- Practical, Not Alarmist
AI Regulation: What a Texas Small Business Actually Needs to Do
The rules that will affect a Dallas practice or firm are mostly not AI-specific laws. They are the obligations you already have, applied to a new kind of tool, and preparing for them looks the same either way.
THE HONEST FRAMING
Your Obligations Did Not Pause for AI
AI regulation is genuinely unsettled and changing, and any page claiming to give you a definitive compliance checklist is overpromising. What is stable, and what actually governs most small businesses today, is simpler: the obligations you already carry, HIPAA if you handle PHI, professional confidentiality if you practice law, contractual data terms, grant conditions, and consumer protection law, apply to AI tools exactly as they apply to anything else.
A practice that puts patient information into a service with no business associate agreement has a HIPAA problem today. Not a future AI-regulation problem. That framing is more useful than tracking legislative proposals, because it points at work worth doing now regardless of what passes.
We are a technology firm, not a law firm. What follows is how we see the practical picture; your counsel decides what it means for you.
For a Dallas business, the rules that matter are mostly not AI-specific. They are HIPAA, contractual confidentiality, and state data-breach obligations you already carry, and they apply to an AI tool the same way they apply to email. We track the Texas requirements from Plano and tell clients plainly which ones touch them.
WHAT ACTUALLY APPLIES
Four Layers, in Order of How Likely They Are to Affect You
LAYER 1, APPLIES TODAY
Sector Rules You Already Follow
HIPAA, professional conduct rules, financial-services obligations. These are not new and they are not ambiguous. They simply now apply to a category of vendor most businesses vetted less carefully than they vet a practice management system.
LAYER 2, APPLIES TODAY
What You Promised in Writing
Client engagement letters, privacy notices, grant agreements, and enterprise customer contracts frequently contain data-handling commitments made before anyone was thinking about AI. These bind you now.
LAYER 3, ARRIVING
Disclosure and Transparency Expectations
The clear direction of travel is toward telling people when they are interacting with an automated system and when AI materially shaped a decision about them. Adopting this now is cheap and gets ahead of it.
LAYER 4, WATCH
Consequential-Decision Rules
Where AI influences hiring, credit, insurance, housing, or access to care, expect the most scrutiny and the strictest requirements. If you are in that territory, involve counsel early rather than after building.
The preparation is the same either way
Know what tools are in use, know what data they touch, have a written policy, have vendor agreements appropriate to that data, keep human review on consequential decisions, and log enough to answer a question later. Every emerging requirement we have seen asks for some subset of those six things. Build them because they are good practice, and compliance becomes a documentation exercise rather than a project.
Should we wait for the rules to settle before adopting AI?
Waiting does not reduce your exposure, because staff are already using these tools whether or not the business has adopted them. The businesses that will find new requirements easiest are the ones that already know what is running and wrote it down.
Do rules from other states or countries affect a Texas business?
They can, depending on where your clients, patients, or employees are, and larger customers often pass their own obligations down through contract regardless of jurisdiction. This is a question for your counsel, and the practical preparation is identical either way.
What is the single most likely way we get caught out?
Not a new statute, a member of staff putting regulated data into a consumer tool with no agreement in place, under rules that have applied for years. That is the realistic exposure for almost every small business we talk to, and it is addressable this month.
BK
Written and reviewed by Bob Kehr, President & Founder of Kehr Technologies, Plano City Council member, and Plano Chamber Small Business Person of the Year 2022, as a Plano City Council member he sees policy questions arrive from the public side as well as the client side.
Last reviewed August 2026 . This page is technology guidance, not legal advice. Call 214-444-3583. Kehr Technologies is based in Plano, Texas, and works with businesses throughout the Dallas area.