Insights · Perspective
Insights · Perspective
I get two questions more than any others right now. From founders: "Do I need to care about tokenization yet?" From operators: "What exactly do I have to do about AI?" For most of the last few years the honest answer to both was "not much, and nobody knows." That changed in 2026. The tokenized dollar and the tokenized share now have federal rules, or at least federal permission. Artificial intelligence has a Texas statute that has applied to anyone doing business here since January 1, while Washington spent the year arguing about whether states should be allowed to write one. So the answers have changed. Yes, you need to care. And the list of what to do is short enough to fit on a page, which is what the second half of this article is.
Start with money, because that is where it touches everyone. The GENIUS Act, signed July 18, 2025, created a federal license for issuers of payment stablecoins — dollar tokens redeemable one-for-one and backed by cash and short Treasuries. The Comptroller of the Currency finished its rule on October 21 of this year, and the whole regime takes effect January 18, 2027. After that date it is unlawful to issue a payment stablecoin in this country unless you are an approved issuer; state-chartered issuers can stay under state supervision only while they are under $10 billion outstanding. I don't expect many readers to issue a stablecoin. I do expect most of you to be offered one by your bank or payment processor within the year, because a dollar that settles in seconds, at 2 a.m. on a Sunday, on a ledger your auditor can read, is about to be an ordinary regulated product instead of a science project. The question for you is price and plumbing, and I'll come back to it.
Then securities, where Congress didn't finish and the agencies went ahead anyway. The House passed the market-structure bill (the CLARITY Act) 294 to 134 in July 2025. On September 15 of this year the Senate voted 49 to 50 on the motion to even begin debating it, eleven votes short of the sixty it needed, and with that the bill is dead for this Congress. A month earlier, on August 18, the Securities and Exchange Commission had proposed a rule it calls Regulation Crypto Assets. As the proposing release describes it, a project could launch a token under a one-time $5 million exemption spread over four years, or raise up to $20 million a year with unaudited financials or $75 million a year with audited ones, each with plain-language disclosure and bad-actor rules borrowed from Regulation A; and a token could stop being a security altogether by filing a form (Form TR) certifying that the issuer has finished whatever it promised to build. The proposal would also preempt state blue-sky registration for those offerings. What it would not do is change the status of a tokenized share, note, or fund interest. Those are securities, and the proposal leaves them where they are. Then on September 17 the Commission issued what it calls an innovation exemption (Release No. 34-106402): for five years, tokenized versions of exchange-listed stock may trade on-chain on "tokenized securities venues," subject to volume caps, smart contracts published on public ledgers, trading halts that follow the primary market, and a thirty-day window for the issuer to say no to anyone tokenizing its stock without permission.
The exchanges got there first, quietly. The Depository Trust Company received staff no-action relief on December 11, 2025 to tokenize securities entitlements after settlement, starting with Russell 1000 stocks and index ETFs. On March 18, 2026 the SEC approved Nasdaq's rule for it: you buy the share the normal way, it settles T+1 the normal way, and then, if you checked a box when you placed the order, a token with the same CUSIP, the same symbol, and the same rights shows up in the wallet you named. On April 29, NYSE Texas, the exchange headquartered in Dallas, filed the same rule, effective on filing. Meanwhile the money kept arriving: tokenized Treasury funds passed $15 billion by late summer, BlackRock's alone is close to $3 billion, tokenized private credit is around $12 billion, and the total value of real-world assets on public ledgers, not counting stablecoins, roughly tripled in a year to somewhere between thirty and fifty billion dollars depending on who is counting and when. Small against the markets they shadow. Not small for something that had no legal home eighteen months ago.
| Group | Value |
|---|---|
| Tokenized U.S. Treasuries | $15B |
| Private credit | $12B |
| Commodities (mostly gold) | $6.5B |
| Listed equities | $2.3B |
| Real estate | $1B |
Figures are rounded tracker estimates and differ by several billion dollars between data providers; the total has since grown.
Source: Stobox, “RWA Tokenization 2026” (Aug. 19, 2026), compiling RWA.xyz and other trackers; Coin-Turk (Aug. 31, 2026) for Treasuries.
If you do business in Texas, or sell a product Texans use, or build or run an AI system here, the law that governs you is House Bill 149, the Texas Responsible Artificial Intelligence Governance Act, now Chapters 551 through 554 of the Business and Commerce Code. It took effect January 1. I have read a lot of commentary calling it weak. I'd call it narrow on purpose, and the narrowness is good news for a business that is trying to behave. It bans specific things: AI meant to encourage self-harm or crime, AI built for the sole purpose of violating constitutional rights, AI used with the intent to discriminate against a protected class, and AI built to make sexual deepfakes or abuse material. It adopts an intent standard for discrimination, and the statute says in so many words that disparate impact by itself is not enough. It requires disclosure of AI use by government agencies and by health care providers at the point of service; the general duty for private businesses to tell consumers they are talking to a machine was taken out before passage. It wipes out city and county AI ordinances. Only the Attorney General can enforce it, nobody can sue you privately under it, and every notice of violation comes with sixty days to fix the problem. The penalties are not trivial: $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable one, and $2,000 to $40,000 a day while a violation continues. But the defenses are generous. If you found the problem yourself, through red-team testing or an internal review while substantially following the NIST AI Risk Management Framework, you have a defense. The Act can't be enforced against a system you haven't deployed. There is a 36-month sandbox at the Department of Information Resources. And as of the first of this month there was no publicly reported enforcement action under it at all; the Attorney General's complaint portal has been live since September 1, and investigative demands aren't announced, so read that as quiet rather than idle.
Washington went the other way. An executive order on December 11, 2025 declared a national policy of light-touch AI regulation and sent the Justice Department after state AI laws; the AI Litigation Task Force stood up January 9, and its first visible move was to back a lawsuit against Colorado's 2024 AI Act. Colorado's Attorney General agreed to a stay of that law in April, and on May 14 the state repealed it and passed a narrower disclosure-and-rights statute for automated decision-making that starts January 1, 2027. No federal preemption law has passed; the Senate stripped a ten-year moratorium on state AI laws out of last year's budget bill 99 to 1, and the national framework the White House published in March is a recommendation to Congress, nothing more. Across the Atlantic, the European Union postponed the AI Act's heaviest obligations, the high-risk rules, from August 2026 to December 2027 in a regulation that took effect July 27; its transparency and general-purpose-model rules are already in force. Put it together and a Texas company has one real rule close to home, a federal government unlikely to add to it soon, and export markets that have pushed their hardest requirements out but not away.
One more Texas fact, and it tells you more about the climate than the statute does. On October 23 the Attorney General sued OpenAI in Collin County. Not under the AI Act. By the press accounts and the office's own description, the case is brought under the Deceptive Trade Practices Act and the state's children's online safety law, and it asks for an injunction that would keep minors off the product and put outside reviewers between the company and its next model. That is the Texas pattern in one sentence: light on AI rules, heavy on consumer harm. If your AI touches consumers, plan for the DTPA before you plan for Chapter 552.
| Track | Date | Event |
|---|---|---|
| Tokenization rails | Dec. 11, 2025 | SEC staff no-action relief lets DTC tokenize securities entitlements post-trade |
| Tokenization rails | Mar. 18, 2026 | SEC approves Nasdaq rule to deliver listed shares in tokenized form (Release 34-105047) |
| Tokenization rails | Apr. 29, 2026 | NYSE Texas files SR-NYSETEX-2026-13, effective on filing |
| Tokenization rails | Aug. 18, 2026 | SEC proposes Regulation Crypto Assets: $5M start-up, $20M/$75M tiers, Form TR safe harbor |
| Tokenization rails | Sept. 15, 2026 | Senate rejects cloture on the market-structure bill, 11 short of 60 |
| Tokenization rails | Sept. 17, 2026 | SEC five-year exemption for on-chain trading of tokenized listed stock (Release 34-106402) |
| Tokenization rails | Oct. 21, 2026 | OCC finalizes its GENIUS Act rule for payment stablecoin issuers |
| Tokenization rails | Jan. 18, 2027 | GENIUS Act takes full effect; only permitted issuers may issue payment stablecoins |
| AI rules | Dec. 11, 2025 | Executive order directs DOJ to challenge state AI laws |
| AI rules | Jan. 1, 2026 | Texas Responsible Artificial Intelligence Governance Act (HB 149) takes effect |
| AI rules | Jan. 9, 2026 | Justice Department forms the AI Litigation Task Force |
| AI rules | May 14, 2026 | Colorado SB 26-189 repeals the 2024 AI Act; ADMT disclosure law effective Jan. 1, 2027 |
| AI rules | July 27, 2026 | EU Digital Omnibus in force; Annex III high-risk obligations deferred to Dec. 2, 2027 |
| AI rules | Sept. 1, 2026 | Texas Attorney General's AI complaint mechanism live |
| AI rules | Oct. 23, 2026 | Attorney General sues OpenAI in Collin County under consumer-protection law |
| AI rules | Jan. 1, 2027 | Colorado's automated-decision-making disclosure law takes effect |
The EU's high-risk AI obligations now apply from December 2, 2027, beyond the right edge of this chart.
Sources: SEC, OCC, Federal Register, Texas Legislature Online, Office of the Texas Attorney General, Colorado General Assembly, Official Journal of the EU; see the article's source list.
In October I made the case for forming a company in Texas rather than Delaware: a Business Court that writes opinions, the 2025 statutes that codified the business judgment rule and let a company set an ownership threshold for derivative suits, no state income tax, and a stock exchange in Dallas that began listing companies this fall. Tokenization and AI strengthen that case rather than complicate it. On digital assets, Texas got there early and then mostly got out of the way. The Department of Banking told exchangers in 2014 that converting crypto to dollars is money transmission, said the same of stablecoins in 2019, and let state-chartered banks custody digital assets in June 2021. The Legislature wrote a Virtual Currency Act into the Uniform Commercial Code in 2021, so a lender can perfect a security interest in a token by filing or by control — and should insist on control, because a later buyer who takes control can cut in front of a lender who only filed. In June 2025 the state created a Strategic Bitcoin Reserve under the Comptroller, bought its first $5 million of bitcoin in November, and put out a request for custodians in May. NYSE Texas, which can now deliver listed shares in tokenized form, and the Texas Stock Exchange are both in Dallas, a short drive from most of the people reading this. On AI, the intent standard, the cure period, the framework defense, and the preemption of local ordinances add up to the most predictable compliance environment any big state has offered. Predictable enough that the compliance work is mostly documentation, which a well-run company should be producing anyway.
The energy side of my practice sees this from the other direction. The data centers that train and run these models, and the facilities that secure these ledgers, are electricity projects before they are anything else, and in Texas the land, title, power, and permitting questions they raise are the ones a Permian operator or a Smackover lithium developer brings me every week. That is not this article's subject. It is the reason a firm built around energy and critical minerals is writing about tokens and models at all: in this state they are one economy.
A token is a wrapper. It is a transferable entry on a shared ledger that points to a legal right — a share, a fund interest, a note, a royalty, a dollar on deposit — and the right is defined by documents that have nothing to do with the ledger: the company agreement, the subscription agreement, the indenture, the deed. Everything that was true of the right stays true when you tokenize it. If it is a security, it is a security on-chain; the SEC's August proposal says exactly that. If the documents restrict transfers, the smart contract has to enforce the same restrictions, or the two will drift apart and you will find out in someone else's due diligence. What tokenization changes is not the law of the asset but the cost of moving it. Settlement in seconds instead of days. A transfer ledger that reconciles itself. Collateral you can post at midnight. Fund interests that change hands without a transfer agent's week. For a private company the near-term uses are modest and real: a cap table or fund register kept on a permissioned ledger, taking or making payment in regulated stablecoins once the GENIUS regime is live in January, parking operating cash in a tokenized government money market fund, and, for sponsors, a fund or real-estate interest sold under Regulation D whose transfers are automated inside the restrictions the offering documents already impose.
AI is a wrapper too, but around a decision rather than an asset. Every place you have put a model — screening résumés, pricing a policy, approving credit, drafting a contract, answering a customer, reading a title runsheet — you have delegated a decision that the law still attributes to you. The Texas Act doesn't change who is responsible. What it does is tell you the questions the Attorney General's office will ask when something goes wrong: What was this system supposed to do? What did you know about how it behaved? Did you have a framework, and were you following it? Could a person have stepped in, and did one? Who was told, and when? If you can answer those from a file, you cure in sixty days and move on. If you have to answer them from memory, you will be building the file under a civil investigative demand, which is a bad time to start.
Three decisions are in front of you whether you make them on purpose or not. First, is your ownership record built so it could be tokenized later? That costs nothing extra. It means keeping the capitalization ledger, the consents, and the signed instruments in a form a transfer agent or a tokenization platform could take in without reconstruction — which is just a clean record, and it is what Windward Charts is for. Reconstructing one later costs a great deal, and I have watched it cost deals. Second, does a token belong in your business at all? Sometimes it does: a loyalty asset, a network incentive, a governance right. If so, the proposed Regulation Crypto Assets is the path to watch. The $5 million start-up exemption and the $20 million tier were written for exactly that launch, with disclosure, bad-actor rules, and a defined exit from securities status, and a company that structures with those rules in view now won't have to restructure if they are adopted. If the honest answer is that the token is a way to raise money from the public without calling it a security, the answer has not changed since the last cycle, and neither has the enforcement. Third, your AI posture, which is cheap to get right at the start and expensive to retrofit: a one-page use policy, a list of the models in the product and in the back office, vendor terms that forbid training on your data and your customers' data, and a human signature on any decision that touches a person's money, job, housing, health, or legal rights. Investors have started asking for all four in diligence. The Texas Act rewards you for having them.
An operating company with payroll, revenue, and counterparties has a different list, and it is longer because you have more surface area. Treasury first: by the end of January a payment stablecoin will be a licensed product, so ask your bank and your processor what they will offer, what it costs against wire and ACH, and how it settles, and decide whether your receivables, your vendor payments, or your cross-border flows benefit. Second, collateral and liquidity: if you borrow against financial assets, or you are a sponsor whose investors would value a way out, the tokenized-fund and tokenized-Treasury markets are now big enough and regulated enough to be worth a conversation with your lender and your administrator, and the Texas UCC already tells a lender how to take the collateral. Third, the AI inventory, which almost every company over fifty people needs and almost none has: every system in the business that makes or shapes a consequential decision, who owns it, what data it sees, what the vendor's contract says about that data, and whether a human reviews the output. Fourth, the contracts you already signed. The SaaS terms, the API agreements, the recruiting and staffing tools — most of them now carry AI clauses that were not there two years ago, and those clauses allocate training rights, output ownership, and liability in the vendor's favor by default. Fifth, if you are in health care, the point-of-service disclosure duty applies to you today; if you sell to government, the agency's disclosure duty flows down into your contract. Sixth, the board: one real briefing and a standing line in the risk report, because the business judgment rule Texas codified last year protects an informed decision, not an absent one.
For AI, the program that satisfies the Texas Act, positions you for Colorado and Europe, and would survive a plaintiff's lawyer is not exotic. Keep an inventory with an owner for each system. Write a policy that names the uses the statute prohibits and the uses you have decided to prohibit for your own reasons. Map the program to the NIST AI Risk Management Framework, not because the framework is law but because substantial compliance with it is the statutory defense when your own testing finds a problem. Test before you deploy and periodically after, and keep the results; remember the Act can't reach a system you haven't deployed, and it protects the company that caught the issue itself. Put a human with real authority between the model and any decision about a person's employment, credit, housing, insurance, health care, or legal status, and document that the human can and does override it. Fix the vendor contracts: no training on your data, clear ownership of outputs, a right to audit, security and breach terms that match your own obligations, and an indemnity that covers the model's mistakes and not just the vendor's uptime. Write the sixty-day cure plan before you need it — who receives the notice, who investigates, who decides, who talks to the Attorney General's office. And treat the consumer-protection laws as the main exposure, because that is where Texas has actually sued.
For tokenization, the safeguards are old disciplines applied to a new record format. Do the securities and commodities analysis before the engineering, and write it down; that memorandum is the thing that survives a regulatory inquiry. Make the smart contract and the legal documents say the same thing about who may hold, transfer, and vote, and say which one wins if they ever differ. Decide who holds the keys, under what controls, with what insurance and what recovery process, because custody failure is the one mistake the law does not forgive. If dollars move on-chain, understand that the sanctions and anti-money-laundering duties of the GENIUS regime sit with the issuer and flow through to the platform, and know what your platform is doing about them. Reconcile the ledger to the cap table and the cap table to the signed instruments, which is the discipline the certified record was built around in the first place. Confirm the tax treatment of every token movement, including the ones that feel like housekeeping. And if you offer a token to investors, use the exemption that fits — Regulation D today, the Regulation Crypto Assets tiers if and when they are adopted — not the one that is convenient.
The Census Bureau's business survey put AI use at 19.8 percent of all U.S. businesses in the period ending May 3, 2026, 37 percent of businesses with 250 or more employees, roughly 40 percent in the information sector and 34 percent in finance and insurance, and under 20 percent for the smallest firms, where it has not moved.
| Group | Value |
|---|---|
| All U.S. businesses | 19.8% |
| 250 or more employees | 37% |
| 100 to 249 employees | 32% |
| Information sector | 39.7% |
| Finance & insurance | 33.9% |
| Retail trade | 14% |
Source: U.S. Census Bureau, Business Trends and Outlook Survey, “Large Firms With at Least 20 Employees Biggest AI Users” (May 2026). Retail figure is approximate as published.
Read that as a market structure rather than a technology statistic. The large companies and the information-heavy ones have already folded the technology into their cost base. Their prices, their turnaround times, and the diligence requests they send counterparties now assume it. Compete with them without it and you are running a higher cost structure against a lower one, and the gap compounds every quarter. The ledger works the same way: when the other side can settle in seconds and post collateral at midnight, a company that needs three days and a wire cutoff is paying for the difference in working capital whether or not it shows up on an invoice. I wrote last month that the law firms which adapt will show it in their price lists before they show it in their survival. That was not a point about law firms. It applies to every professional-services business, every sponsor, and most operating companies I know. The unusual thing about 2026 is that the regulators did their part: the rails are legal and the Texas rulebook is short. What is left is a management decision, and the companies that make it in 2027 will be making it from behind.
The frontier I described in September was organizational — a company whose legal and financial record is kept as infrastructure rather than rebuilt as an event. Tokenization is what that record looks like when it becomes transferable. AI is what keeping it costs when the assembly is automated and the judgment is not. Texas has written the rules for both in a way that favors the company that keeps its records, tests its systems, and tells the truth about what they do. For a well-run business that is a low bar. It is also, now, the price of admission.
Scott Beckmen is the Managing Partner of Windward Counsel, PC, a business law firm in Flower Mound, Texas. This article is the author's perspective and general information as of its date, not legal, tax, or investment advice about any company, token, or system; several of the federal rules described are proposals or temporary exemptions that may change before or after adoption. Attorney advertising. Not certified by the Texas Board of Legal Specialization.
Securities and commodities analysis, structure options, and an issuance plan before the engineering starts.
from $7,500 · estimateTraining rights, output ownership, audit, security and indemnity terms in the contracts you have already signed.
from $750 per agreement · estimateAn AI inventory, use policy and NIST-mapped program, maintained monthly alongside the rest of your legal work.
from $3,500 per month · estimateEvery package above is a fixed fee quoted before work begins — build your estimate.
Yes, if the business does business in Texas, offers a product or service Texans use, or develops or deploys an AI system in Texas, wherever it is headquartered. The Act's prohibitions apply to everyone; its disclosure duties apply to government agencies and health care providers. Enforcement is by the Attorney General only, with a sixty-day cure period and no private right of action.
No. The SEC's August 2026 proposal covers crypto assets that are not themselves securities and leaves tokenized securities under the existing rules, and the September 2026 innovation exemption requires tokenized listed stock to carry the same rights as the conventional share. The documents that define the right still control; the token changes how the right is recorded and transferred, not what it is.
The GENIUS Act takes full effect January 18, 2027; from that date only approved permitted payment stablecoin issuers may issue payment stablecoins in the United States. Banks and payment processors are expected to offer compliant products around that date. The terms, fees, and settlement mechanics will come from your bank or processor, and the sanctions and anti-money-laundering obligations attach at the issuer and platform level.
Keep a current inventory of its AI systems and map its program to the NIST AI Risk Management Framework. Substantial compliance with that framework is the statutory defense when the company's own testing or review discovers a violation, and the inventory is what every other safeguard depends on.
Not yet on a rule-based path. The SEC's proposed Regulation Crypto Assets would create a $5 million start-up exemption, $20 million and $75 million offering tiers, and a safe harbor for tokens whose issuer has completed its promised development, but it is a proposal whose comment period closed in October 2026. Until it is adopted, a token that is an investment contract is offered under an existing exemption, usually Regulation D, or not at all.
Charts is the firm's attorney-certified governance record for a company — capitalization, consents, filings, and the executed instruments behind each entry. A token is only as reliable as the record it points to, so a company that intends to tokenize its equity or fund interests needs that record first. Charts is designed to be that record; it is not itself a blockchain or a token platform.
This article is general information about developments in Texas and federal law as of its publication date, not legal advice about any specific tract, lease, project, or offering. Laws and rules change; talk to counsel about your situation before acting. Attorney advertising.