Texas TRAIGA vs. Colorado's AI Act: Building One Compliance Program for Two Incompatible State AI Laws

The Texas Responsible Artificial Intelligence Governance Act took effect January 1, 2026, codified at Texas Business & Commerce Code Chapters 551 through 553. It applies broadly to any entity that promotes or advertises in Texas, produces a product or service used by Texas residents, or develops or deploys an AI system in the state, and its definition of AI covers recommendation algorithms and autonomous systems, not just generative AI. Government agencies must disclose AI use to a person before or during an interaction, and healthcare providers must disclose AI use connected to treatment. On discrimination specifically, TRAIGA Section 552.056(b) prohibits intentionally developing or deploying an AI system that unlawfully discriminates or infringes a constitutional or statutory right, and Section 552.056(c) is explicit that disparate impact alone does not establish that intent. TRAIGA also bans AI systems designed to manipulate someone into self-harm, harm to others, or criminal activity, and separately restricts government use of social scoring and biometric capture, with private companies exempted from that specific restriction. Enforcement runs exclusively through the Texas Attorney General, there is no private right of action, and the AG must issue a notice with a 60-day cure period before penalties attach. Penalties under Section 552.105(a) run $10,000 to $12,000 per curable violation not cured, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for violations that continue. A meaningful safe harbor exists too: Section 552.105(e)(2) protects a company that discovers a violation through its own testing, red-teaming, or internal review, and that substantially complies with a recognized framework such as the NIST AI Risk Management Framework's Generative AI Profile. Texas also runs a regulatory sandbox allowing up to 36 months of testing outside standard licensing requirements, subject to quarterly reporting.

Colorado passed the first comprehensive US state AI law, SB 24-205, in 2024, and most compliance content written since then, including much of what is still circulating online, describes that version: a duty of reasonable care to protect consumers from algorithmic discrimination, developer and deployer obligations to document intended use and known risks, mandatory periodic impact assessments for high-risk systems, and a rebuttable presumption of compliance for companies aligned with a recognized framework like NIST AI RMF or ISO 42001. That law never took effect. Its start date was first pushed from February 1, 2026 to June 30, 2026 through SB 25B-004, signed during an August 2025 special session after lawmakers could not agree on amendments. Before the later date arrived, a federal magistrate judge issued an order in April 2026 blocking Colorado from enforcing SB 24-205 after AI company xAI filed a constitutional challenge and the US Department of Justice intervened in support, and the parties agreed the AG would not enforce or investigate the law until well after a ruling on xAI's request for a preliminary injunction. Rather than fight that fully out, Colorado's legislature repealed SB 24-205 outright and replaced it with SB 26-189, signed May 14, 2026, now scheduled to take effect January 1, 2027. SB 26-189 is a materially narrower law: it drops the duty-of-care standard and mandatory impact assessments and replaces them with a notice-and-disclosure regime. Developers must give deployers documentation of a system's intended uses, training data categories, and limitations, and notify them of material updates. Deployers must notify consumers when AI is used in a consequential decision covering education, employment, lending, housing, healthcare, or insurance, and must provide a plain-language explanation within 30 days of an adverse outcome, plus a human review and correction process. Liability is allocated between developer and deployer by fault rather than joint and several, and the Attorney General enforces with a 60-day cure period that sunsets after three years. Even this replacement law is expected to face its own legal challenges from the same parties that blocked its predecessor, so treat January 1, 2027 as the current best information rather than a certainty.

Even after Colorado's overhaul, the two states still rest on genuinely different legal logic, just not quite the intent-versus-impact split that circulated when SB 24-205 was still expected to take effect as written. TRAIGA conditions liability on subjective intent: a company that can show it did not mean to build or deploy a discriminatory system has a real defense, and disparate impact statistics alone cannot substitute for proof of that intent. Colorado's current law, SB 26-189, does not ask about intent at all, in either direction. Its notice and disclosure duties are triggered by objective facts, whether a system falls into a listed consequential-decision category, whether an adverse outcome occurred, not by anyone's state of mind. A company that has built a complete TRAIGA defense file, red-team logs, a NIST AI RMF alignment memo, documented internal review, can still owe a Colorado consumer a notice or a 30-day explanation it has never built a workflow to produce, because that duty does not care whether the company intended harm. The reverse is also true. A company that has built out Colorado's consumer notices and human-review workflow has not thereby proven anything about intent, and disclosure records without genuine underlying bias testing can even work against a TRAIGA defense by showing the company knew a system produced adverse outcomes and did not meaningfully investigate why. It is also worth remembering that the older, stricter duty-of-care model Colorado originally enacted has not disappeared as a legislative template just because Colorado itself walked it back under court pressure. Other states drafting AI legislation may still land closer to that original design, so understanding it remains relevant even though it is not currently in force in Colorado.

A program built narrowly around TRAIGA's intent defense, red-team documentation, a framework-alignment memo, records of internal review, does a genuinely good job of proving the company did not mean to discriminate. It produces none of what Colorado's SB 26-189 actually requires: no consumer-facing notice when AI is used in a covered consequential decision, no 30-day plain-language explanation after an adverse outcome, no developer-to-deployer technical documentation hand-off, and no human review or correction channel a Colorado consumer can actually use. Those are freestanding disclosure obligations under Colorado's law, and having a strong no-intent case under TRAIGA does not satisfy any of them. Run the comparison the other direction and a program built purely around Colorado-style disclosure, consumer notices, plain-language adverse-outcome explanations, a human-review workflow, produces exactly the kind of paper trail that documents a system's outcomes without necessarily documenting why they happened or what was done about it. Without genuine bias testing and a record of remediation behind those disclosures, that paper trail can cut the wrong way under TRAIGA, since it can show a company was aware of adverse outcomes for a protected group without showing it investigated whether those outcomes were the product of intentional design choices. Neither program builds the evidentiary record the other regime's theory of liability actually needs, absence of intent on one side, completeness of disclosure and process on the other, so a security or compliance team has to build both categories of control deliberately, not inherit one by accident from whichever regulator's guidance it read first.

The practical path is a small set of controls that were never actually specific to one state's legal theory in the first place.

Two states rewrote, delayed, or had their flagship AI law blocked by a federal court within about eighteen months of signing it. That is a strong signal that state AI regulation is still being actively contested, not settled, and more states are working through their own AI bills right now with their own liability theories, some closer to TRAIGA's intent standard, some closer to the duty-of-care model Colorado itself walked away from under legal pressure, and some combination not yet drafted. The durable response is not to chase whichever state's law reads as final this month. It is to build the underlying controls, an inventory, documented impact testing, disclosure and notice capability, human review, that would satisfy the strictest plausible version of a state AI law, so that whichever theory a new state adopts, or whichever way an existing state's law gets rewritten next, the program already produces most of what is needed. Teams that are also managing EU AI Act obligations alongside this US state-law patchwork will recognize the same overlap: the EU AI Act compliance platform comparison covers tools built around Annex III high-risk classification and conformity documentation, and an AI-system inventory, a documented impact assessment, and a disclosure trail built once for that regulation is largely reusable for Texas and Colorado's obligations too. Building the control once and mapping it to every applicable regime is cheaper than rebuilding it every time a state legislature changes its mind.