Trust-First AI: How Regulation Is Reshaping Business

AI regulation is no longer hypothetical. The European Union's AI Act is phasing in. Texas has its own AI governance law in force. Federal policy in the United States has changed direction. For any organization that uses AI with the public, with patients, with students, or with citizens, the question is no longer whether rules apply. It is which ones, and when.

This post lays out what the main frameworks actually require, what has changed recently, and the trust-first infrastructure that holds up regardless of which rules apply to you. It is a general overview, not legal advice. Your counsel should confirm how any of this applies to your organization.

What the EU AI Act Actually Requires

The EU AI Act (Regulation (EU) 2024/1689) was approved in 2024 and entered into force on August 1, 2024. It applies in phases rather than all at once:

• February 2025: Bans on prohibited AI practices and AI literacy duties began to apply.
• August 2025: Obligations for providers of general-purpose AI models began.
• August 2026: Transparency duties, such as telling people when they are interacting with an AI system, and most remaining provisions began to apply.
• Later: A 2026 amendment pushed the main obligations for high-risk systems back, to December 2027 for stand-alone high-risk uses and August 2028 for AI built into regulated products like medical devices.

The Act sorts AI uses by risk:

• Prohibited practices. These include manipulative techniques that cause significant harm, exploiting the vulnerabilities of specific groups, social scoring, emotion recognition in workplaces and schools, and real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.
• High-risk systems. These include AI used in hiring and worker management, education and exam scoring, access to essential public and private services such as credit and benefits, law enforcement, and critical infrastructure, plus AI built into regulated products such as medical devices. High-risk systems must meet requirements for risk management, data governance, documentation, human oversight, accuracy, and security.
• Transparency obligations. Chatbots must disclose that the user is interacting with AI, and certain AI-generated or manipulated content must be labeled.
• Minimal risk. Most other AI uses, such as spam filters or internal drafting tools, carry no new obligations.

Penalties come in three tiers. Prohibited practices can draw fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher. Most other violations, including high-risk and transparency obligations, can draw up to €15 million or 3%. Supplying incorrect or misleading information to authorities can draw up to €7.5 million or 1%. For smaller companies, the lower of the two figures applies.

Does the EU AI Act Apply to a Texas Organization?

Sometimes. The Act applies to providers that place AI systems on the EU market or put them into service there, wherever the provider is based, and to providers and deployers outside the EU when the system's output is used in the EU. A Plano practice serving local patients with an AI scheduling assistant is unlikely to be in scope. A DFW software company selling an AI hiring tool to European employers likely is.

Having a website that EU residents can visit does not by itself bring you into scope. Collecting personal data from people in the EU is a separate question, governed mainly by the GDPR.

The deeper impact is indirect. The EU AI Act is becoming a reference point for AI governance, much as the GDPR became a reference point for privacy. Large customers, vendors, and procurement teams increasingly ask EU-style questions about risk, documentation, and oversight even where the law does not strictly apply.

The U.S. Federal Picture Has Shifted

The United States has no comprehensive federal AI law. Federal direction comes mostly from executive action and agency guidance, and it has changed.

President Biden's Executive Order 14110 on Safe, Secure, and Trustworthy AI, issued in October 2023, was revoked on January 20, 2025. Executive Order 14179, signed days later, directed agencies to review actions taken under it and to develop a national AI action plan. Federal policy since then has favored fewer AI-specific rules for industry and has pushed back on a patchwork of state AI laws. Expect continued change.

What has stayed constant is the NIST AI Risk Management Framework. Released in January 2023 and supplemented in 2024 with a profile for generative AI, it is voluntary, but it is widely used as a common vocabulary for AI risk and appears in procurement and contracting conversations. As noted below, Texas law now gives it real weight.

State Law: Texas Has an AI Law

State legislatures have moved faster than Congress. California's SB 1047, which would have required safety testing for the largest models, was vetoed in September 2024. Colorado passed a broad algorithmic-discrimination law in 2024, then delayed it and, in 2026, replaced it with a narrower transparency-focused law. Other states have passed targeted measures, and the list changes every session.

Texas has two laws every DFW organization using AI should know.

The Texas Data Privacy and Security Act (TDPSA). Signed in June 2023 and in effect since July 1, 2024, the TDPSA gives Texas consumers rights to access, correct, and delete their personal data and to opt out of its sale, targeted advertising, and certain profiling. It requires data protection assessments for higher-risk processing. It is not an AI law, but it shapes how personal data can feed AI systems. The Texas Attorney General enforces it, with civil penalties of up to $7,500 per violation.

The Texas Responsible Artificial Intelligence Governance Act (TRAIGA, HB 149). Signed in June 2025, it took effect on January 1, 2026. Its main features:

• Prohibited uses. It bars developing or deploying AI with the intent to manipulate people toward self-harm, violence, or crime, to unlawfully discriminate against a protected class, or to produce certain unlawful sexual content. Liability is intent-based. A disparate impact alone does not establish discriminatory intent.
• Government obligations. Most of the duties fall on government entities. State and local agencies must disclose to people when they are interacting with an AI system, may not use AI for social scoring, and face limits on using AI to identify individuals from biometric data without consent.
• Healthcare disclosure. Healthcare providers that use AI in a patient's diagnosis or treatment must disclose that use to the patient.
• Enforcement. The Texas Attorney General has exclusive enforcement authority. There is no private right of action. Organizations get notice and a 60-day opportunity to cure, and uncured violations can carry significant civil penalties.
• NIST alignment. Substantial compliance with the NIST AI Risk Management Framework, or a similar recognized framework, is a defense.
• Statewide rules. TRAIGA preempts city and county AI ordinances and creates a state AI council to advise on AI policy.

Texas also passed healthcare-specific rules in 2025 (SB 1188) that address AI use in diagnosis and how electronic health records are handled. For public sector teams and healthcare organizations in Texas, AI governance is already a compliance requirement, not a future one.

The United Nations Sets the Tone

In March 2024, the UN General Assembly adopted its first resolution on artificial intelligence (A/RES/78/265), led by the United States and co-sponsored by more than 120 member states. It calls for AI that is safe, secure, and trustworthy, and that respects human rights and protects personal data.

The resolution is non-binding. Its significance is normalization: governments across very different systems have endorsed the same basic expectations of transparency, oversight, and accountability. Those expectations show up in every framework above.

What This Means for the Public Sector and Regulated Organizations

Government agencies carry the heaviest direct load under TRAIGA, and procurement is where it shows up first. Expect solicitations to ask how an AI system discloses itself, what data it uses, how bias is tested, who reviews consequential outputs, and whether the vendor aligns with the NIST framework.

Healthcare, education, workforce, and financial services organizations face a similar pattern from different directions: HIPAA and Texas health privacy law, student privacy rules, employment law, and financial regulators all ask some version of the same question. Can you explain what the system did and show that a qualified person was accountable for the outcome?

The organizations that can answer with documentation, not reassurance, will win contracts and keep trust.

What Trust-First Infrastructure Looks Like

Trust-first AI infrastructure has five components, and they map onto every framework above.

Transparency. Every AI-assisted process should be documentable. If an algorithm scores, routes, or ranks people, someone on your team should be able to explain what factors drove the result. Where people interact with AI, tell them.

Human oversight. Consequential decisions should not be fully automated. AI can triage an intake queue or draft an eligibility summary, but a qualified person should own decisions about care, benefits, employment, or legal standing.

Data governance. Know what data your AI systems use, where it came from, how it is processed, and whether you have the right to use it that way. Most organizations cannot yet answer these questions about their own systems.

Auditability. Systems should produce records that can be reviewed. If someone disputes an AI-assisted decision, you should be able to reconstruct what happened.

Continuous monitoring. AI systems drift as models update and data changes. Regular testing for accuracy and bias is part of the infrastructure, not an extra.

The Business Case Beyond Compliance

Compliance is the minimum. The larger payoff is trust.

Public trust in AI is fragile. In a 2023 Pew Research Center survey, 52% of Americans said they were more concerned than excited about the growing use of AI in daily life, and only 10% said they were more excited than concerned. Where skepticism is the default, organizations that can show responsible AI use stand out.

That matters most where relationships are the product. A patient wants to know their health information is handled with care. A client wants to know a professional reviewed the analysis. A resident wants to know a person, not a black box, is accountable for a decision about their benefits.

What to Build Now

Start with an inventory. List every process that uses AI or automated decision-making, what data it uses, what it does, and who is responsible for oversight. Most organizations have never done this, and every framework above assumes you have.

Build disclosure into anything public-facing. If people interact with an AI assistant, say so plainly. If you use automated scoring or recommendations, be able to explain the logic.

Add human review checkpoints for consequential decisions. Anything that significantly affects someone's health, finances, legal standing, benefits, or employment should include human judgment before it is final.

Align with the NIST AI Risk Management Framework. It is voluntary, it is the common language procurement teams use, and in Texas it supports a defense under TRAIGA.

Finally, set a review cycle. Audit AI systems on a regular schedule for accuracy, bias, and fit with current practice, and revisit the inventory when laws change. They will.

Our AI integration and strategy work builds this infrastructure into AI deployments from the start. If you want a first read on where AI fits in your operation, take the AI Opportunity Score. It asks a few questions about your operation and estimates where automation would return the most.

---

Primary sources: Regulation (EU) 2024/1689 (EU AI Act) and its 2026 amendment; Executive Orders 14110 (October 2023), 14148 (January 2025) and 14179 (January 2025); NIST AI Risk Management Framework 1.0 (January 2023) and Generative AI Profile (2024); Texas Data Privacy and Security Act (HB 4, 2023); Texas Responsible Artificial Intelligence Governance Act (HB 149, 2025); UN General Assembly Resolution A/RES/78/265 (March 2024); Pew Research Center survey on AI attitudes (August 2023). This post is general information, not legal advice.