New Enforcement Priorities Reflect Texas AG’s Political and Regulatory Realities

As federal agencies continue to realign regulatory frameworks to carry out the priorities of the current administration, the state attorneys general (AGs) of many states, including Texas, are stepping forward to become more active and visible regulatory enforcers. AGs assert their authority to fill perceived enforcement gaps, but also to signal political alignment or opposition to their federal counterparts on issues such as environmental, social and governance investment, diversity, equity and inclusion corporate programmes and consumer protections.

For businesses, this growing assertiveness is not just a trend – it poses a strategic risk. And for law firms, it’s prompting new investments, evolving capabilities and the creation of dedicated state AG-focused practices. 

Top enforcement priority areas for Texas businesses in 2026

An analysis of 2026 press releases from the Texas AG office, through 20 August, indicates that consumer protection, immigration enforcement, healthcare/Medicaid fraud and data privacy/big tech accountability, represent the most active and recurring enforcement priorities in Texas.

Consumer protection and deceptive trade practices

Consumer protection and deceptive trade practices is the single most active enforcement domain in 2026, encompassing fraud, false advertising and deceptive marketing across industries. The largest settlements include:

• a USD45 million settlement with a payment processor over misleading consumers about platform safety;
• a USD13 million settlement with Walmart over deceptive compensation practices for delivery drivers;
• a USD10 million settlement with GreenSky over a fraudulent loan scheme targeting seniors and disabled Texans; and
• a settlement with a grocery chain relating to secretly misting synthetic pesticides on organic produce.

Immigration enforcement and border security

Immigration enforcement is a consistently recurring theme across the spectrum of documented Texas AG activities, mirroring its high priority at the federal level. The AG’s office vigorously enforces Texas Senate Bill 4 (SB 4), which prohibits local jurisdictions from limiting the enforcement of federal immigration laws. Specific actions by the AG include:

• suing Houston city officials for allegedly limiting local law enforcement co-operation with US Immigration and Customs Enforcement officials;
• defending SB 4 before the US Court of Appeals for the Fifth Circuit;
• suing Bexar County and Harris County to stop using taxpayer funds to defend individuals in deportation proceedings;
• securing a USD68 million settlement against the developers of Colony Ridge for allegedly harbouring undocumented aliens; and
• investigating multiple school districts for facilitating student protests against immigration enforcement.

The AG also withdrew a 2001 legal opinion that permitted non-citizens to obtain occupational licences without a social security number and took legal action against nearly 30 businesses suspected of H-1B visa fraud.

Healthcare Fraud and Medicaid Enforcement

Healthcare fraud enforcement is one of the few areas of enforcement that is a priority for most states and at the federal level, with the recently launched National Fraud Enforcement Division of the US Department of Justice (DOJ) identifying it as a key focus area. In Texas, the AG’s office has added the regulation of gender medicine in addition to targeting fraud, waste and abuse. Specific activities in this area include:

• a nearly USD34 million settlement with a biopharmaceutical company for an illegal kickback scheme influencing Medicaid prescriptions;
• a USD10 million settlement with Texas Children’s Hospital for billing Texas Medicaid for alleged illegal gender-transition interventions using false diagnosis codes;
• lawsuits filed against a dental network for allegedly defrauding Texas Medicaid through an illegal kickback scheme and against dental providers for allegedly performing medically unnecessary procedures and bribing Medicaid patients;
• a lawsuit filed against another biopharmaceutical and healthcare company for allegedly providing illegal kickbacks to doctors; and
• a lawsuit filed against Children’s Health System of Texas for allegedly performing illegal gender transition procedures and engaging in Medicaid fraud.

Data privacy and big tech accountability

The ramp-up of enforcement related to data privacy affects key business obligations including opt-out rights, data minimisation and vendor contract requirements. The AG is also keen to bring privacy enforcement actions against major technology companies, such as:

• a USD150 million multistate settlement against 23andMe over a 2023 data breach exposing the genetic data of 6.9 million people;
• settlements with two major consumer electronics companies to stop unauthorised collection of smart TV viewing data via automated content recognition technology without consent;
• a lawsuit against a streaming service for allegedly collecting user data without consent, including children’s data;
• a lawsuit against Meta and WhatsApp for allegedly lying about encryption and privacy protections; and
• an investigation into Meta AI Glasses over alleged unlawful collection of facial geometry and private data.

Fragmented enforcement: a challenge and an opportunity

Texas is not an outlier in the level of enforcement activity – New York and California are just as busy, but under different political agendas. With state AGs increasingly taking the lead on enforcement reflecting their political priorities, law firms supporting AGs should be prepared to align with those priorities if they want to build strong AG practices. 

For the corporate clients in Texas, firms should take seriously any potential issues related to the AG’s demonstrated priorities – consumer fraud, immigration, healthcare fraud and data privacy. AG law practices should take an interdisciplinary approach to help companies respond to state-level enforcement activity – spotting emerging risk areas based on enforcement data, anticipating where their clients’ business models may come under scrutiny, and helping ensure controls are in place to mitigate issues before they arise.

The star witness: data in high-stakes investigations

When a battery energy storage facility catches fire, a product malfunctions or there is a significant data centre outage, finding the root cause takes priority. But for companies operating Texas’s vast energy, manufacturing and data centre infrastructure, the consequences can extend far beyond operational disruption. Once the organisation uncovers what happened, attention quickly shifts to liability. 

Whether prompted by litigation, regulatory scrutiny, operational disruptions or internal concerns, investigations are no longer confined to interviews and paper records. Instead, modern investigations have a star witness: data.

Investigators increasingly look beyond the incident itself, and examine data from across the organisation to identify broader patterns and determine whether warning signs existed before the event occurred. Regulators, plaintiffs’ attorneys, corporations and insurers are often less focused on the isolated failure and more on whether it reflected a systemic issue.

Rarely are all relevant facts contained within a single system. Instead, evidence is often scattered across IoT sensors, video surveillance systems, enterprise resource planning platforms, and maintenance and control logs. Each source may offer a different, sometimes conflicting, view of events. Variations in system and real-world timestamps, data gaps, inconsistencies and disconnected systems can make it difficult to reconstruct an accurate and defensible timeline.

Before organisations can defend their decisions, establish causation or build a legal strategy, they must first justify their timeline. Modern litigation increasingly focuses not just on what happened, but on whether an organisation’s reconstruction of events is credible, making forensic data analytics essential to establishing a defensible sequence of facts.

As a result, forensic data analysis and the tools associated with it have shifted from a back-office support function to a frontline tool used in legal and regulatory cases. Data also empowers industrial and energy companies to adopt a more proactive risk management posture by improving controls and monitoring capabilities.

When a company is the subject of a multidistrict product liability investigation, or when a manufacturer is preparing a causation analysis after a major incident at its facility, it will likely face three main challenges.

• Establishing a defensible version of the truth.
1. Critical data is often distributed across many systems with disparate owners, retention practices and levels of operational context. When a crisis occurs, the ability to distinguish signal from noise and reconcile competing records is crucial.
2. Even a slight discrepancy between operational, video and safety-system data can raise red flags in litigation and regulatory events. Organisations must synchronise data from all sources to develop a reliable sequence of events.
• Keeping pace with data-driven scrutiny.
1. Enforcement agencies and multidistrict litigation courts are increasingly demanding broader, more complex datasets that enable deeper analysis of trends, patterns and outcomes rather than relying on a single point-in-time view.
2. To meet these new data demands, companies and counsel must create repeatable, auditable methodologies to produce data at scale while preserving the data’s evidentiary integrity.
• Aligning legal strategy with technical reality.
1. Investigative outcomes often depend on effective collaboration between counsel and data specialists. Legal teams need to understand what the data can and cannot establish, while technical teams need sufficient context to focus their analysis on the questions that matter. Bridging that gap helps ensure findings are interpreted correctly, limitations are understood and conclusions can withstand scrutiny. As data increasingly forms the foundation of investigative and regulatory responses, organisations must be able to establish, explain and defend how the facts were derived.

To strengthen data and analytics capabilities for timeline reconstruction and litigation support, organisations should approach crisis preparedness through three phases: before, during, and after an operational event.

Before: 

• understand what critical data may be needed during an incident and where it resides across operational systems;
• document who owns each data source, what the data represents, how frequently it is refreshed, and how long it should be retained; and
• understand where data may be vulnerable to overwrite, loss or limited historical retention, so preservation requirements can be established in advance.

During:

• quickly secure potentially relevant data across operational, safety, video, maintenance and communication systems; and
• preserve data broadly and early, particularly where systems overwrite or refresh historical data; never assume one source tells the full story. Compare and reconcile data across systems, investigate discrepancies, and document how conclusions are reached.

After and ongoing:

• establish a repeatable, documented methodology for integrating, validating, reconciling and analysing data across disparate systems;
• capture lessons learned from each incident, including data gaps, ownership issues, preservation challenges and inconsistencies that complicated the response; and
• build those lessons into crisis response protocols and documentation so the organisation can produce reliable, defensible data more quickly and consistently if/when future events occur.

In an environment in which every system generates evidence, organisations that can establish a defensible timeline will be best positioned to control the narrative, demonstrate causation and withstand scrutiny. The continued investment in data governance, data management and incident response readiness can establish instant credibility with regulators and plaintiffs’ counsel when a crisis occurs.

Energy sector strategies for a changed world

The Texas oil, gas and petrochemical sectors are navigating an unprecedented convergence of legal, regulatory and commercial pressures driven by geopolitical disruption, shifting trade policy and changes in global energy markets. These pressures include shipping disruptions in Middle Eastern straits that affect the flow of crude, refined products, liquefied natural gas (LNG) and chemicals; evolving tariffs and trade policies; the impact of the ongoing Russia-Ukraine conflict on the European and Asian LNG markets; and changing Venezuelan crude flows. These disruptions are not only forcing producers to rethink sourcing, supply chains and commercial relationships, but also require counsel to prepare for litigation and regulatory risks that stem from an increasingly complex landscape.

Force majeure and contractual risk

At the forefront of legal concern is the growing use of force majeure and other contract defences to delay or excuse performance. Disruptions across oil, gas and chemical supply chains have led companies to declare force majeure and have increased the risk of arbitration and litigation for Texas businesses. At the same time, changing market conditions are enhancing the risk associated with key contract terms, including take-or-pay obligations, minimum volume commitments, pricing formulas and freight costs, that may diverge from the original contract assumptions. Finally, counterparty financial distress and restructuring activity are introducing insolvency and contract termination risk for Texas-based supply chain participants. 

Sanctions and regulatory pressures

Sanctions compliance and evolving US trade policy create additional risks for Texas businesses, especially for Gulf Coast refiners handling Venezuelan crude. Recent announcements have created opportunities but also require companies to stay compliant and structure contracts according to the changing guidance.

Changes in US LNG trade are also creating new commercial issues. As European and Asian buyers compete for LNG and regional prices change, disputes may arise over where cargoes can be sent, whether they can be redirected, and how contract prices are calculated. Companies that modify facilities to handle different feedstocks may also face new permitting requirements from the Texas Commission on Environmental Quality, the Railroad Commission of Texas, and the US Environmental Protection Agency.

Rethinking the traditional model

Current disruptions to the energy supply chain have shifted the conversation, prompting producers to rethink traditional models. 

• Efficiency is no longer the number one priority: Historically, supply chains were built around the lowest-cost feedstocks, world-scale plants, high utilisation and global trade. This approach concentrated production, feedstock sourcing and logistics around a relatively small number of regions to achieve the lowest landed cost.
• Capacity depends on supply reliability: Having production capacity is of little value if raw materials cannot reach the plant or finished products cannot reach customers. Reliable access to feedstock, transportation and end markets is important.
• The economics of resilience are changing: Geopolitics, trade policy, sanctions, energy security and logistics constraints are forcing producers to re-evaluate the traditional model. Producers increasingly recognise that the cost of shutting down a plant because feedstock is unavailable can outweigh the incremental cost of maintaining alternative supply. 

Winning strategies for producers

As producers consider how to reorganise their operations to cope with current and unpredictable challenges in the energy sector, counsel should prepare for different needs from their clients related to the following strategies. 

• Diversifying the feedstock: Beyond diversifying feedstock suppliers, producers are diversifying feedstock itself. For example, flexible ethylene crackers are increasingly designed to process a range of feedstocks. 
• Building asset resilience: Producers are increasingly looking not just at having multiple feedstock capabilities, but also at feedstock blending, intermediate storage, turndown capacity and the ability to redirect intermediates. 
• Diversifying the route: Having multiple suppliers offers limited backup if they all depend on the same port, pipeline or canal. Companies are focusing on points of failure by considering alternative ports, pipelines, Atlantic versus Pacific sourcing, and rail or truck alternatives if practical.  
• Inventory as insurance: Traditionally, inventory was minimised in order to reduce working capital. Today, an optimised inventory buffers against supply chain disruptions. The challenge is balancing the carrying cost of inventory against the potentially much greater cost of production interruptions. 
• Commercial flexibility: A producer can only be as flexible as its contracts allow. Contracts can either enable you or constrain you. Companies therefore need to carefully consider single versus multiple suppliers, minimum purchase obligations, take-or-pay provisions, force majeure provisions, price indices, freight provisions and other contractual terms that can either provide or restrict flexibility during a disruption. 
• Supply chain speed and intelligence: Producers need to identify disruptions early and make decisions quickly, which requires supply chain modelling. Optionality does not matter if you cannot act quickly.
• Stress-test the network: Producers can use what-if analysis to stress test the supply network, identify vulnerabilities before a disruption occurs, and evaluate the potential economic consequences. Molecules should be mapped from feedstock through intermediate products to the ultimate customer to identify dependencies, chokepoints and alternative pathways. 
• Selective regionalisation: Producers can maintain the cost advantage of global trade while establishing regional supply alternatives. 

Each of these strategies addresses part of the challenges that operators need to navigate, but new solutions also introduce novel risks. As operators take steps to respond to a changing world, counsel should be ready to proactively help manage the new risks these strategies introduce.

Managing investigative risk in Texas’ data centre boom

The explosive growth of data centre development in Texas is creating a complex risk environment for owners, developers, contractors, investors and their counsel. These multibillion-dollar capital projects are highly complex and routinely face cost escalation, schedule delays and change orders throughout the project lifecycle. This makes risk management especially challenging. 

Data centre projects operate under fundamentally different conditions to traditional construction projects. Designs evolve during construction. Critical equipment is often procured before designs are complete, and project success depends on energising capacity as quickly as possible across multiple facilities.

In this environment, change, cost growth and schedule pressure are expected realities rather than signs of dysfunction. Assessing whether an event is truly anomalous therefore requires a clear understanding of how data centre programmes are delivered and managed. Data centres have become an increasingly attractive asset class, drawing significant investor interest and new market entrants. Intense competition for the land and resources needed to develop data centres compresses timelines and weakens traditional diligence, increasing counterparty risk.

Texas’s energy infrastructure and pro-business environment have attracted substantial data centre investment. At the same time, rising demand is driving parallel investment in power generation and transmission. These interconnected programmes create overlapping dependencies, stakeholders and schedules, increasing execution risk and complicating oversight.

Cost overruns, schedule delays and other challenges do not always indicate misconduct. Determining whether issues stem from project complexity, weak controls or other factors requires further investigation and is essential for effective risk management and dispute resolution.

The intersection of project risk and investigative risk

In massive Texas data centre projects, failure and misconduct can look similar. Distinguishing between them is now one of counsel’s most critical risk management challenges.

Data centre initiatives face enormous pressure to deliver and scale quickly, increasing execution risk and potentially concealing signs of misconduct. The difference between a project failure and improper conduct can be difficult to understand.

Investigations must begin before ground is broken. Reputational, legal, regulatory and financial risks associated with joint venture partners, local lobbyists, general contractors and suppliers cannot be overlooked. 

Investigations should be guided by facts and the project environment, rather than assumptions of misconduct. For example, an inquiry into unexpected cost growth may focus on change orders and contractor billing, but analysis could reveal that design changes, scope expansion or inadequate controls are the primary causes.

Pairing forensic accountants and investigators with construction and capital project professionals who have delivered similar programmes and know what the records should look like is critical. Without this combined expertise, it is harder to identify and address the true source of risk.

Where red flags often emerge

Recognising key risk areas in large construction projects can help identify and address issues before they escalate. The following are common intersections of project and investigative risk.

• Lack of pre-investment diligence: Extreme competition for land and real estate in pro-data centre jurisdictions can undermine proper investigation and diligence. Investment attractiveness is drawing both fraudsters and legitimate investors. Proper investigative diligence before a project starts can save millions of dollars, avoid sunk costs and mitigate long-term reputational risk. 
• Failure to know your neighbours: Stakeholder mapping and regulatory risk evaluation are key to anticipating community risks and preparing an engagement plan to ensure project success, particularly as community agitation around data centre projects grows, compounded by rising costs of living. 
• Contractor and subcontractor billing: Large projects often involve multiple tiers of contractors, subcontractors, suppliers and vendors. Complex billing can hide duplicate charges, unsupported costs, unusual markups and other irregularities until costs escalate.
• Schedule and progress reporting: Pressure to bring capacity online quickly can create challenges around energisation, commissioning and project delivery. Discrepancies between reported and actual performance are critical in disputes or investigations.
• Procurement and supply-chain pressure: The need for specialised materials and skilled labour can force expedited procurement decisions. When normal procurement processes are compressed or bypassed, new risks can arise.

These conditions may signal typical project challenges or potential misconduct. Effective investigations must distinguish between them. Project irregularities are inevitable, but early and ongoing investigative involvement enables both outside and in-house counsel to respond more effectively.

Distinguishing commercial challenges from misconduct risks

Here are some key considerations for counsel when anomalies are detected or potential misconduct surfaces:

• determine whether the anomalies have legitimate project explanations;
• identify and preserve relevant project records and data;
• reconstruct key decisions and transactions to clarify the sequence of events accurately;
• analyse patterns across contracts, schedules, invoices, change orders and field records such as daily reports, manpower logs and equipment tickets;
• assess whether issues are isolated or systemic; and
• determine whether the matter should remain a commercial/project dispute or requires a broader investigative response.

While data centre expansion will continue, the distinction between execution challenges and misconduct will continue to blur. The most effective counsel approach is to establish the facts to understand which risks require remediation, dispute resolution or a broader investigative response. Reaching the right conclusion requires a disciplined, fact-based assessment that pairs investigative tools with a working understanding of how projects are contracted and delivered. 

The views expressed herein are those of the author and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates, or its other professionals.