Businesses across Dallas, Fort Worth, and Plano are adopting artificial intelligence tools at a pace that has outrun most internal policies. Employees use ChatGPT, Microsoft Copilot, and similar platforms every day to draft emails, summarize documents, and analyze data. Many of these interactions happen through personal accounts that sit outside any company oversight.
That means new risks and vulnerabilities.
The risk is not the technology. The risk is what happens to company data after it enters these platforms. Customer records, financial projections, contract language, and competitive strategies can leave an organization with a single prompt. Once that information reaches a third-party system, the business loses practical control over how it gets stored, processed, or used to train future models.
At this point, companies in the Metroplex know employees are using AI. What comes next is understanding what data is being shared into systems like CoPilot, Gemini, ChatGPT, and Claude…and with whom. This post examines the governance risks AI creates for DFW businesses, the Texas law now in effect, and the practical steps business owners can take to protect their organizations.
Where AI Data Risk Starts for Small Businesses
Most AI-related data exposure does not begin with a dramatic security breach. It begins with an employee trying to work faster.
A sales manager pastes a customer list into ChatGPT to generate outreach templates. An office administrator uploads a vendor contract to get a plain-English summary. A finance team member drops revenue numbers into an AI tool to build a quick forecast. Each of these actions sends proprietary business data to a system that the company does not own or control.
Shadow AI and Unsanctioned Tool Use
Research from Cyberhaven found that 74% of workplace ChatGPT usage happens through personal accounts rather than corporate-licensed versions. For Google’s Gemini, that figure reaches 94%. These numbers mean that most AI interactions at work bypass any enterprise data protections the tools themselves may offer.
The term for this is shadow AI. Like shadow IT before it, the pattern involves employees adopting tools on their own because the tools make their work faster or easier. The difference is speed. Shadow IT took months to spread through an organization. Shadow AI can move through an entire team in a single afternoon.
The Data That Leaves Without Permission
The types of data entering AI tools are not limited to low-risk content. The vast majority of legal documents shared with AI platforms go through unauthorized accounts. Close to half of all source code, R&D materials, and HR records pasted into these tools follow the same path.
For a Dallas business handling client contracts, patient information, or financial records, each of these interactions represents a potential compliance violation and a loss of control over sensitive data. Federal courts ruled in 2026 cases that sharing confidential material with third-party AI tools can destroy the legal protections a business relies on to keep trade secrets classified as trade secrets.
Understanding the risk is the first step. Knowing the regulatory landscape is the next.
What Texas Businesses Need to Know About AI Regulation
Texas passed the Texas Responsible AI Governance Act, known as TRAIGA, through House Bill 149. The law took effect on January 1, 2026, and applies to any business operating in Texas or serving Texas residents.
TRAIGA takes an intent-based approach to regulating AI. Rather than requiring specific impact assessments or documentation the way some other states have proposed, the law prohibits specific harmful uses. These include biometric capture without consent, discriminatory decisions in areas like employment and lending, and government social scoring. The Texas Attorney General holds enforcement authority, with civil penalties ranging from $10,000 to $200,000 depending on the severity and nature of the violation.
TRAIGA and the Affirmative Defense That Matters
The most practical element of TRAIGA for Dallas business owners is its affirmative defense provision. Companies that demonstrate substantial compliance with the NIST AI Risk Management Framework can use that compliance as a legal defense if a question arises about their AI use.
The NIST AI Risk Management Framework, or NIST AI RMF, organizes AI risk management across four functions: Govern, Map, Measure, and Manage. A business does not need a large compliance program to align with these principles. A documented, lightweight version of the framework satisfies the standard that TRAIGA references.
What This Means for a Company With 30 Employees
For most small and mid-sized DFW companies, TRAIGA is not a reason to panic. The law targets specific harmful behaviors rather than requiring broad compliance infrastructure. A 30-person company that uses AI tools for routine business tasks and maintains reasonable policies around that use faces minimal enforcement risk.
That said, the law creates a practical incentive to document how the business uses AI and what safeguards are in place. Companies with that documentation in hand have a clear defense. Companies without it face more uncertainty if the Attorney General’s office comes asking questions. Building that documentation starts with a governance policy that is fit for the size of the business itself.
Building an AI Governance Policy That Works
Governance does not require a 50-page document or a full-time compliance officer. For a business with 15 to 75 employees, the goal is a clear, usable policy that employees can follow without legal interpretation.
Start With an AI Inventory
Before writing a policy, business owners need to know what AI tools are in use across the organization. This includes licensed platforms like Microsoft Copilot as well as free tools employees may access through personal logins.
Internal surveys, browser histories, and even informal interviews can provide a baseline of AI activity in the business. The inventory should capture which tools are in use, which teams use them, and what types of data those teams handle. Without this information, any policy will be based on assumptions rather than the reality of how the business operates.
Define What Data Stays Out of AI Tools
The most effective governance policies include a clear list of data categories that should not enter any AI platform. Customer personally identifiable information, or PII, financial records, legal documents, employee HR files, trade secrets, and proprietary business strategies belong on that list.
Framing this as a “do-not-paste” list in plain language makes the rule easy for every employee to follow. Technical terms and legal jargon reduce adoption. Concrete examples increase it. A policy that people can understand and follow without a lot of handholding can be the difference between adoption and rejection.
Vendor Vetting and Data Agreements
Every AI tool a company adopts should go through a basic review before deployment. The key questions are direct. Does the vendor train its models on user inputs by default? Can the business opt out? Is there a signed data processing agreement in place?
These checks apply to new tools and to platforms the business has used for months. Many companies adopted AI tools during the initial period of rapid availability without reviewing terms of service or data handling practices. A retroactive review addresses that gap and gives the business a documented record of its IT regulatory compliance posture. Once the policy side is in place, technical controls add a second layer of protection.
Technical Controls and Ongoing Oversight
Policies set expectations. Technical controls enforce them. The two work together, and neither is sufficient on its own.
Network-Level Visibility and Access Controls
Cloud access security broker tools and secure web gateway technology can restrict access to personal AI accounts at the network level while allowing approved enterprise versions. A business that licenses Microsoft Copilot, for example, can block personal ChatGPT logins so that employees use the corporate tool instead. This approach keeps AI accessible while routing all interactions through systems with appropriate data protections.
Permission management also plays a role in governance. AI tools like Copilot can surface any file the logged-in user has access to. If a company has loose internal file permissions, an AI tool can expose documents that should be restricted to specific teams or roles. An IT security risk assessment identifies these gaps before they become a problem.
Training That Sticks
Technical controls catch most unauthorized activity. Training addresses the rest. Employees who understand why data governance matters and what information should not enter an AI prompt are less likely to create a risk than employees who receive a policy document and nothing else.
Effective training includes concrete examples drawn from the business itself. A law firm’s training should reference client files and case materials. A construction company’s training should reference bid documents and project data. General training that uses abstract scenarios has a limited effect compared to training built around the data employees handle every day.
Protecting Your Business as AI Adoption Grows
AI tools are becoming part of how businesses across Dallas and Fort Worth operate. That adoption will continue. The companies that manage it well are those that build governance into the process rather than responding to problems after they occur.
The practical steps are not complex. An AI inventory, a clear acceptable use policy, a do-not-paste list, vendor review procedures, network-level controls, and recurring employee training give a small business a strong governance foundation. For Texas companies, that foundation also supports the NIST AI RMF alignment that TRAIGA incentivizes as a legal defense.
Businesses looking to build or strengthen their AI governance framework can benefit from working with a partner that understands both the technology and the cybersecurity implications. Axxys Technologies offers AI and data governance consulting services designed for small and mid-sized organizations across the DFW area. To learn more about how a structured governance approach can protect your business as AI use grows, contact us to start a conversation.
