State AI Decision-Making Laws: Compliance Guide for Texas Businesses

Colorado just rewrote its AI law, and the new version carries real obligations for businesses that use AI in customer-facing decisions. Texas and Florida already enforce their own AI disclosure requirements. If your business uses AI for hiring, customer service, insurance quoting, or marketing content, you likely have compliance obligations in at least one of these states, regardless of where your headquarters sits.

This is a plain-English breakdown of what each state requires, who the laws apply to, and what your business should do before enforcement begins.

What Each State Requires

Three states have passed distinct AI regulations. Each targets different types of AI use, but they overlap in ways that matter for multi-state businesses.

Colorado SB 26-189

Colorado’s original AI Act (SB 205) took effect in early 2026. The legislature replaced it in May 2026 with SB 26-189, a more detailed framework effective January 1, 2027.

The new law requires four specific obligations when AI contributes to consequential decisions:

• Consumer disclosure. Before an AI system makes or substantially contributes to a decision, you must tell the consumer that AI is involved.
• Post-decision explanation. If a decision goes against the consumer (denied a loan, rejected for a job, higher insurance rate), you must explain what factors the AI weighed and why.
• Correction rights. Consumers can challenge AI-driven decisions and submit corrected information for reconsideration.
• Human review. Consumers can request that a human being review any AI-driven consequential decision.

“Consequential decisions” covers employment, lending, insurance underwriting, healthcare, housing, and education. If your business touches any of these areas with AI tools, Colorado’s law applies when you serve Colorado customers.

There is no private right of action, meaning only the Colorado Attorney General can enforce the law. But penalties under the Colorado Consumer Protection Act can reach $20,000 per violation, and enforcement actions are public record. If you wrote an AI governance policy based on the original SB 205, you will need to update it to match the new requirements.

Texas TDPSA

The Texas Data Privacy and Security Act already requires disclosure when AI processes personal data in consumer-facing contexts. Financial services and healthcare applications carry the strictest requirements. Businesses must document that their AI systems do not discriminate based on protected characteristics and must disclose AI involvement to consumers.

Texas also passed the Responsible AI Governance Act (TRAIGA), which creates legal accountability for AI systems deployed with intent to harm, discriminate, or deceive. Deploying AI for hiring or lending decisions without documented safeguards can demonstrate reckless disregard even without malicious intent. Penalties under TDPSA reach $7,500 per affected record, which adds up fast when you’re processing thousands of customer interactions.

Florida AI Content Labeling

Florida’s requirement is narrower but still relevant for marketing teams. If your business uses AI to generate audio, video, or image content for commercial purposes, that content must be clearly labeled as AI-generated. This applies to AI-generated social media graphics, marketing videos, podcast content, and product images.

The law does not cover internal documents or text-only content. But if your AI marketing tools produce visual or audio assets for external use, those need labels.

Who These Laws Apply To

All three laws apply based on where your customers are located, not where your business is headquartered. A Dallas company with customers in Colorado must comply with SB 26-189 for those customers. A Houston firm running AI-generated video ads that reach Florida consumers must label that content properly.

The Small Business Exemption (Read the Fine Print)

Colorado SB 26-189 exempts businesses with fewer than 50 employees, but there is a significant condition: the exemption only applies if your business does not customize AI models with proprietary data. The moment you fine-tune a model on your own customer data, train a chatbot on your internal knowledge base, or build custom AI workflows with company-specific datasets, the exemption disappears.

For businesses using off-the-shelf AI tools (standard ChatGPT, Microsoft Copilot, basic chatbot widgets) without customization, the Colorado exemption applies. But if your team has configured any AI tool with company data, confirm whether that crosses the customization line before relying on the exemption.

Texas and Florida do not offer comparable blanket exemptions for small businesses.

Five AI Use Cases That Trigger Compliance

You may be using AI in ways that trigger these laws without realizing it. Audit these five areas first:

1. Resume screening and hiring tools. Any AI involvement in filtering applicants, scoring resumes, or ranking candidates triggers Colorado’s consequential decision requirements and Texas disclosure obligations.
2. Customer service chatbots. If your chatbot handles insurance questions, financial inquiries, healthcare scheduling, or any interaction that could affect a customer’s access to services, disclosure requirements apply in both Colorado and Texas.
3. Insurance quoting and underwriting. AI-assisted pricing or risk scoring is a textbook consequential decision under Colorado law and falls under TDPSA requirements in Texas.
4. AI-generated marketing content. Video, audio, or image content produced by AI tools must be labeled under Florida law. Text-only content is currently exempt.
5. Loan or credit decisions. Any AI involvement in credit scoring, loan approvals, or financial risk assessment triggers the full suite of Colorado’s disclosure, explanation, correction, and human review requirements.

Your Readiness Checklist

January 2027 is seven months away. That sounds comfortable until you factor in policy reviews, legal consultations, tool audits, and staff training. Start now.

• [ ] Inventory every AI tool your business uses. Include chatbots, hiring software, CRM automation, marketing tools, and any Microsoft Copilot or AI assistant deployments. Document what data each tool processes and what decisions it influences.
• [ ] Map which states your customers are in. If you serve customers in Colorado, Texas, or Florida, identify which tools trigger obligations in each state.
• [ ] Update your AI governance policy. If you already have one, review it against Colorado’s new SB 26-189 requirements. If you don’t have one, building an AI policy is step one.
• [ ] Establish human review processes. For any AI tool involved in consequential decisions, define who reviews flagged decisions, how consumers can request human review, and what the turnaround time looks like.
• [ ] Draft consumer disclosure language. Prepare standardized notices for customers explaining where and how AI is used in your business processes.
• [ ] Document non-discrimination compliance. Texas requires this documentation explicitly. Colorado’s explanation and correction requirements make it practically necessary everywhere.
• [ ] Train your team. HR, customer service, marketing, and sales staff should know which tools use AI and what disclosure requirements apply to their work.
• [ ] Set a Q4 2026 compliance review date. Put it on the calendar now for a final review before Colorado’s January 1, 2027 effective date.

The regulatory direction is clear: more states will follow Colorado, Texas, and Florida with their own AI-specific laws. Building a compliance framework now means you adapt once instead of scrambling every time a new state passes its version. Start with the inventory. You cannot comply with rules about AI tools you don’t know you’re using.