Someone at your business used AI today. Maybe they asked ChatGPT to draft a client email, or had Copilot summarize a meeting. Nobody approved it. Nobody wrote a policy for it. It just happened, because it's useful and it's free.
That's shadow AI: the AI tools running quietly inside your business that never went through IT, legal, or leadership. Almost every company has some version of it right now, whether anyone's noticed or not.
Here's why it matters more starting this fall. Texas's new AI law, TRAIGA, has been in effect since January 1, 2026. On September 1, 2026, the Texas Attorney General's office opens a complaint portal, giving consumers, patients, and employees a direct way to flag how a business is using AI. The AG has sole enforcement authority, and penalties for confirmed violations range from $10,000 to $200,000, though businesses do get 60 days to fix an issue after notice before penalties apply.
No need to panic. But you do want to know what's happening with AI in your business before someone else asks you about it.
There's already plenty written about what TRAIGA says. What's harder to find is something you can do with that information today. So here's a self-audit. Ten questions, about 10 minutes, and you don't need a consultant.
The 10-question shadow AI audit
- Can you name every AI tool your team is using right now, including the ones nobody officially approved?
- Has anyone pasted customer, patient, or employee information into a public AI tool to draft something faster?
- Do you have anything in writing telling employees what they can and can't put into an AI tool?
- If someone asked "what AI does this company use, and for what," could you answer in under five minutes?
- Does AI play any role in decisions about hiring, lending, pricing, or anything else that affects a specific person's outcome?
- If you're in healthcare, are patients ever told when AI is involved in their care or communications?
- Is there one person in your business who owns AI-related decisions, or does everyone just use whatever they find?
- Do you know what your AI vendors do with your data once you enter it? Stored? Used for training? Shared?
- If an employee left tomorrow, would you know which AI tools they had access to and what they used them for?
- If a customer or employee raised a concern about how AI was used regarding them, do you have any process for handling it?
If you answered "no" or "not sure" to three or more of these, you're not unusual. You're most businesses in Central Texas right now. The gap is normal. Leaving it alone for another six months is the problem.
What to do with the answers
You don't need a 40-page compliance binder. You need one page that says, in plain language, which tools your team can use and what should never go into them. It should also say who to ask when something's unclear. That's it. That's the policy most small and mid-size businesses need right now.
At safemode IT, we put together a one-page AI-use policy template built for exactly this, along with a fuller AI governance guide for Texas businesses. Both are free, and both are meant to be edited, not framed.
If you'd rather walk through it with someone instead of reading another PDF, we're happy to do that too. No pitch, no pressure. Just a conversation about where you stand and what, if anything, needs to change before September.
If you're further along and want to see what AI done well looks like once the basics are covered, we wrote about that too: The AI productivity payoff: what you gain when AI is done right.
This post is meant as a practical starting point, not legal advice. If TRAIGA compliance is a significant concern for your business, especially around hiring, lending, or healthcare decisions, talk to an attorney familiar with Texas AI law.
Not sure your IT is as solid as it should be? Take 10 minutes and tell us about your setup. No pressure, no obligation.
Book a 10-Minute Discovery Call →Frequently asked questions
What is shadow AI?
Shadow AI is any AI tool employees use at work without company approval: ChatGPT, Copilot, a transcription app, whatever gets the job done faster. Most businesses have some shadow AI running right now, whether leadership knows it or not.
What is TRAIGA?
TRAIGA, the Texas Responsible AI Governance Act, is Texas's AI law. It has been in effect since January 1, 2026, and the Texas Attorney General enforces it.
When does the TRAIGA complaint portal open?
The Texas Attorney General's office is required to have its AI complaint portal operational by September 1, 2026. Once it's live, consumers, patients, and employees have a direct way to report how a business is using AI.
What are the penalties for a TRAIGA violation?
Penalties range from $10,000 to $200,000 depending on the violation. Curable violations run $10,000 to $12,000, non-curable violations run $80,000 to $200,000, and violations that continue can add $2,000 to $40,000 per day. Businesses get 60 days to fix an issue after written notice before any penalty applies.
Do I need a written AI-use policy?
You don't need a lengthy compliance document. A one-page policy is usually enough: which tools employees can use, and what should never go into them. Add a line about who to ask when something's unclear, and that covers most of what a small or mid-size business needs.
Can safemode IT help us with the AI audit and a policy?
Yes. We put together a free one-page AI-use policy template and an AI governance guide for Texas businesses, and we'll walk through the audit with you if you'd rather not do it alone. Learn more on our AI page or book a free consult.
Last updated: September 18, 2026
