Texas's new AI statute does not require your AI receptionist to announce itself to callers — but the same bill amended Texas Business and Commerce Code § 503.001 to make a caller's voiceprint a biometric identifier your firm cannot capture for a commercial purpose without informing the caller and obtaining consent first, at a civil penalty of up to $25,000 for each violation, recoverable only by the Texas Attorney General (§ 503.001(a), (b), (d), as amended by HB 149, the Texas Responsible AI Governance Act, effective January 1, 2026, 89th Texas Legislature, Regular Session).
Most of the secondary coverage has this backwards. Correcting it is the entire point of this article.
TRAIGA's Disclosure Mandate Reaches Government Agencies and Healthcare Providers — Not Your Law Firm
TRAIGA is codified at Texas Business and Commerce Code Chapters 551–554 — Chapter 552 is titled "Artificial Intelligence Protection." (Note the code: Texas Government Code Chapter 552 is the Public Information Act, an unrelated open-records statute, and miscitation between the two is common.) The AI-disclosure duty sits in Business and Commerce Code § 552.051, "Disclosure to Consumers," which provides that "a governmental agency that makes available an artificial intelligence system intended to interact with consumers shall disclose to each consumer, before or at the time of interaction, that the consumer is interacting with an artificial intelligence system." Health care providers must disclose no later than the date the service or treatment is first provided. A Texas solo attorney is neither a governmental agency nor a health care provider. Writing "TRAIGA makes you disclose your AI receptionist" is a false statement of law.
The prohibitions in TRAIGA that can reach a private deployer are intent-gated — developing or deploying AI with intent to incite self-harm or crime, with the sole intent to infringe constitutional rights, or with intent to unlawfully discriminate — and § 552.056(c) states plainly that disparate impact alone does not establish intent.
What § 503.001 Actually Says: $25,000 for Each Voiceprint Captured Without Consent
§ 503.001(a) enumerates "voiceprint" as a biometric identifier. § 503.001(b) bars capturing one for a commercial purpose unless you (1) inform the individual before capture and (2) receive consent to capture. § 503.001(d) provides that a violator "is subject to a civil penalty of not more than $25,000 for each violation" and that "the attorney general may bring an action to recover" it. Per violation reads per caller. There is no private right of action — only the Attorney General enforces it.
Scope discipline matters here, because getting it wrong in either direction is expensive. The duty attaches to capture of a voiceprint, not to answering a phone and not to speech-to-text transcription. Not every AI receptionist captures a voiceprint. Whether your vendor creates a speaker-recognition embedding or only transcribes words is the dispositive technical question — and the answer decides whether § 503.001(b) is triggered at all.
The Trap: Train on Voices, Exempt. Identify Callers by Voice, $25,000 a Head.
HB 149 added § 503.001(e), exempting training, processing, or storage of biometric identifiers for developing, training, evaluating, or offering AI models — unless the system "is used or deployed for the purpose of uniquely identifying a specific individual." The exemption evaporates at exactly the feature firms most want: returning-caller voice recognition. A separate carve-out covers security, fraud, identity-theft, and harassment prevention. HB 149 also clarified that media being publicly available is not consent unless the individual made it public themselves.
Send Your Vendor This Question in Writing
One sentence, in email, before your next intake call: Does your system create, store, or compare a speaker-recognition voiceprint embedding of callers, or does it perform speech-to-text transcription only — and will you state that answer in our data processing agreement?
Ask Presently that question the same way you would ask any vendor, and keep the answer in the DPA rather than the sales deck. Presently Core runs $799/month, or $8,150/year billed annually plus $499 setup — the cost of the contract is not the risk; the undocumented answer is. Our compliance page covers what belongs in that agreement.
Three Layers Govern Your Intake Line — Only One Has a Per-Caller Price Tag
- Professional conduct. Texas Opinion 705 and Disciplinary Rules 1.05 and 5.03 govern you as an attorney — confidentiality and supervision, remedied by a DPA and attorney review of every intake summary.
- Business conduct. TRAIGA governs you as a business but imposes no disclosure duty — intent-gated prohibitions, exclusive AG enforcement with a required online complaint mechanism, and a mandatory notice plus 60-day cure period before enforcement (§ 552.104). Penalties under § 552.105(a): $10,000–$12,000 for curable violations not timely cured, $80,000–$200,000 for uncurable violations, and $2,000–$40,000 per day for continuing violations. No private right of action — § 552.101 states the chapter "does not provide a basis for, and is not subject to, a private right of action." It preempts city and county AI ordinances, and the Department of Information Resources regulatory sandbox (§ 553.053(a), testing "for a period of not more than 36 months") is a vendor's tool, not a one-attorney firm's.
- Biometric capture. CUBI § 503.001 is the only layer with a per-caller number attached.
A separate noun, kept separate: Texas is one-party-consent, so call recording is governed by Penal Code § 16.02 — never let that bleed into the biometric analysis.
Texas vs. Colorado vs. the EU: Intent Survived, Impact Did Not
Do not cite Colorado SB 24-205 as live law. SB 25B-004, signed in August 2025, pushed enforcement from February 1 to June 30, 2026. On April 27, 2026 a federal magistrate judge in the District of Colorado blocked enforcement of SB 24-205 after xAI challenged it on constitutional grounds, with the U.S. Department of Justice intervening in support. The General Assembly then passed SB 26-189 in May 2026, repealing and reenacting the AI Act with narrower obligations — shifting from "high-risk artificial intelligence systems" to "automated decision-making technology" that "materially influences" a "consequential decision." That replacement does not take effect until January 1, 2027, and applies only to decisions made on or after that date.
So the contrast is sharper than "Texas versus Colorado." Texas's intent-based standard is in force today. Colorado's impact-based "algorithmic discrimination" model was enjoined and legislatively replaced before it ever operated, and its successor is still more than a year out. The EU AI Act, meanwhile, retains risk-tiered classification: under Article 99, prohibited-practice violations draw administrative fines of up to €35 million or 7% of total worldwide annual turnover, whichever is higher.
On enforcement appetite — as scale evidence, not solo exposure — a Texas court finalized a $1.4 billion CUBI settlement with Meta on July 30, 2024 over facial-recognition tagging, the largest settlement ever obtained from an action brought by a single state. Texas then finalized a $1.375 billion settlement with Google on October 31, 2025, resolving two 2022 suits covering geolocation, incognito browsing, and biometrics.
The biometric half of the Google matter is the one to read closely: it alleged capture of biometric identifiers including voiceprints through Google Assistant and Nest Hub Max. That is not an analogy to a phone system — it is a phone-adjacent voice product, and CUBI is the statute Texas used. No solo attorney faces billion-dollar exposure. But the theory has been run, at scale, on voiceprints specifically.
FAQ
Does TRAIGA require me to tell callers they are talking to AI? No. The disclosure duty in Business and Commerce Code § 552.051 applies to governmental agencies and health care providers — note that it is the Business and Commerce Code, not the Government Code, whose Chapter 552 is the unrelated Public Information Act. A private Texas law firm has no TRAIGA disclosure obligation.
Is a voiceprint a biometric identifier in Texas? Yes. Texas Business and Commerce Code § 503.001(a) expressly enumerates "voiceprint" as a biometric identifier.
What is the penalty for capturing one without consent? Up to $25,000 for each violation under § 503.001(d), recoverable only by the Texas Attorney General. There is no private right of action.
Does my AI receptionist capture a voiceprint? Only if it creates a speaker-recognition embedding. Transcription alone is not voiceprint capture. Get the answer from your vendor in writing.
Do I get a cure period? Under TRAIGA, yes — § 552.104 requires notice and a 60-day cure period. CUBI § 503.001 contains no equivalent cure right.