Texas AI Law Imposes New Framework – Employers Should Review Use of Biometric Data

A landmark Texas law will shape how artificial intelligence and biometric data are handled in the workplace. Under House Bill 149 (the Texas Responsible Artificial Intelligence Governance Act), signed into law June 22, 2025, a comprehensive governance structure for AI takes effect January 1, 2026.

While the statute’s most restrictive provisions apply to government entities, businesses and payroll service providers must begin preparing now for key obligations and potential liability.

What the law requires

The legislation sets out several core duties:

An AI advisory council and regulatory oversight mechanism covering the development, procurement and use of certain AI systems.
Disclosure requirements when individuals interact with AI systems that generate content, decisions and recommendations about them.
A prohibition on government entities deploying AI to capture or infer biometric identifiers in real-time (such as facial recognition or voice recognition) unless very specific conditions are met.
Enhanced protections for “consumers,” though the statute defines “consumer” in a way that excludes individuals in an employment or business-to-business context.
Authority for the Texas attorney general to enforce the law and seek civil penalties for violations.

What employers should know

Although the statute does not directly ban private-sector employers from using biometric tools, several provisions are relevant for payroll and HR departments:

If your organization uses AI tools (for recruiting, monitoring, access control or payroll-related verification) that collect or process biometric data (such as fingerprints, facial scans or voice recognition), you should confirm whether those tools are covered under the law’s “biometric identifier” definition.
Review how you obtain and document consent for biometric data or AI-driven profiling. Even if the law doesn’t impose identical requirements on employers, transparency and good data governance are now a strong expectation.
Verify that contracts with vendors (for time-clocks, access systems, AI monitoring platforms) reference data-retention, security and destruction practices that align with emerging compliance expectations.
Train HR, IT and payroll staff on the new law’s broad obligations, especially disclosure of AI-generated decisions or content and appropriate data safeguards.
Monitor updates from the Texas Attorney General and legal-firm guidance on enforcement trends and private-sector risk exposure.

Next steps for payroll/service providers

Inventory: Check inventory of all systems that use biometric data or AI–identify which rely on facial recognition, voice recognition or other biometric identifiers.
Gap-analysis: Compare current policies and vendor agreements to the law’s transparency and governance standards.
Policy review and update: Integrate or revise language on consent, data retention, security and employee notification of AI-driven employment decisions.
Training and communication: Ensure internal stakeholders understand the new law’s scope, what qualifies as “AI interaction” and how to respond to employee requests or concerns.
Stay informed: The law becomes effective January 1, 2026, but legal guidance and enforcement practices will evolve. Establish a process to monitor updates from the Texas attorney general and industry advisories.

By getting ahead of compliance now, employers and payroll vendors can reduce risk, maintain trust among employees and avoid potential regulatory action.