The practical lesson is separation. Keep the build, the support and the hosting as different lines. Run the application in a cloud account in your company’s name, so the hosting bill comes from the cloud provider and not inside a developer’s lump sum. Take care with web work. The Comptroller’s guide to taxable services lists “web site creation and maintenance” as data processing. A website build can therefore be taxed on 80% of the charge even when every right passes to you. Whether a given charge is taxable is a question for your tax adviser, since a bundled invoice can be read differently from three separate ones.
What the Texas privacy act asks of your software
The Texas Data Privacy and Security Act has applied since July 1, 2024. Section 541.002 catches a person who meets three tests. The person does business in Texas, or makes a product or service Texas residents use. It processes or sells personal data. And it is not a small business as the US Small Business Administration defines one. That last condition looks like a safe harbour for a start-up. It is not a full one.
Custom software and the Texas small-business twist
Section 541.107 makes an exception. Even a small business “may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer.” A sale covers sharing data for money or other valuable consideration. Sensitive data includes precise geolocation, health diagnoses, biometric data used to identify someone, and data collected from a known child. A small Texas company whose app hands location history to an advertising partner in return for payment is therefore bound by the act for that one activity. Any business that sells sensitive data must put this sentence in its privacy notice: “NOTICE: We may sell your sensitive personal data” (section 541.102(b)). Since January 1, 2025, section 541.055(e) has also let consumers opt out through a browser setting or a device-wide signal, which a controller must generally honour, so the system needs a way to read one.
Who is outside the act
Some buyers are outside the act altogether. The exemptions include HIPAA covered entities and business associates, financial institutions and data covered by the Gramm-Leach-Bliley Act, and nonprofits. Higher-education institutions are out too, as are electric utilities, power generation companies and retail electric providers. Do not assume an exemption fits your whole business, because each names a category rather than every firm that works in energy or health.
Where the software vendor sits
If you hire a developer to run your system, that developer is probably a processor under the act, and section 541.104(b) lists what the contract between you must contain:
- Clear instructions for processing, its nature and purpose, the type of data and how long it lasts.
- A duty of confidentiality for everyone who touches the data.
- Deletion or return of all personal data when the service ends, at your direction.
- Information on request to show the processor’s compliance, and cooperation with reasonable assessments.
- Subcontractors engaged only under a written contract that binds them to the same terms.
Two items on that list are engineering work. “Delete or return” needs a real export and a deletion path that reaches backups. The subcontractor clause means you should know who else sees your data before you sign. Enforcement belongs to the Attorney General alone. The office must give 30 days’ written notice and a chance to cure before suing. After that a violation can cost up to $7,500 (sections 541.154 and 541.155).
Two breach clocks for software in Texas
Any custom software in Texas that holds sensitive personal information inherits two deadlines after a breach, and they are not the same length. Under section 521.053, a business that owns or licenses computerised data holding sensitive personal information must tell the affected individuals “without unreasonable delay” and no later than the 60th day after it determines that a breach occurred. A separate subsection puts the Attorney General on a shorter clock: as soon as practicable and no later than the 30th day, if the breach involves at least 250 Texas residents. That notice goes through a form on the Attorney General’s website. It must say what happened, how many residents are affected, what has been done, and whether law enforcement is involved.
The 30-day notice is the one that runs out first. Both start from the day the business determines a breach occurred, which is why the timestamps in an incident log matter more than they seem to. A vendor that holds data it does not own has a duty of its own: it must tell the owner “immediately after discovering the breach.” “Immediately” is hard to measure in a dispute. The contract should turn it into hours and name who is called, because the vendor’s delay eats your 30 days.
The same section adds that if you must notify more than 10,000 people at once, you also have to tell the nationwide consumer reporting agencies.
Texas AI law: what lands on a private company
The Texas Responsible Artificial Intelligence Governance Act has applied since January 1, 2026. Read the enrolled text of H.B. 149 and the headline duties turn out to be narrow for a private buyer. The requirement to tell people they are dealing with an AI system falls on governmental agencies and on health care providers, not on every business. Governmental entities are barred from social scoring, and from using AI to identify people from biometric data without consent where that would infringe their rights.
Three bans that turn on intent
The Act bars building or deploying AI that intentionally aims to push someone toward self-harm, harm to others or crime. It bars doing so with the sole intent to infringe constitutional rights. And it bars doing so with intent to unlawfully discriminate against a protected class, where “a disparate impact is not sufficient by itself” to show intent.
Enforcement and the safe harbour
The Attorney General enforces the Act, and there is no private right of action; a state licensing agency can add its own sanctions only after the Attorney General has won a case and recommends it. Before suing, the office must give written notice and 60 days to cure. An uncured violation costs $10,000 to $12,000 where the court finds it curable, and $80,000 to $200,000 where it does not. Each day it continues adds $2,000 to $40,000. A defendant is not liable where it found the violation itself, through feedback, testing such as red-teaming, state agency guidelines, or an internal review while substantially complying with NIST’s AI Risk Management Framework: Generative AI Profile or a comparable recognised framework.
Since the prohibitions turn on intent, what you write down about an AI feature becomes evidence of it. A one-page purpose note per feature, with a record of the testing it went through, is cheap to keep now and hard to reconstruct later.
Four Texas sectors, four different rules
Custom software in Texas usually arrives attached to a physical operation, whether wells, hospital wards, chip fabs or state offices. Energy, healthcare, semiconductors and work for state agencies each come with a rule that changes what a vendor can build or where it can put things.
| Sector | The rule worth knowing | What it changes in the build |
|---|---|---|
| Energy | The privacy act exempts electric utilities, power generation companies and retail electric providers (section 541.002) | Confirm whether the exemption covers you before you decide how much consent and request handling to build |
| Healthcare | S.B. 1188: from January 1, 2026, covered entities must keep electronic health records physically in the United States or a US territory, including records held by cloud and subcontracted providers. “Covered entity” takes its meaning from the Texas Medical Records Privacy Act, which reaches contractors that handle protected health information | US hosting for primary data, backups and anything that copies records. The text limits access to people who need it for treatment, payment or operations but says nothing about where they sit, so settle how an overseas team connects, in writing and with counsel, before the first login |
| Semiconductors | Under 15 CFR 734.13, sending an item out of the US counts as an export, and releasing technology or source code to a foreign person in the US is a deemed export | Classify what the project touches before anyone outside the US gets repository access; controlled technology may need a licence first |
| Work for state agencies | The state’s TX-RAMP program certifies cloud services that process the data of Texas state agencies | Ask early whether the product will count as one, because certification evidence takes time to collect |
The AI disclosure in healthcare software
S.B. 1188 also requires a practitioner who uses AI for diagnostic purposes to tell patients so, a duty in force since September 1, 2025. If your product gives a clinician AI output, the interface should make that disclosure easy to show.
Central time, written by place name
Houston, Dallas and Austin sit on Central Time, and Ahmedabad is 10.5 hours ahead of Central Daylight Time. India does not change its clocks, so on November 1, 2026, when Texas returns to standard time, the gap grows to 11.5 hours. Our Texas page promises three live hours every working day, 08:00 to 11:00 Central. Until November 1 that is 18:30 to 21:30 in Ahmedabad, and afterwards 19:30 to 22:30. Clocks go forward again on March 14, 2027, and the window moves back to 18:30 to 21:30.
Write the zone into the contract by its place name, such as America/Chicago, rather than “CT” or “CST”. A place name moves with the clock change and a fixed offset does not, and “CST” read literally is wrong all summer. El Paso is the exception inside the state: it keeps Mountain Time, an hour behind Dallas, so for a team there the same window runs 07:00 to 10:00.
Where a team in Ahmedabad fits a Texas project
For custom software in Texas, most of what this post covers is paperwork any vendor can sign. A few rules bear on a remote team in particular. Health records under S.B. 1188 stay on US soil whoever writes the code, and a vendor that handles them may itself be a covered entity. Chip-design and other controlled technology may need an export licence before an engineer abroad sees the repository. And if the work needs people on a plant floor or a hospital ward, we say on the first call whether that rules us out. We contract under Texas law, with the venue your counsel prefers. For the wider trade-off, our post on building in-house against hiring remote sets out when each model suits a company.
Texas taxes a licensed program but not contract programming, so when you buy custom software in Texas, the ownership clause is also a tax decision. Alongside it come a privacy act with a small-business catch, two breach deadlines of different lengths, an AI law in force since January 1, 2026, and a health-records law that decides where patient data may sit. Each one ends up in the contract, the architecture or both.
QalbIT is an engineering team based in Ahmedabad, with no office or staff in Texas. What we do is cover the Central-time morning for Texas companies, and the custom software development on Central time we offer is described on its own page. You can use this post without hiring us. It is not legal or tax advice: each point links the rule it relies on, and your Texas lawyer and tax adviser decide how it applies to you.
Who keeps the rights decides tax on custom software in Texas
The shorthand you will hear is that custom software is exempt and packaged software is taxable. The Comptroller’s rules are not written that way. Rule 3.308 starts from a different sentence: “The sale, lease, or license of a computer program is a sale of tangible personal property.” Tax is due when a program, or a licence to use it, is transferred for consideration in Texas. It is also due when the program is stored, used or consumed in Texas, in electronic form or on physical media.
Contract programming in custom software
The rule defines contract programming as services to create a new program, where the person doing the work did not sell the program and keeps no rights in it. In its own words: “Charges for contract programming are charges for a service and are not taxable.” So the question for a build is less “is it custom?” and more “who holds the rights after delivery?” If your developer assigns all rights to you, the work looks like a service. If the developer keeps rights and licenses the result back to you, it looks like the sale of a program.
Texas software hosting is taxed separately
Hosting does not follow the code. Rule 3.330 treats Internet hosting as a taxable data processing service when the user stores data on the provider’s hardware, and it exempts part of the bill: “Twenty percent of the total amount charged for data processing services is exempted from tax.” Put differently, tax applies to 80% of a data processing charge.