Texas HB 149 & EU AI Act: Engineering Duties by Role

Texas House Bill 149 and the European Union’s AI Act both impose concrete engineering duties, but they apply to different people in different ways. HB 149 focuses on algorithmic discrimination in Texas state government, while the EU AI Act creates a risk-based system of obligations for anyone placing AI systems on the EU market. This article explains who owes what duty under each law, broken down by system type and by role.

Background: Why These Two Laws Matter Together

Texas HB 149, signed in 2023, is one of the first US state laws to directly regulate AI decision-making. It applies only to state agencies in Texas—not private companies—and requires them to assess and report on any automated decision system that could contribute to algorithmic discrimination. The EU AI Act, adopted in 2024, is a comprehensive regulation that applies to any organization (public or private) that develops, deploys, or uses AI in the EU, with extra scrutiny for “high-risk” systems.

Together, they show a global shift: engineering teams are no longer just building to a spec; they are building to a legal standard. The duties differ by whether you are a developer, a deployer, or an importer/distributor, and by whether the system is classified as prohibited, high-risk, or limited-risk.

Texas HB 149: Duties for State Agencies and Vendors

HB 149 creates a two-step process for Texas state agencies. First, each agency must inventory all automated decision systems (ADS) it uses. Second, it must conduct an algorithmic impact assessment before deploying any system that could result in a “materially adverse” decision about a resident—such as hiring, housing, or benefits eligibility.

Engineering duties under HB 149 are indirect but real. The law does not impose duties directly on engineers, but it requires agencies to:

• Document the system’s purpose, intended use, and data sources.
• Evaluate whether the system has a disparate impact on protected classes (race, sex, age, disability).
• Ensure that any vendor contract includes provisions for the agency to access the system’s design and testing data.
• Report findings to the Texas Legislature every two years.

For a private engineer building a system for a Texas agency, the practical duty is to provide transparency artifacts: model cards, data sheets, bias test results, and an explanation of how the system can be audited. If you sell an AI tool to the state of Texas, you must be ready to hand over enough detail for the agency to complete its assessment—otherwise the agency cannot legally deploy your system.

EU AI Act: Risk-Based Duties for Systems

The EU AI Act categorizes AI systems into four tiers. Your engineering duties depend on which tier your system falls into.

• Prohibited (unacceptable risk): Systems that manipulate behavior, exploit vulnerabilities, or enable social scoring. These are banned outright—no engineering duty except to not build them.
• High-risk: Systems used in critical infrastructure, education, employment, law enforcement, migration, and essential services. These carry the heaviest duties.
• Limited-risk: Chatbots, emotion recognition, and deepfakes. Duties are mostly transparency—tell users they are interacting with AI.
• Minimal-risk: Spam filters, games, etc. No specific duties.

For high-risk systems, the engineering team must implement a risk management system that runs continuously. This includes:

• Data governance: training data must be relevant, representative, and free of errors where feasible.
• Technical documentation: a detailed record of the system’s design, testing, and performance.
• Logging: automatic recording of events that allow traceability of the system’s decisions.
• Human oversight: the system must be designed so a human can interpret its output and override it.
• Robustness and cybersecurity: the system must be resilient to manipulation.

These duties are not just on paper—the EU can fine up to €35 million or 7% of global turnover for violations.

Duties by Role: Provider, Deployer, Importer, Distributor

The EU AI Act assigns distinct obligations to each actor in the supply chain. Here is how they break down:

• Provider (developer): The entity that develops the AI system. Must ensure compliance before placing on market—conduct conformity assessment, draw up technical documentation, implement quality management, and register the system in the EU database.
• Deployer (user): The organization that uses the AI system. Must use it according to instructions, ensure human oversight, monitor for risks, and inform affected individuals. Deployers of high-risk systems must also perform a Data Protection Impact Assessment if they process personal data.
• Importer: Must verify the provider has done its job—check that the CE marking is present, the technical documentation exists, and the system is properly labeled.
• Distributor: Must verify the system has the correct CE marking and accompanying documentation before making it available.

Texas HB 149 has a simpler role split: the state agency is the deployer and bears the legal duty, but the vendor (provider) must supply the information. If you are a vendor, your contract will likely require you to cooperate with the agency’s assessment—and your engineering team must be prepared to answer questions about data, testing, and limitations.

How to Choose Which Law Applies to You

If you are an engineer or a compliance officer, the first question is: where is the system used, and by whom?

• If your system is used by a Texas state agency (or you are building it for one), HB 149 applies. Even if your company is in another state, the law reaches you through the contract.
• If your system is placed on the EU market or used by someone in the EU, the EU AI Act applies—regardless of where your company is headquartered. The Act has extraterritorial reach.
• If your system is used in both places, you must comply with both. This is common for large software vendors.

For the EU AI Act, you must also classify your system. The Act includes a list of high-risk use cases in Annex III, but many systems are borderline. The European Commission has issued guidelines, but the final decision often requires a legal review. When in doubt, assume high-risk—the duties are more burdensome, but that is safer than being fined.

Common Problems and Misconceptions

One common misconception is that the EU AI Act applies only to AI systems that are “intelligent” in a narrow sense. In fact, it applies to any software that uses machine learning, logic-based rules, or statistical methods to produce outputs that influence decisions. A simple regression model that predicts credit risk is covered.

Another problem is that engineers often think “bias testing” is a one-time event. Both laws require ongoing monitoring. The EU AI Act explicitly says risk management must be iterative—you must re-evaluate after any significant change to the system or its data. Texas HB 149 requires re-assessment when a system is “materially modified.”

A third issue is the black box problem. The EU AI Act requires that high-risk systems be “sufficiently transparent” to allow users to interpret the output. If you are using a deep learning model that cannot explain its decisions, you may need to switch to a more interpretable model or add explainability tools—even if that slightly reduces accuracy.

Safety and Ethical Considerations

Both laws are ultimately about preventing harm. The EU AI Act bans systems that exploit vulnerabilities of children or disabled people, and it requires that high-risk systems be designed to minimize the risk of errors. Texas HB 149 specifically targets algorithmic discrimination—the law defines it as any differential treatment that disadvantages a group based on protected characteristics.

Engineers should integrate these considerations into the design phase, not as an afterthought. This means:

• Collecting and documenting data with an eye toward bias (e.g., ensuring underrepresented groups are included).
• Testing for disparate impact using metrics like equalized odds or calibration.
• Building in human oversight mechanisms, such as a “human-in-the-loop” for high-stakes decisions.

Neither law mandates a specific technical solution, so you have flexibility in how you meet the duties. But the burden is on you to prove compliance—so keep records of your testing and design decisions.

Frequently Asked Questions

Does Texas HB 149 apply to my startup if we sell AI to a Texas state agency?

Yes, indirectly. The law requires the state agency to ensure its vendors provide enough information for an impact assessment. Your contract will likely include clauses that force you to cooperate. Even if the contract is silent, the agency cannot legally deploy your system without the needed data, so you will be asked to provide it.

What is the penalty for violating the EU AI Act?

Fines can reach up to €35 million or 7% of global annual turnover, whichever is higher, for prohibited practices. For other violations, fines are up to €15 million or 3% of turnover. Non-compliance with transparency obligations can result in fines up to €7.5 million or 1.5% of turnover.

Are open-source AI models exempt from the EU AI Act?

Not entirely. The Act exempts open-source models from most provider duties unless they are placed on the market as a high-risk system or a prohibited practice. However, if you deploy an open-source model in a high-risk context, you become the deployer and must comply with deployer duties. Also, the General-Purpose AI model rules apply to large open-source models with systemic risk.

How do I know if my AI system is “high-risk” under the EU AI Act?

Check Annex III of the Act. It lists eight areas: biometric identification, critical infrastructure, education, employment, essential services, law enforcement, migration, and administration of justice. If your system is used in one of these areas and makes decisions that affect individuals’ rights, it is likely high-risk. The European Commission has also published guidelines, but they are not legally binding.

Can I use the same documentation for both Texas HB 149 and EU AI Act compliance?

Partially. Both require technical documentation, bias testing, and risk assessment, but the formats and details differ. The EU AI Act has specific requirements for technical documentation in Annex IV, while Texas HB 149 requires a report to the legislature. You can reuse the underlying data (e.g., model cards, test results) but you will need to tailor the reports to each jurisdiction.

Related

• Can AI Get Better Without Getting Bigger? Test-Time Compute
• Calculate Months Between Two Dates in Excel
• 7 Days to Die Same Key Already Exists Error Fix