The note was already written before the patient reached the parking lot

A family physician in a Frisco medical office finishes a twenty-minute visit. She never touched the keyboard. By the time the patient is walking back through the lobby, an ambient tool has already drafted the note — history, assessment, plan — and it is waiting for her signature. She reads it, corrects a medication line, and signs.

That moment is now the most legally consequential thirty seconds of the encounter. Not because the software did anything wrong. Because the instant she signed, the record became hers. The vendor is not licensed in Texas. The vendor did not examine the patient. The vendor’s name is not on the chart.

Adoption has moved fast enough that this is no longer a fringe scenario. The American Medical Association’s 2026 Physician Survey on Augmented Intelligence, fielded in early 2026 among 1,692 physicians, found 81% using AI in a professional capacity — up from 66% in 2024 and 38% in 2023. In the same survey, physicians ranked clear liability frameworks as the single most important regulatory action needed to build their trust in these tools.

Texas answered part of that request in 2025. This article walks through what the answer actually says, and where the insurance side of it sits — for practices in Frisco, Plano, McKinney, and Dallas alike.

What follows is general educational information about Texas law and insurance concepts. It is not legal advice, medical advice, or a compliance opinion. Confirm how these requirements apply to your specific practice with your attorney and your compliance advisor.

Section 1: What SB 1188 requires

Senate Bill 1188 passed during the 2025 regular session and took effect September 1, 2025, with its data-storage provision following on January 1, 2026. It is primarily an electronic health records law, and the AI provisions sit inside it. According to the Texas Academy of Family Physicians, the law permits a health care practitioner to use AI for diagnostic purposes provided three conditions hold: the practitioner is acting within the scope of their license or certification, the particular use is not prohibited or restricted by law, and the practitioner reviews any records generated by AI in accordance with standards developed by the Texas Medical Board.

Read that third condition slowly, because it is the load-bearing one. It is not a recommendation to proofread. It is a statutory condition on your authority to use the tool at all. Attorneys reviewing the bill have described the practical effect as requiring that any record, summary, or note produced with AI assistance be reviewed and approved by the physician before it becomes part of the patient’s chart — meaning the statute is written so that AI supports clinical decision-making rather than automating it. Commentators have also noted the AI-review obligation as codified at Texas Health & Safety Code § 183.005, which requires licensed practitioners to review AI-generated diagnostic output and retain final clinical authority.

SB 1188 carries three more provisions worth knowing, because they reach your vendors as much as your clinicians:

• Patient disclosure. When a practitioner uses AI, the practitioner must inform the patient of that use in their diagnosis or course of treatment.
• Data localization. Beginning January 1, 2026, electronic health records containing Texas patient information must be physically maintained within the United States, and this applies regardless of when the record was created. Practices should be asking their EHR and AI vendors directly where data is stored and processed.
• Role-based access. EHR information must be accessible only to individuals whose duties require it for treatment, payment, or health care operations.

The enforcement side is where practice owners should slow down. As reported by the Texas Medical Association, violations of SB 1188 can result in civil penalties ranging from $5,000 to $250,000 per violation, depending on the violator’s intent and whether protected health information was used for financial gain — and regulatory agencies including the Texas Medical Board, the Texas Department of Licensing and Regulation, and the Texas Department of Insurance may take disciplinary action, up to license suspension or revocation, against a covered entity that violates the requirements three or more times in the same manner. Handling protected health information through a new software pathway is precisely the kind of change that deserves a documented decision behind it.

Section 2: What TRAIGA adds on top

House Bill 149 — the Texas Responsible Artificial Intelligence Governance Act — was signed June 22, 2025 and took effect January 1, 2026. Most of TRAIGA is aimed at state agencies and at prohibited AI uses. One provision reaches straight into private practice.

The Texas Attorney General’s office states that if an AI system is used in relation to health care services or treatment, the provider must give a clear and conspicuous disclosure to the recipient of the service or treatment, or the recipient’s personal representative, no later than the date the service or treatment is first provided — and in an emergency, as soon as reasonably possible afterward. The same page confirms that the attorney general has exclusive authority to enforce TRAIGA and may issue civil investigative demands.

Three details in that sentence do a lot of work:

• “In relation to” is broad. It is not limited to a diagnostic algorithm. Firms analyzing the statute have pointed out that the disclosure requirement applies broadly to AI systems used in connection with any health care service or treatment — which increasingly includes back-office and documentation systems, not just clinical decision tools.
• The timing is more forgiving than the agency rule. Where state agencies must disclose before or at the point of interaction, providers have until the date the service is first provided.
• The presentation matters. The disclosure must be clear and conspicuous, must be written so a patient can understand it, and may not use a dark pattern. It may be delivered by hyperlink to a separate web page.

Here is the gap that should get your attention: neither statute supplies a model disclosure. A Texas health care AI firm reviewing both laws observed that because neither SB 1188 nor TRAIGA provides a disclosure model, providers using AI have to build their own standardized compliance strategies, documentation, enforcement, and training practices. The same analysis notes that neither law creates a standalone private right of action for a patient based solely on a failure to disclose — but that disclosure failures may still surface inside informed-consent, professional-negligence, or licensing-board matters.

That distinction is the whole reason this article exists. A missed AI disclosure is not, by itself, a malpractice claim. It is an ingredient. And the proceeding it most naturally produces — an attorney general inquiry or a board complaint — is not what a medical professional liability policy was built to pay for. That is what regulatory defense coverage exists to address, and it is frequently an endorsement rather than a default.

Texas has also already demonstrated that it will act in this space. In September 2024, the Attorney General announced a first-of-its-kind settlement with a Dallas-based health care AI company after an investigation found the company made deceptive claims about the accuracy of its products — software that had been deployed at several Texas hospitals to summarize patient condition and treatment for staff. The company denied wrongdoing and the agreement carried no financial penalty, but the framing from the state was unambiguous: entities deploying AI in high-risk settings are expected to evaluate whether the product is appropriate and to train their people accordingly. Vendor marketing is not a shield.

Section 3: Four assumptions worth retiring

• “My vendor is liable if the note is wrong.” — Reality: Texas built the statute the other direction. The practitioner reviews the record and retains final clinical authority. A vendor agreement may allocate some contractual risk between you and the vendor, but it does not move a licensing obligation, and it does not change who signed the chart. Have counsel read the vendor contract; do not assume it does work it was not drafted to do.
• “AI isn’t mentioned in my policy, so it’s covered.” — Reality: That was closer to true before 2026. Coverage that is neither granted nor excluded — sometimes described as silent AI coverage — is exactly the ambiguity insurers have been moving to resolve, and they have been resolving it by adding exclusions rather than by adding grants.
• “Disclosure is a front-desk formality.” — Reality: It is a statutory duty with an enforcement authority attached, and it is one of the few things in this whole area that is fully within your control today. Practices are documenting who received the disclosure, when, in what form, and what happens when a patient declines — which means having a workable non-AI alternative ready.
• “My malpractice carrier would have told me.” — Reality: Carriers are working through this in real time, and positions vary meaningfully between them. Some professional liability carriers have publicly stated they have no AI exclusion; others have introduced riders that narrow coverage around AI use. Neither posture is universal, and neither is permanent. The only reliable answer is the one written on your own policy.

Section 4: Which policy responds to what

Most coverage confusion here comes from treating “AI risk” as one thing. It is not. An AI tool can generate at least four structurally different claims, and they land in four different places on your coverage tower. The table below is a general educational map of how these coverage parts are typically structured — not a determination of how any particular policy would respond. Only your actual policy language and your carrier can answer that.

That last row is the one practice owners are least likely to have checked. In January 2026, ISO — the organization that publishes the standard forms underpinning much of the U.S. commercial property and casualty market — made three optional generative-AI endorsements available to carriers for commercial general liability policies: CG 40 47, CG 40 48, and CG 35 08. The broadest, CG 40 47 01 26, excludes bodily injury, property damage, and personal and advertising injury arising out of generative artificial intelligence, and it applies to both Coverage A and Coverage B. The definition of generative AI in these forms is written broadly enough to reach systems that produce text, images, audio, video, or code.

Two qualifications matter enormously here, and skipping them is how this topic gets oversold. First, these endorsements are optional. A carrier chooses whether to adopt them, so you cannot assume the exclusion is on your policy — and you cannot assume it is not. Second, the presence of an exclusion is not the end of a coverage analysis; policyholder-side attorneys have already noted that broadly drafted AI exclusions are not necessarily the final word on whether a particular claim is covered. That is a question for coverage counsel on a specific set of facts, not something to resolve from an article.

The practical takeaway is much simpler than the legal one: generative AI exclusions show up as form numbers on your endorsement schedule. You can look. If you see CG 40 47, CG 40 48, or CG 35 08 on the commercial general liability portion of your practice’s business owners policy, that is a conversation to have before your next renewal, not after a claim. And because most professional liability is written on a claims-made basis, the timing of when you adopted the tool and when a claim is reported both matter — which is why the claims-made versus occurrence distinction is worth understanding before you need it. If you are still mapping how the two liability towers relate, our breakdown of malpractice versus general liability for a Texas practice covers that structure, and our guide to when Texas physicians actually need malpractice coverage covers the timing triggers.

One more surface worth naming: AI is moving into hiring, scheduling, and staff management as quickly as it is moving into charting. Employment-related allegations tied to automated tools sit with your employment practices liability coverage, which is a separate form with its own definitions — and TRAIGA separately prohibits deploying AI with the specific intent to discriminate against protected classes.

Section 5: How we approach this at The Agent’s Office®

We are an independent agency in Frisco Station, and we work across a wide range of carriers rather than one. On a practice like yours, that mostly means one thing: we can read all four parts of your tower at once — professional liability, the business owners policy, cyber, and employment practices — and tell you where the seams are, instead of defending a single company’s form.

A fair number of the practices we talk with already have coverage they are reasonably happy with, and are not shopping. That is a perfectly good reason to call. A second set of eyes on an endorsement schedule costs you nothing, and the question we are answering — “has anything been added to my policy that I did not ask for?” — is one you can only answer by looking. If everything is in order, we will tell you that plainly. If we find a generative-AI exclusion sitting on a policy you assumed was untouched, you will know while you still have time to do something about it.

Where we do quote, we are comparing how different carriers are currently treating AI use, which right now varies more than almost anything else on these forms. We cannot promise a particular carrier will offer particular terms, and no agency can — underwriting decisions belong to the carrier. What we can do is put the options side by side and be honest about the trade-offs. For a fuller picture of how these pieces fit together, our Texas medical practice insurance guide maps the full coverage structure, and if your practice handles behavioral health or dental records, our cyber coverage guide for medical and dental practices goes deeper on the data side. If you have watched your professional liability premium move recently, our look at why Texas malpractice premiums rose in 2026 explains what is actually driving it.

The old proverb holds up well here: a prudent person foresees danger and takes precautions. Adopting a tool that reduces your charting burden is good stewardship of your time. Reading what it changed about your obligations and your policies is good stewardship of everything else.