An AI safe harbor is written into the Texas Responsible AI Governance Act, which took effect on January 1, 2026, and it is the most useful clause in the statute for an ordinary business. The law takes an intent-based approach, prohibiting particular harmful uses rather than sorting systems into risk tiers, with penalties reaching 200,000 dollars and a 60-day period to cure. Alongside that sits an affirmative defense for organizations that substantially comply with the current NIST AI Risk Management Framework, find violations through their own testing, and run documented internal review. Almost nobody we speak to knows it exists, and the firms writing AI policies this year are mostly producing documents that would not qualify.
The Five Conditions the Defense Actually Rests On
The affirmative defense is conditional, and the conditions are specific. These are the ones that decide whether your documentation is worth anything.
- Substantial compliance with the current NIST AI Risk Management Framework, including its generative AI profile rather than the core document alone.
- Violations discovered through your own testing, which means internal testing, red-teaming, or adversarial testing rather than a customer complaint.
- Adherence to guidance issued by the applicable state agency, which changes over time and needs somebody watching it.
- Feedback captured through a documented internal review process, so the review has to leave a written trail.
- A 60-day cure period, which rewards being able to move quickly once something is identified.
Our note on building a compliance framework that holds up covers the structural work this sits on top of.
Why an AI Safe Harbor Rewards Testing Rather Than Policy
The defense is built around evidence that you looked for problems, which is a different activity from stating what you will not do. A policy document records intent. A test record shows you went looking, found something, and acted. When a statute offers a defense to organizations that discovered violations through internal testing, it is telling you which of those two artifacts will matter, and it is not the one most firms produced this year. We have read a lot of AI policies since January. They are largely well written, they set out acceptable use and approval steps, and almost none of them is accompanied by any record of anyone testing whether the systems behave as the policy assumes.
Adversarial Testing Is Less Exotic Than It Sounds
Red-teaming an AI system in a small business means sitting down with the thing and deliberately trying to make it behave badly, which needs a couple of hours and somebody willing to be difficult rather than a specialist tool. Try to get the customer-facing assistant to promise something the business cannot deliver. Try to get the internal tool to reveal information from a record the user should not see. Try to get it to produce output that treats two similar enquiries differently in a way that would embarrass you. Write down what you tried, what happened, and what you changed. That record is the artifact the defense contemplates. The objection that amateur testing proves nothing has some force against a sophisticated adversary and misses the point of the requirement, which is evidence of a genuine internal search rather than a certification of safety. Our AI risk assessment work formalizes this, and a firm doing a rough version themselves is still in a far better position than one doing none.
The Framework Reference Is Load-Bearing
Substantial compliance with a named framework is a much harder claim than having a policy, because the framework specifies functions and activities somebody can check you against. The NIST AI Risk Management Framework organizes the work into governing, mapping, measuring, and managing, and its generative AI profile addresses the systems most small businesses are actually deploying. Reading it is not a weekend, and mapping your practices against it honestly will show gaps. That is the exercise. The reasonable counterpoint is that a voluntary framework written for large organizations imposes real overhead on a fifteen-person firm, and substantial compliance is an undefined standard nobody can confirm in advance. Both are true. What we can say is that a firm with a mapped, gap-noted, partially-implemented framework is in a categorically different position from one with a policy and nothing else, and our note on doing compliance work once across overlapping frameworks covers how to avoid paying for this twice.
Whether This Applies to You at All
Reach is the first question and the one most firms get wrong in both directions, assuming either that a state law cannot touch them or that every state law does. State AI statutes generally reach conduct affecting residents of that state rather than only businesses headquartered there, so a firm with customers in a regulated state can be in scope without any physical presence. Equally, not every law reaches every use of AI, and an internal tool that never touches a consumer sits differently from a system making decisions about people. Get a clear answer for your own situation rather than acting on a general impression, because the cost of assuming either way is real. Our compliance services start at exactly this scoping question.
Build to the Strictest Regime You Touch
Maintaining one control set built against the most demanding regime you are exposed to is cheaper than maintaining several, and it is the only approach that survives the next state passing a law. The patchwork is growing rather than settling, and firms that build state-by-state end up with overlapping obligations, duplicated evidence, and no clear answer when somebody asks a general question about their AI governance. One framework, one set of records, one review cycle. The argument against is that building to the strictest standard imposes cost driven by a jurisdiction that may represent a small share of your business. That is a fair commercial objection, and the answer depends on how concentrated your exposure is. For a firm with customers spread across many states, the single control set wins quickly. For one with a single out-of-state customer, it may not.
Watch the Agency Guidance, Not Just the Statute
The defense depends partly on following guidance issued by the applicable state agency, which means the requirement moves after the law is passed and somebody needs to be watching. This is the condition most likely to decay quietly. A firm does the work in year one, files it, and never learns that guidance was issued in year two clarifying what substantial compliance means in practice. Put a named person on it with a calendar reminder, the same way you would for any other regulatory watch. The objection that this is disproportionate for a small business with limited AI use is reasonable, and the proportionate version is a quarterly check rather than a subscription service. What does not work is nobody, because the statute rewards adherence to guidance you have to know about first, and our FTC compliance practice sees the same decay pattern in every regime where guidance evolves after the rule lands.
What Good Documentation Looks Like Here
The paperwork that earns this defense is a running record rather than a document, which is a different thing from what most compliance efforts produce. A policy is written, approved, filed, and reviewed annually if anyone remembers. What the statute contemplates is closer to a logbook: this is the system, this is what we tested on this date, this is what we found, this is what we changed, this is who reviewed it. That format is more useful internally as well, because it answers the question that actually comes up, which is what was known and when. Our note on governance as infrastructure rather than a security checkbox makes the same argument in a different regime.
Record the Systems Before You Record the Testing
You cannot show you tested your AI systems without a list of them, and that list is harder to produce than firms expect because AI arrives inside products nobody classified that way. The obvious deployments get listed. The assistant embedded in a customer service platform, the summarization feature in a meeting tool, the scoring built into a recruitment product, and the automation somebody configured in a low-code tool usually do not. Each of those is a system making or shaping a decision, and each falls in scope of a statute concerned with how AI is used rather than with what the vendor calls it. Start the inventory from your software list rather than from your AI projects. The counterargument is that this definition sweeps in so much that the exercise becomes unmanageable, which is a genuine risk. Bound it by consequence: list the systems whose output affects a person’s treatment, access, price, or opportunity, and leave the spell checker alone.
Keep the Record Somewhere It Will Survive
Documentation that lives in one person’s folder is documentation you will not have when it matters, and the person who ran the testing is disproportionately likely to be the one who leaves. Put it in a shared location with a predictable structure, one folder per system, dated entries, and a named owner. This sounds obvious and it is the most common reason we find good work that no longer counts for anything. The reasonable pushback is that formal records management is overhead a small team resents, and that the testing itself is the valuable part. The testing is the valuable part, and it becomes worthless as a defense the moment nobody can produce it. Our work on AI tooling for compliance documentation covers ways to lower that overhead without lowering the standard.
Build the Cure Path Before You Need It
A 60-day cure period is generous on paper and short in practice, because most of it gets consumed by finding out who decides. The clock starts when the problem surfaces, and the firms that use the window well are the ones who worked out in advance who can switch a system off, who signs off on a change to it, and who talks to the customer or the regulator. Firms that have not are still arranging a meeting in week three. Write three names down: the person who can disable the system same-day without asking anyone, the person who approves a remediation, and the person who handles the external communication. That is the whole cure path, and it fits on the same page as the system inventory.
Test it against the least consequential system you have, in the same session as your adversarial testing, by asking what would actually happen if you had to take it out of service this afternoon. The answers are usually uncomfortable in a productive way, because a system nobody can switch off without a week of coordination is a system you do not really control. The objection is that this is incident response planning wearing a compliance hat, and it largely is, which is an argument for doing it once rather than twice. If you already have an incident process, add the AI systems to it and name the decision-maker. If you do not, the three names are a reasonable place to start one.
Frequently Asked Questions
Does the Texas law apply to businesses outside Texas?
It can. State AI statutes generally reach conduct affecting residents of that state rather than only businesses located there, so customers in a regulated state can bring you into scope. Get a specific answer for your situation.
What is an affirmative defense in practice?
It is a defense you raise and support with evidence rather than a shield that applies automatically. The burden of producing the documentation sits with you, which is why the records matter more than the intent.
Do we need specialist tools to red-team an AI system?
No. For most small business deployments this means deliberately trying to make the system behave badly for a couple of hours and writing down what happened. The record of a genuine internal search is what the defense contemplates.
Is an AI policy document enough on its own?
Not for this defense. The conditions reference testing, discovery of violations through your own review, and documented internal feedback, all of which are activities rather than statements.
How often should we repeat the testing?
Re-test when the system changes, when the vendor ships a significant update, and on a scheduled cycle otherwise. An annual record against a system that was replaced in March proves very little.
Who You Are Taking This Advice From
Mindcore does AI risk assessment and compliance work for businesses deploying AI inside products they bought rather than systems they built, which is where the inventory problem is hardest and the paperwork is thinnest. We build the system list from the software estate, run the adversarial session with the people who use the tool daily, and set up the record in a place that survives a staff change, and the guidance above comes from assessments we have run this year rather than from a statutory summary. Matt Rosenthal, who leads Mindcore, keeps the firm focused on compliance work that produces something a business can actually use internally, which here means a logbook that answers what we knew and when. You decide how AI is used in your business. Our job is to make sure you can show it.
Your Next Move on AI Governance
Start with the inventory, because every other step depends on it and it is the one most firms have never done. Work from your software list rather than your AI projects, and include anything whose output affects a person’s treatment, access, price, or opportunity. Then run one honest adversarial session against the system on that list with the most consequential output, with the people who use it daily in the room, and write down what you tried and what happened. That single record puts you ahead of almost every comparable business, and it takes an afternoon. Map what you have against the NIST framework afterward rather than first, since the mapping is far easier once you know what you are mapping. Put the whole thing in a shared folder with a named owner and a quarterly reminder to check whether agency guidance has moved. The defense exists and it is winnable. It is simply not available to a business whose only artifact is a policy nobody has tested. If you want help running the inventory and the first adversarial session, book a free strategy call and we will start with your software list.
