Texas's new AI statute does not require your AI receptionist to announce itself to callers — but the same bill amended Texas Business and Commerce Code § 503.001 to make a caller's voiceprint a biometric identifier your firm cannot capture for a commercial purpose without informing the caller and obtaining consent first, at a civil penalty of up to $25,000 for each violation, recoverable only by the Texas Attorney General (§ 503.001(a), (b), (d), as amended by HB 149, the Texas Responsible AI Governance Act, effective January 1, 2026, 89th Texas Legislature, Regular Session).
Most of the secondary coverage has this backwards. Correcting it is the entire point of this article.
TRAIGA's Disclosure Mandate Reaches Government Agencies and Healthcare Providers — Not Your Law Firm
Per the Texas Legislature's own bill analysis of C.S.H.B. 149, the AI-disclosure duty sits in new Government Code § 552.051 and binds governmental agencies ("before or at the time of the interaction") and healthcare providers ("not later than the date the service or treatment is first provided"). A Texas solo attorney is neither. Writing "TRAIGA makes you disclose your AI receptionist" is a false statement of law.
The prohibitions in TRAIGA that can reach a private deployer are intent-gated — developing or deploying AI with intent to incite self-harm or crime, with the sole intent to infringe constitutional rights, or with intent to unlawfully discriminate — and § 552.056(c) states plainly that disparate impact alone does not establish intent.
What § 503.001 Actually Says: $25,000 for Each Voiceprint Captured Without Consent
§ 503.001(a) enumerates "voiceprint" as a biometric identifier. § 503.001(b) bars capturing one for a commercial purpose unless you (1) inform the individual before capture and (2) receive consent to capture. § 503.001(d) sets the civil penalty at up to $25,000 for each violation. Per violation reads per caller. There is no private right of action — only the Attorney General enforces it.
Scope discipline matters here, because getting it wrong in either direction is expensive. The duty attaches to capture of a voiceprint, not to answering a phone and not to speech-to-text transcription. Not every AI receptionist captures a voiceprint. Whether your vendor creates a speaker-recognition embedding or only transcribes words is the dispositive technical question — and the answer decides whether § 503.001(b) is triggered at all.
The Trap: Train on Voices, Exempt. Identify Callers by Voice, $25,000 a Head.
HB 149 added § 503.001(e), exempting training, processing, or storage of biometric identifiers for developing, training, evaluating, or offering AI models — unless the system "is used or deployed for the purpose of uniquely identifying a specific individual." The exemption evaporates at exactly the feature firms most want: returning-caller voice recognition. A separate carve-out covers security, fraud, identity-theft, and harassment prevention. HB 149 also clarified that media being publicly available is not consent unless the individual made it public themselves.
Send Your Vendor This Question in Writing
One sentence, in email, before your next intake call: Does your system create, store, or compare a speaker-recognition voiceprint embedding of callers, or does it perform speech-to-text transcription only — and will you state that answer in our data processing agreement?
Ask Presently that question the same way you would ask any vendor, and keep the answer in the DPA rather than the sales deck. Presently Core runs $799/month, or $8,150/year billed annually plus $499 setup — the cost of the contract is not the risk; the undocumented answer is. Our compliance page covers what belongs in that agreement.
Three Layers Govern Your Intake Line — Only One Has a Per-Caller Price Tag
- Professional conduct. Texas Opinion 705 and Disciplinary Rules 1.05 and 5.03 govern you as an attorney — confidentiality and supervision, remedied by a DPA and attorney review of every intake summary.
- Business conduct. TRAIGA governs you as a business but imposes no disclosure duty — intent-gated prohibitions, exclusive AG enforcement with a required online complaint mechanism, and a mandatory notice plus 60-day cure period before enforcement (§ 552.104). Penalties under § 552.105(a): $10,000–$12,000 for curable violations not timely cured, $80,000–$200,000 for uncurable violations, and $2,000–$40,000 per day for continuing violations. No private right of action (§ 552.101(b)). It preempts city and county AI ordinances, and the DIR regulatory sandbox (§ 553.053, up to 36 months) is a vendor's tool, not a one-attorney firm's.
- Biometric capture. CUBI § 503.001 is the only layer with a per-caller number attached.
A separate noun, kept separate: Texas is one-party-consent, so call recording is governed by Penal Code § 16.02 — never let that bleed into the biometric analysis.
Texas vs. Colorado vs. the EU: Intent Survived, Impact Did Not
Do not cite Colorado SB 24-205 as live law. SB 25B-004 (signed August 28, 2025) pushed its effective date to June 30, 2026; a federal court paused enforcement on April 27, 2026; and SB 26-189 (signed May 14, 2026) replaced it with a narrower disclosure-and-transparency framework. Texas's intent-based standard is in force. Colorado's impact-based "algorithmic discrimination" model was enjoined and legislatively replaced before it ever operated. The EU AI Act retains risk-tiered classification with penalties up to €35 million or 7% of global turnover.
On enforcement appetite — as scale evidence, not solo exposure — the Texas Attorney General recovered $1.4 billion from Meta in 2024 and $1.375 billion from Google in 2025 under CUBI. No solo attorney faces anything remotely like that. But the statute the AG used is the same one that now names voiceprints.
FAQ
Does TRAIGA require me to tell callers they are talking to AI? No. The disclosure duty in Government Code § 552.051 applies to governmental agencies and healthcare providers. A private Texas law firm has no TRAIGA disclosure obligation.
Is a voiceprint a biometric identifier in Texas? Yes. Texas Business and Commerce Code § 503.001(a) expressly enumerates "voiceprint" as a biometric identifier.
What is the penalty for capturing one without consent? Up to $25,000 for each violation under § 503.001(d), recoverable only by the Texas Attorney General. There is no private right of action.
Does my AI receptionist capture a voiceprint? Only if it creates a speaker-recognition embedding. Transcription alone is not voiceprint capture. Get the answer from your vendor in writing.
Do I get a cure period? Under TRAIGA, yes — § 552.104 requires notice and a 60-day cure period. CUBI § 503.001 contains no equivalent cure right.