The 10-minute AI audit every Central Texas business should run before September 1

Someone at your business used AI today. Maybe they asked ChatGPT to draft a client email, or had Copilot summarize a meeting. Nobody approved it. Nobody wrote a policy for it. It just happened, because it’s useful and it’s free.

That’s shadow AI: the AI tools running quietly inside your business that never went through IT, legal, or leadership. Almost every company has some version of it right now, whether anyone’s noticed or not.

Here’s why it matters more starting this fall. Texas’s new AI law, TRAIGA, has been in effect since January 1, 2026. On September 1, 2026, the Texas Attorney General’s office opens a complaint portal, giving consumers, patients, and employees a direct way to flag how a business is using AI. The AG has sole enforcement authority, and penalties for confirmed violations range from $10,000 to $200,000, though businesses do get 60 days to fix an issue after notice before penalties apply.

None of that is a reason to panic. It’s a reason to know what’s actually happening with AI in your business before someone else asks you first.

There’s already plenty written about what TRAIGA says. What’s harder to find is something you can actually do with that information today. So here’s a self-audit. Ten questions, about 10 minutes, no consultant required.

The 10-question shadow AI audit

1. Can you name every AI tool your team is using right now, not just the ones you officially approved?
2. Has anyone pasted customer, patient, or employee information into a public AI tool to draft something faster?
3. Do you have anything in writing telling employees what they can and can’t put into an AI tool?
4. If someone asked “what AI does this company use, and for what,” could you answer in under five minutes?
5. Does AI play any role in decisions about hiring, lending, pricing, or anything else that affects a specific person’s outcome?
6. If you’re in healthcare, are patients ever told when AI is involved in their care or communications?
7. Is there one person in your business who actually owns AI-related decisions, or does everyone just use whatever they find?
8. Do you know what your AI vendors do with your data once you enter it? Stored? Used for training? Shared?
9. If an employee left tomorrow, would you know which AI tools they had access to and what they used them for?
10. If a customer or employee raised a concern about how AI was used regarding them, do you have any process for handling it?

If you answered “no” or “not sure” to three or more of these, you’re not unusual. You’re most businesses in Central Texas right now. The gap is normal. Leaving it unaddressed for another six months is the part worth fixing.

What to do with the answers

You don’t need a 40-page compliance binder. You need one page that says, in plain language, which tools your team can use and what should never go into them. It should also say who to ask when something’s unclear. That’s it. That’s the policy most small and mid-size businesses actually need right now.

At safemode IT, we put together a one-page AI-use policy template built for exactly this, along with a fuller AI governance guide for Texas businesses. Both are free, and both are meant to be edited, not framed.

If you’d rather walk through it with someone instead of reading another PDF, we’re happy to do that too. No pitch, no pressure. Just a conversation about where you stand and what, if anything, needs to change before September.

If you’re further along and want to see what AI done well actually looks like once the basics are covered, we wrote about that too: The AI productivity payoff: what you gain when AI is done right.

Frequently asked questions

What is shadow AI?

Shadow AI is any AI tool employees use at work without company approval — ChatGPT, Copilot, a transcription app, whatever gets the job done faster. Most businesses have some shadow AI running right now, whether leadership knows it or not.

What is TRAIGA?

TRAIGA, the Texas Responsible AI Governance Act, is Texas’s AI law. It has been in effect since January 1, 2026, and the Texas Attorney General enforces it.

When does the TRAIGA complaint portal open?

The Texas Attorney General’s office is required to have its AI complaint portal operational by September 1, 2026. Once it’s live, consumers, patients, and employees have a direct way to report how a business is using AI.

What are the penalties for a TRAIGA violation?

Penalties range from $10,000 to $200,000 depending on the violation. Curable violations run $10,000 to $12,000, non-curable violations run $80,000 to $200,000, and violations that continue can add $2,000 to $40,000 per day. Businesses get 60 days to fix an issue after written notice before any penalty applies.

Do I need a written AI-use policy?

You don’t need a lengthy compliance document. A one-page policy is usually enough: which tools employees can use, and what should never go into them. Add a line about who to ask when something’s unclear, and that covers most of what a small or mid-size business actually needs.

This post is meant as a practical starting point, not legal advice. If TRAIGA compliance is a significant concern for your business, especially around hiring, lending, or healthcare decisions, talk to an attorney familiar with Texas AI law.