Legislation in Texas: What Happened in 2025 and What’s Next — Holland & Knight