Regulon — WA-HB-2667 · WA HB 2667 (AI Consumer Protections)

WHAT THIS BILL REGULATES · 4 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney general enforcement only. The attorney general may bring an action in the name of the state or as parens patriae on behalf of state residents. A violation is treated as an unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW, but no private action may be brought under RCW 19.86.090. The attorney general must provide 45 days' written notice before commencing an action. For a first violation, the developer or deployer may cure within 60 days of receiving notice. A rebuttable presumption of reasonable care applies to deployers who comply with the chapter.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

Enforcement is through the Consumer Protection Act, chapter 19.86 RCW, which provides for injunctive relief, restitution, and civil penalties available to the attorney general. The private right of action under RCW 19.86.090 is expressly excluded. Specific penalty amounts are governed by the CPA's existing penalty framework rather than this bill.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Sec. 1

Legislative findings and intent

The legislature finds that artificial intelligence is a dynamic technology that is changing the way Washingtonians live, learn, and work. Emerging artificial intelligence technologies seek to enhance information gathering and decision making, create new efficiencies throughout the economy, and advance scientific discovery. The legislature also recognizes that there are potential risks associated with the rapid development and deployment of artificial intelligence systems, including the generation of bias and unintentional discrimination. These risks are especially profound when an artificial intelligence system is used to make decisions that have a material or legal impact on someone's life. The legislature recognizes Washington's role as a leader and innovator within the high-technology economy. The legislature intends to adopt an artificial intelligence regulatory framework that continues to promote innovation, reduce risk, and protect residents from discriminatory actions. The legislature further recognizes that regulatory frameworks that align with national standards and specify clear compliance requirements provide developers with certainty to support continued innovation while also protecting consumers from unfair or unclear artificial intelligence decisions. Therefore, it is the intent of the legislature to protect Washingtonians from algorithmic discrimination by establishing a comprehensive risk-based approach to artificial intelligence accountability. The legislature intends to regulate deployers of artificial intelligence under the presumption that they are acting in good faith when they comply with the provisions of this act. The legislature also intends to ensure that government agencies are transparent and accountable by requiring disclosure when consumer interactions are supported by an artificial intelligence system. Finally, the legislature intends to extend and expand the work of the artificial intelligence task force to develop a framework for the adoption of artificial intelligence in the workplace in a way that centers workers and protects fairness and opportunity.

Section 1 sets out the legislature's findings regarding AI's benefits and risks, and declares the intent to establish a risk-based accountability framework focused on algorithmic discrimination. It establishes a good-faith presumption for deployers who comply with the act and signals intent to require government agency AI transparency and to extend the existing AI task force's work on workplace AI adoption.

Sec. 2

Definitions

(1)–(11) "Algorithmic discrimination": (a) Means the use of an artificial intelligence system which results in any unlawful differential impact that disfavors any individual or group of individuals on the basis of chapter 49.60 RCW or federal law; and (b) Does not include the following: (i) Any offer, license, or use of a high-risk artificial intelligence system by a developer or deployer for the sole purpose of: (A) The developer's or deployer's testing to identify, mitigate, or prevent discrimination or otherwise ensure compliance with state and federal law; or (B) expanding an applicant, customer, or participant pool to increase diversity or redress historic discrimination; or (ii) Any act or omission by or on behalf of a private club or other establishment not in fact open to the public, as set forth in Title II of the Civil Rights Act of 1964, 42 U.S.C. Sec. 2000a(e), as amended. (2) "Artificial intelligence" means the use of machine learning and related technologies that use data to train statistical models for the purpose of enabling computer systems to perform tasks normally associated with human intelligence or perception, such as computer vision, speech or natural language processing, and content generation. (3) "Consequential decision" means any decision that has a material legal or similarly significant effect on the provision or denial of any consumer's access to: (a) Pardon, parole, probation, or release; (b) Education enrollment or opportunity; (c) Employment; (d) A financial or lending service; (e) An essential government service; (f) Health care services; (g) Housing; (h) Insurance; or (i) Legal service. (4) "Consumer" means any individual who is a resident of this state. (5) "Deploys" or "deployed" means to put a high-risk artificial intelligence system into use. (6) "Deployer" means any person doing business in this state that deploys a high-risk artificial intelligence system in the state. (7) "Developer" means any person doing business in this state that develops, or intentionally and substantially modifies, a high-risk artificial intelligence system intended for use within the state. (8) "High-risk artificial intelligence system": (a) Means any artificial intelligence system designed by its developer to, when deployed, make, or is a substantial factor in making, a consequential decision; and (b) Does not include: (i) Any artificial intelligence system that is intended to: (A) Perform any narrow procedural task; (B) Improve the result of a previously completed human activity; (C) Perform a preparatory task to an assessment relevant to a consequential decision; or (D) Detect any decision-making pattern, or any deviation from any preexisting decision-making pattern; (ii) Any antifraud technology, antimalware, antivirus, calculator, cybersecurity, database, data storage, firewall, internet domain registration, internet website loading, networking, robocall-filtering, spam-filtering, spellchecking, spreadsheet, webcaching, webhosting, search engine, or similar technology; or (iii) Any technology that communicates in natural language for the purpose of providing users with information, making referrals or recommendations, answering questions, or generating other content, and is subject to an acceptable use policy that prohibits generating content that is unlawful. (9) "Intentional and substantial modification" or "intentionally and substantially modifies" means a deliberate change made to an artificial intelligence system that materially increases the risk of algorithmic discrimination. (10) "Person" means any individual, association, corporation, limited liability company, partnership, trust, or other legal entity. (11) "Substantial factor" means a factor that is: (a) Considered when making a consequential decision; (b) Likely to alter the outcome of a consequential decision; and (c) Weighed more heavily by a deployer of the applicable high-risk artificial intelligence system than any other factor contributing to the consequential decision.

Section 2 defines the key terms used throughout the chapter. Notably, the definition of high-risk artificial intelligence system contains three broad carve-outs: systems performing narrow procedural tasks, common IT infrastructure tools, and natural-language systems subject to an acceptable use policy prohibiting unlawful content. The substantial factor definition is unusually restrictive, requiring the AI factor to be weighed more heavily than any other factor in the consequential decision.

Sec. 3

Deployer duty to protect against algorithmic discrimination

Deployer

(1)(a)–(b) 1 Beginning July 1, 2027, each deployer of a high-risk artificial intelligence system must use industry-standard means to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination. (b) In any enforcement action brought on or after July 1, 2027, by the attorney general pursuant to section 9 of this act, there is a rebuttable presumption that a deployer of a high-risk artificial intelligence system used reasonable care as required under this section if the deployer complied with this chapter.

(2)(a)–(b) 2 By July 1, 2027, and at least annually thereafter, a deployer or third party contracted by the deployer shall review the deployment of each high-risk artificial intelligence system deployed by the deployer to ensure that the high-risk artificial intelligence system is not causing algorithmic discrimination. (b) If a deployer subsequently discovers that the high-risk artificial intelligence system has caused algorithmic discrimination, the deployer, without unreasonable delay, but no later than 90 days after the date of the discovery, shall send to the attorney general, in a form and manner prescribed by the attorney general, a notice disclosing the discovery.

(3) Nothing in this section may be construed to require a deployer to disclose any trade secret, or other confidential or proprietary information.

Section 3 establishes two core deployer obligations beginning July 1, 2027. First, deployers must use industry-standard means to protect consumers from known or reasonably foreseeable risks of algorithmic discrimination. Second, deployers must conduct at least annual reviews of each deployed high-risk AI system to verify it is not causing algorithmic discrimination, and must notify the attorney general within 90 days of discovering discrimination. Compliance with the full chapter creates a rebuttable presumption of reasonable care. Trade secret protections apply.

Compliance actions 2 items

Deployers must use industry-standard means to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination arising from each deployed high-risk AI system. Compliance with the full chapter creates a rebuttable presumption of reasonable care in any attorney general enforcement action.

H-02.1

Deployers must conduct at least annual reviews — either internally or through a contracted third party — of each deployed high-risk AI system to verify the system is not causing algorithmic discrimination. If a deployer discovers that the system has caused algorithmic discrimination, the deployer must notify the attorney general within 90 days of discovery, in the form and manner prescribed by the attorney general.

H-02.8

Sec. 4

Risk management policy and program

Deployer

(1) 3 Beginning July 1, 2027, and except as provided in section 5(6) of this act, each deployer of a high-risk artificial intelligence system shall implement and maintain a risk management policy and program to govern the deployer's deployment of a high-risk artificial intelligence system.

(2)(a)–(c) 3 The risk management policy and program must specify and incorporate the principles, processes, and personnel that the deployer uses to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination. The risk management policy and program must include an iterative process that is planned, implemented, and regularly and systematically reviewed and updated over the lifecycle of the high-risk artificial intelligence system. (b) A risk management policy and program implemented and maintained pursuant to this subsection must be reasonable, considering: (i) The size and complexity of the deployer; (ii) The nature and scope of the high-risk artificial intelligence systems deployed by the deployer including, but not limited to, the intended uses of such high-risk artificial intelligence systems; (iii) The sensitivity and volume of data processed in connection with the high-risk artificial intelligence systems deployed by the deployer; and (iv) A risk management framework that either: (A) Adheres to the guidance and standards set forth in the latest version of the artificial intelligence risk management framework published by the national institute of standards and technology, ISO/IEC 42001, or another nationally or internationally recognized risk management framework for artificial intelligence systems, if the standards are substantially equivalent to or more stringent than the requirements; or (B) Complies with any risk management framework for artificial intelligence systems that the attorney general, in the attorney general's discretion, may designate. (c) A risk management policy and program implemented and maintained pursuant to this subsection (2) may cover multiple high-risk artificial intelligence systems deployed by the deployer.

(3) Nothing in this section may be construed to require a deployer to disclose any trade secret, or other confidential or proprietary information.

Section 4 requires deployers to implement and maintain a risk management policy and program governing the deployment of high-risk AI systems, beginning July 1, 2027. The program must identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination and must be iterative and regularly updated. Reasonableness is calibrated to the deployer's size, the nature and scope of deployed systems, and data sensitivity. Compliance with NIST AI RMF, ISO/IEC 42001, or another nationally recognized framework — or a framework designated by the attorney general — satisfies the requirement. A single program may cover multiple systems. Small deployer exemptions under Section 6 apply.

Compliance actions 1 item

Deployers must implement and maintain a risk management policy and program governing the deployment of each high-risk AI system. The program must specify the principles, processes, and personnel used to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and must include an iterative process that is planned, implemented, and regularly and systematically reviewed and updated over the lifecycle of the system. The program must be reasonable considering the deployer's size and complexity, the nature and scope of deployed systems, the sensitivity and volume of data processed, and adherence to a recognized risk management framework such as the NIST AI RMF, ISO/IEC 42001, or a framework designated by the attorney general. A single program may cover multiple high-risk AI systems.

G-01.1

Sec. 5

Impact assessments

Deployer

(1)(a)–(b) 4 Except as provided in subsection (6) of this section, a deployer that deploys a high-risk artificial intelligence system on or after July 1, 2027, or a third party contracted by the deployer for such purposes, shall complete an impact assessment for: (a) The high-risk artificial intelligence system; and (b) A deployed high-risk artificial intelligence system no later than 90 days after any intentional and substantial modification to such high-risk artificial intelligence system is made available.

(2)(a)–(c) 4 Each impact assessment completed pursuant to this section must include, at a minimum, and to the extent reasonably known by, or available to, the deployer: (a) A statement by the deployer disclosing the purpose, intended use cases and deployment context of, and benefits afforded by, the high-risk artificial intelligence system; (b) An analysis of whether the deployment of the high-risk artificial intelligence system poses any known or reasonably foreseeable risks of algorithmic discrimination and, if so, the nature of such algorithmic discrimination and the steps that have been taken to mitigate such risks; (c) A description of the following: (i) The categories of data the high-risk artificial intelligence system processes as inputs; (ii) The outputs the high-risk artificial intelligence system produces; (iii) Any metrics used to evaluate the performance and known limitations of the high-risk artificial intelligence system; (iv) A description of any transparency measures taken concerning the high-risk artificial intelligence system, such as any measures taken to disclose to a consumer that such high-risk artificial intelligence system is in use when such high-risk artificial intelligence system is in use; and (v) A description of the postdeployment monitoring and user safeguards provided concerning such high-risk artificial intelligence system, such as the oversight process established by the deployer to address issues arising from deployment of such high-risk artificial intelligence system.

(3) 4 In addition to the information required under subsection (2)(c) of this section, each impact assessment completed following an intentional and substantial modification made to a high-risk artificial intelligence system on or after July 1, 2027, must include a statement disclosing the extent to which the high-risk artificial intelligence system was used in a manner that was consistent with, or varied from, the developer's intended uses of such high-risk artificial intelligence system.

(4)–(5) 4 A single impact assessment may address a comparable set of high-risk artificial intelligence systems deployed by a deployer. (5) If a deployer, or a third party contracted by the deployer, completes an impact assessment for the purpose of complying with another applicable law or regulation, such impact assessment satisfies the requirements established in this section if such impact assessment is reasonably similar in scope and effect to the impact assessment that would otherwise be completed pursuant to this subsection.

(6) 5 A deployer shall maintain the most recently completed impact assessment for a high-risk artificial intelligence system as required under this section, relevant records supporting the impact assessment, and prior impact assessments, if any, for a period of at least three years following the final deployment of the high-risk artificial intelligence system.

(7) Nothing in this section may be construed to require a deployer to disclose any trade secret, or other confidential or proprietary information.

Section 5 requires deployers to complete impact assessments for each high-risk AI system deployed on or after July 1, 2027, and within 90 days of any intentional and substantial modification. Impact assessments must cover purpose and intended use, algorithmic discrimination risks and mitigation steps, data categories, outputs, performance metrics, transparency measures, and post-deployment monitoring. Assessments following a substantial modification must also disclose consistency with the developer's intended uses. A single assessment may cover comparable systems, and assessments completed under other applicable law may satisfy this requirement if reasonably similar in scope. Deployers must retain the most recent assessment, supporting records, and prior assessments for at least three years following final deployment.

Compliance actions 2 items

Deployers must complete an impact assessment for each high-risk AI system before deployment on or after July 1, 2027, and within 90 days after any intentional and substantial modification. Each assessment must include, to the extent reasonably known: (1) the system's purpose, intended use cases, deployment context, and benefits; (2) an analysis of known or reasonably foreseeable algorithmic discrimination risks and mitigation steps; (3) categories of input data, system outputs, performance metrics and limitations, transparency measures taken, and post-deployment monitoring and user safeguards. Assessments following a substantial modification must also disclose the extent to which the system was used consistently with or in variance from the developer's intended uses. A single assessment may cover comparable systems, and an assessment completed under another applicable law satisfies this requirement if reasonably similar in scope and effect.

H-02.3

Deployers must retain the most recently completed impact assessment, relevant supporting records, and all prior impact assessments for at least three years following the final deployment of each high-risk AI system.

H-02.10

Sec. 6

Small deployer exemption

(1)(a)–(c) The requirements in section 5 (1) through (3) of this act and section 3(2) of this act do not apply to a deployer if, at the time the deployer deploys a high-risk artificial intelligence system and at all times while the high-risk artificial intelligence system is deployed: (a) The deployer: (i) Employs fewer than 50 full-time equivalent employees; and (ii) Does not use the deployer's own data to train the high-risk artificial intelligence system; (b) The high-risk artificial intelligence system: (i) Is used for the intended uses that are disclosed by the deployer; and (ii) Continues learning based on data derived from sources other than the deployer's own data; and (c) The deployer makes available to consumers any impact assessment that: (i) The developer of the high-risk artificial intelligence system has completed and provided to the deployers; and (ii) Includes information that is substantially similar to the information in the impact assessment required under section 5 of this act.

(2) Nothing in this section may be construed to require a deployer to disclose any trade secret, or other confidential or proprietary information.

Section 6 exempts small deployers — those with fewer than 50 full-time equivalent employees who do not use their own data to train the high-risk AI system — from the impact assessment requirements in Section 5(1)–(3) and the annual bias review requirement in Section 3(2), provided the system is used for its disclosed intended uses, continues learning from non-deployer data, and the deployer makes available to consumers any developer-completed impact assessment that is substantially similar to the Section 5 assessment. This is a conditional exemption that must be satisfied at deployment and at all times during deployment.

Sec. 7

Consumer notification before consequential decisions

Deployer

(1)–(2) 6 Beginning July 1, 2026, each time a deployer deploys a high-risk artificial intelligence system to make, or be a substantial factor in making, a consequential decision concerning a consumer, the deployer shall: (1) Notify the consumer that the deployer has deployed a high-risk artificial intelligence system to make, or be a substantial factor in making, a consequential decision before the decision is made; and (2) Provide to the consumer a statement disclosing: (a) The purpose of the high-risk artificial intelligence system and the nature of the consequential decisions; (b) The contact information for the deployer; and (c) A description, in plain language, of the high-risk artificial intelligence system.

Section 7 requires deployers, beginning July 1, 2026, to notify consumers before a consequential decision is made using a high-risk AI system. The notification must disclose the system's purpose, the nature of the consequential decisions, the deployer's contact information, and a plain-language description of the system. This is the earliest operative date in the bill — one year before most other obligations take effect.

Compliance actions 1 item

Deployers must notify the consumer before any consequential decision is made using a high-risk AI system that the deployer has deployed such a system to make or substantially factor in the decision. The deployer must also provide a statement disclosing: (1) the purpose of the system and the nature of the consequential decisions; (2) the deployer's contact information; and (3) a plain-language description of the system.

H-01.3

Sec. 8

Exemptions and savings clauses

(1)(a)–(d) Nothing in this chapter may be construed to: (a) Restrict a developer's, deployer's, or other person's ability to: (i) Comply with federal, state, or municipal law; (ii) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, municipal, or other governmental authorities; (iii) Cooperate with law enforcement agencies concerning conduct or activity that the developer, deployer, or other person reasonably and in good faith believes may violate federal, state, or municipal law; (iv) Investigate, establish, exercise, prepare for, or defend legal claims; (v) Take immediate steps to protect an interest that is essential for the life or physical safety of a consumer or another individual; (vi) Engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is conducted in accordance with 45 C.F.R. Part 46, as amended from time to time, or relevant requirements established by the federal food and drug administration; (vii) Conduct any research, testing, or development activities regarding any artificial intelligence system or model, other than testing conducted under real world conditions, before such artificial intelligence system or model is placed on the market, deployed, or put into service, as applicable; (viii) Effectuate a product recall; (ix) Identify and repair technical errors that impair existing or intended functionality; or (x) Assist another developer, deployer, or person with any of the obligations imposed under this chapter; (b) Impose any obligation on a developer, deployer, or other person that adversely affects the rights or freedoms of any person including, but not limited to, the rights of any person to freedom of speech or freedom of the press guaranteed in the First Amendment to the United States Constitution; (c) Apply to any developer, deployer, or other person: (i) Insofar as such developer, deployer, or other person develops, deploys, puts into service, or intentionally and substantially modifies, as applicable, a high-risk artificial intelligence system that has been approved, authorized, certified, cleared, or granted: (A) By a federal agency, such as the federal food and drug administration or the federal aviation administration, acting within the scope of such federal agency's authority; or (B) In compliance with standards established by any federal agency including, but not limited to, standards established by the federal office of the national coordinator for health information technology; (ii) Conducting any research to support an application for approval or certification from any federal agency including, but not limited to, the federal aviation administration, the federal communications commission, or the federal food and drug administration, or otherwise subject to review by such federal agency; (iii) Performing work under, or in connection with, a contract with the United States department of commerce, the United States department of defense, or the national aeronautics and space administration, unless such developer, deployer, or other person is performing such work on a high-risk artificial intelligence system that is used to make, or as a substantial factor in making, a decision concerning employment or housing; or (iv) That is a covered entity within the meaning of the health insurance portability and accountability act of 1996, P.L. 104-191, and the regulations promulgated thereunder, as both may be amended from time to time, and providing health care recommendations that: (A) Are generated by an artificial intelligence system; (B) Require a health care provider to take action to implement such recommendations; and (C) Are not considered to be high risk; or (d) Apply to any artificial intelligence system that is acquired by or for the federal government or any federal agency or department including, but not limited to, the United States department of commerce, the United States department of defense, or the national aeronautics and space administration, unless such artificial intelligence system is a high-risk artificial intelligence system that is used to make, or as a substantial factor in making, a decision concerning employment or housing.

(2) If a developer, deployer, or other person engages in any action pursuant to an exemption set forth in this section, the developer, deployer, or other person bears the burden of demonstrating that such action qualifies for such exemption.

Section 8 establishes broad exemptions and savings clauses. The chapter does not restrict compliance with other laws, cooperation with law enforcement, legal defense activities, public research, product recalls, technical error repair, pre-market R&D, or any obligation that would adversely affect First Amendment rights. The chapter also does not apply to AI systems approved by federal agencies (FDA, FAA), systems used under federal defense or commerce contracts (unless for employment or housing decisions), HIPAA covered entities providing AI health care recommendations where a provider must act, or AI acquired by federal agencies (unless for employment or housing). Parties claiming an exemption bear the burden of proof.

Sec. 9

Enforcement

(1)(a)–(b) The attorney general may bring an action in the name of the state, or as parens patriae on behalf of persons residing in the state, to enforce this chapter. For actions brought by the attorney general to enforce this chapter, a violation of this chapter is an unfair or deceptive act in trade or commerce for the purpose of applying the consumer protection act, chapter 19.86 RCW. An action to enforce this chapter may not be brought under RCW 19.86.090. (b) The office of the attorney general, before commencing an action under the consumer protection act, chapter 19.86 RCW, must provide 45 days' written notice to a deployer or developer of the alleged violation of this chapter. For the first violation, the developer or deployer may cure the noticed violation within 60 days of receiving the written notice.

(2) Nothing in this chapter may be construed to limit or otherwise affect the obligations of developers and deployers under applicable laws, rules, or regulations relating to data privacy or security.

Section 9 establishes exclusive attorney general enforcement. Violations are treated as unfair or deceptive acts under the Consumer Protection Act (chapter 19.86 RCW), but private suits under RCW 19.86.090 are expressly barred. The AG must provide 45 days' written notice before commencing an action. For a first violation, the developer or deployer has 60 days to cure. The section also preserves obligations under existing data privacy and security laws.

Sec. 10

Government agency AI disclosure

Government

(1)–(3) 7 A government agency that makes available an artificial intelligence system intended to interact with consumers must disclose to each consumer, before or at the time of interaction, that the consumer is interacting with an artificial intelligence system. The disclosure must be: (a) Clear and conspicuously posted; (b) Written in plain language; and (c) May not use a dark pattern. (2) The disclosure may be provided by using a hyperlink to direct a consumer to a separate web page. (3) A person is required to make the disclosure under subsection (1) of this section regardless of whether it would be obvious to a reasonable consumer that the consumer is interacting with an artificial intelligence system.

Section 10 requires government agencies that deploy consumer-facing AI systems to disclose to each consumer, before or at the time of interaction, that the consumer is interacting with an AI system. The disclosure must be clear and conspicuous, written in plain language, and may not use a dark pattern. Notably, the disclosure obligation applies unconditionally — regardless of whether it would be obvious to a reasonable consumer that AI is in use. The disclosure may be provided via hyperlink. This section is codified in Title 42 RCW (separate from the private-sector obligations in Title 19).

Compliance actions 1 item

Government agencies that make available an AI system intended to interact with consumers must disclose to each consumer, before or at the time of interaction, that the consumer is interacting with an AI system. The disclosure must be clear and conspicuously posted, written in plain language, and must not use a dark pattern. The disclosure may be provided via hyperlink. The disclosure obligation applies unconditionally regardless of whether it would be obvious to a reasonable consumer that AI is in use.

T-01.1

Sec. 11

Codification — Title 19 RCW

Sections 1 through 9 of this act constitute a new chapter in Title 19 RCW.

Section 11 is a codification directive placing Sections 1 through 9 in a new chapter in Title 19 RCW (Consumer Protection). No obligations are created.

Sec. 12

Codification — Title 42 RCW

Section 10 of this act constitutes a new chapter in Title 42 RCW.

Section 12 is a codification directive placing Section 10 in a new chapter in Title 42 RCW (Public Officers and Agencies). No obligations are created.

Sec. 13

AI Task Force extension (amending 2024 c 163 s 2)

2024 c 163 s 2 (uncodified) is amended to read as follows: (1) A task force to assess current uses and trends and make recommendations to the legislature regarding guidelines and potential legislation for the use of artificial intelligence systems is established. ... (5) ... a final report by July 1, 2027. Meeting summaries must be posted to the website of the attorney general's office within 30 days of any meeting by the task force. ... (9) This section expires June 30, 2028.

Section 13 amends the 2024 AI Task Force legislation to remove the appropriation prerequisite, extend the task force's final report deadline from July 1, 2026 to July 1, 2027, and extend the sunset date from June 30, 2027 to June 30, 2028. The task force composition, mandate, and subcommittee structure are otherwise unchanged. This section creates no new private-sector compliance obligations.

Sec. 14

AI Workplace Advisory Group

The artificial intelligence workplace advisory group is established for the purpose of developing artificial intelligence policy related to the workplace. The artificial intelligence workplace advisory group shall report to the artificial intelligence task force established in section 2, chapter 163, Laws of 2024 as prescribed in subsection (4) of this section. (2) The attorney general shall appoint the following members to the artificial intelligence workplace advisory group: (a) Two members representing different statewide labor organizations; (b) Two members representing the business community; (c) One member representing public sector employees; (d) One member representing private sector employees; (e) One member representing higher education institutions with expertise in artificial intelligence and the workforce; (f) One member with expertise in ethics and artificial intelligence; and (g) Other members as deemed appropriate by the attorney general. (3) The artificial intelligence workplace advisory group is responsible for developing guiding principles for the use of artificial intelligence in the workplace. At a minimum, the guiding principles must prioritize the responsible and ethical use of artificial intelligence tools in ways that protect an individual's privacy and minimize the risk of bias in the workplace. (4) The artificial intelligence workplace advisory group shall deliver an interim report on the development of guiding principles for artificial intelligence in the workplace to the artificial intelligence task force by December 1, 2026, and a final report by March 1, 2027. The final report must be included in the artificial intelligence task force's final report as required by section 2(5), chapter 163, Laws of 2024. (5) This section expires June 30, 2028.

Section 14 establishes an AI Workplace Advisory Group, appointed by the attorney general, to develop guiding principles for workplace AI use. The group must deliver an interim report by December 1, 2026, and a final report by March 1, 2027, which must be incorporated into the AI Task Force's final report. The section expires June 30, 2028. This section creates no private-sector compliance obligations — it is a governmental study body.

Transparency AI identity disclosure · periodic reminders

1 item

T-01.1

Human Oversight Decision review · appeal pathways

5 items

H-02.1

Beginning Jul 1, 2027 Deployers must use industry-standard means to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination arising from each deployed high-risk AI system. Compliance with the full chapter creates a rebuttable presumption of reasonable care in any attorney general enforcement action.

H-02.8

Beginning Jul 1, 2027 Deployers must conduct at least annual reviews — either internally or through a contracted third party — of each deployed high-risk AI system to verify the system is not causing algorithmic discrimination. If a deployer discovers that the system has caused algorithmic discrimination, the deployer must notify the attorney general within 90 days of discovery, in the form and manner prescribed by the attorney general.

H-02.3

Beginning Jul 1, 2027 Deployers must complete an impact assessment for each high-risk AI system before deployment on or after July 1, 2027, and within 90 days after any intentional and substantial modification. Each assessment must include, to the extent reasonably known: (1) the system's purpose, intended use cases, deployment context, and benefits; (2) an analysis of known or reasonably foreseeable algorithmic discrimination risks and mitigation steps; (3) categories of input data, system outputs, performance metrics and limitations, transparency measures taken, and post-deployment monitoring and user safeguards. Assessments following a substantial modification must also disclose the extent to which the system was used consistently with or in variance from the developer's intended uses. A single assessment may cover comparable systems, and an assessment completed under another applicable law satisfies this requirement if reasonably similar in scope and effect.

H-02.10

Beginning Jul 1, 2027 Deployers must retain the most recently completed impact assessment, relevant supporting records, and all prior impact assessments for at least three years following the final deployment of each high-risk AI system.

H-01.3

Beginning Jul 1, 2026 Deployers must notify the consumer before any consequential decision is made using a high-risk AI system that the deployer has deployed such a system to make or substantially factor in the decision. The deployer must also provide a statement disclosing: (1) the purpose of the system and the nature of the consequential decisions; (2) the deployer's contact information; and (3) a plain-language description of the system.

Governance Risk management · accountability programs

1 item

G-01.1

Beginning Jul 1, 2027 Deployers must implement and maintain a risk management policy and program governing the deployment of each high-risk AI system. The program must specify the principles, processes, and personnel used to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination, and must include an iterative process that is planned, implemented, and regularly and systematically reviewed and updated over the lifecycle of the system. The program must be reasonable considering the deployer's size and complexity, the nature and scope of deployed systems, the sensitivity and volume of data processed, and adherence to a recognized risk management framework such as the NIST AI RMF, ISO/IEC 42001, or a framework designated by the attorney general. A single program may cover multiple high-risk AI systems.

Passage Likelihood

Medium

Status Introduced

Chamber No passage

Committee No action

Majority party Yes

Bipartisan Yes

Prior session None

Legislative History

2026-01-26 First reading, referred to Technology, Economic Development, & Veterans.

Sources

Full Text ↗

Entry Last Reviewed

2026-05-20

AI generated