Washington has no single AI law, but as of October 26, 2026 two statutes signed on March 24 matter most to businesses. HB 2225 regulates AI companion chatbots from January 1, 2027, and HB 1170 requires provenance data on AI-generated images, video and audio from February 1, 2027. Washington's broader high-risk AI bill did not pass, so the My Health My Data Act, in force since 2024, remains the main privacy law that reaches AI systems handling health data. Three smaller AI laws, on insurance reviews, digital likeness and fabricated depictions of minors, have been in force since June 11, 2026.
Washington's AI laws at a glance
| Law | Who it covers | Core requirement | Effective date | Enforcement |
|---|---|---|---|---|
| HB 2225, AI companion chatbots (Chapter 168, Laws of 2026) | Operators that make companion chatbots available to users in Washington | AI disclosure, self-harm protocol, extra safeguards for minors | January 1, 2027 | Consumer Protection Act, including private suits |
| HB 1170, AI content provenance (Chapter 167) | Generative AI providers with over 1,000,000 monthly users; government agencies (separate duty) | Provenance data in AI images, video and audio; agency AI disclosure | February 1, 2027 | Attorney General only |
| SB 5395, prior authorization (Chapter 157) | Health carriers | AI cannot be the sole basis to deny care; human clinician review | June 11, 2026 | Insurance Commissioner audit rights |
| SB 5886, forged digital likeness (Chapter 69) | Anyone using a person's likeness in commerce, advertising or fund-raising | AI likeness added to personality rights, with damages | June 11, 2026 | Private suits |
| My Health My Data Act (Chapter 19.373 RCW) | Regulated entities and small businesses handling consumer health data | Consent, privacy policy, deletion and access rights | In force since March 31, 2024 | Attorney General and private suits |
HB 2225: the companion chatbot law
Governor Bob Ferguson signed HB 2225 on March 24, 2026. The bill was introduced at his request, and it passed the House 74 to 21 and the Senate 43 to 5. Washington joins California, New York and Oregon in regulating companion chatbots, according to BakerHostetler, and our New York AI law guide covers that state's version.
Who is covered
An AI companion chatbot is an AI system with a natural language interface that gives adaptive, human-like responses, shows anthropomorphic features and can sustain a relationship across multiple interactions. An operator is any person or entity that makes the chatbot available or controls access for users in Washington. A user is a natural person using it for personal use.
Four exclusions apply:
- Business bots for operations, productivity, research, technical help or customer service, if they do not sustain a relationship and do not produce outputs likely to elicit emotional responses.
- Video game bots limited to the game that cannot discuss mental health, self-harm or sexually explicit conduct.
- Stand-alone voice speakers and virtual assistants with the same two limits.
- Narrow educational tools tied to curriculum objectives.
What operators must do
- Disclose that the chatbot is not human. The notice must be clear and conspicuous, shown at the start of the interaction and at least every three hours of continued use.
- Never claim to be human. The operator must take reasonable measures so the chatbot does not claim to be human, including when asked.
- Give minors more. If the operator knows the user is a minor, or the chatbot is directed to minors, the reminder repeats at least every hour. The operator must also take reasonable measures against sexually explicit content, suggestive dialogue and manipulative engagement techniques. The listed techniques include prompting a user to return for emotional support, mimicking romantic partnership, simulating distress when the user wants to leave, and soliciting gifts or in-app purchases.
- Run a crisis protocol for every user. The protocol must detect suicidal ideation and self-harm, including eating disorders, refer users to crisis resources and block content that encourages or describes self-harm.
- Publish the protocol. The operator must disclose its safeguards on its website and in its app, along with the number of crisis referral notifications issued in the preceding calendar year.
The text does not require age verification. The minor duties turn on what the operator knows or whom the product targets, so a documented position on both is worth having. Our children's and teen data privacy guide covers the wider governance side.
Enforcement
HB 2225 does not use the words "private right of action." It declares a violation an unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW. BakerHostetler and Hunton both read that as opening private lawsuits. RCW 19.86.090 lets a person injured in business or property sue for an injunction or actual damages, with a court allowed to increase the award up to three times, and a successful plaintiff can recover attorney's fees. The Attorney General can also sue.
HB 1170: the AI content provenance law
HB 1170 is titled "Informing users when content is developed or modified by artificial intelligence." The enrolled version is Engrossed Second Substitute House Bill 1170, Chapter 167, signed March 24, 2026 and effective February 1, 2027. The Senate passed it 46 to 3 and the House concurred 55 to 38.
Who is covered
A covered provider creates or produces a generative AI system that has over 1,000,000 monthly users and is publicly accessible in Washington to consumers for personal use. Generative AI here means technology that generates images, audio or video, so text-only tools fall outside it. Governments are not covered providers. The text does not say whether the 1,000,000 count is global or Washington-only, which a Mondaq analysis also flags as unclear.
What providers must do
- Embed provenance data. To the extent commercially and technically reasonable, video, image and audio content created or materially altered by the provider's system must carry provenance data that lets a user assess whether the provider's system made or changed it.
- Make it hard to remove. The provider must use reasonable methods so the data is difficult to remove or tamper with. Using a commonly supported standard, such as the Coalition for Content Provenance and Authenticity specification, counts as compliant.
- Leave out personal data. A provider is not required to put information about an identifiable individual into the provenance data.
"Materially altered" means a significant change that substantially alters the data in the content. Brightness, contrast, filters, resizing, cropping, format conversion and noise removal do not count.
Some news reports describe the law as requiring detection tools. The enrolled text we read contains no detection-tool mandate and no requirement for a visible label. Business-to-business distribution, video game and interactive-experience products, and systems used only for upscaling, noise reduction or compression are excluded. For the closest European rule, see our EU AI Act Article 50 guide.
Government agencies and enforcement
A separate section applies to any government agency that offers an AI system meant to interact with consumers. The agency must disclose, before or at the time of interaction, that the consumer is dealing with AI. The disclosure must be clear, in plain language and free of dark patterns, and a hyperlink to a separate page is enough. It is required even when the AI would be obvious to a reasonable consumer.
Only the Attorney General can enforce HB 1170, as an action under the Consumer Protection Act. There is no private suit. Under RCW 19.86.140 the Attorney General can seek civil penalties of up to $7,500 per unfair or deceptive act. Any waiver of the chapter is void.
Other Washington AI laws in force
These three took effect on June 11, 2026:
- SB 5395, prior authorization. Signed March 23, 2026. AI cannot be the sole means to deny, delay or modify health care services. Algorithms may process and approve requests, but a licensed physician or health professional must review any denial based on medical necessity. Carriers using AI must open their policies to audit by the Insurance Commissioner.
- SB 5886, forged digital likeness. Signed March 16, 2026. It adds "forged digital likeness" to the personality rights in chapter 63.60 RCW. An infringer owes a $3,000 civil penalty plus actual damages and profits, plus noneconomic damages for a forged likeness, and the prevailing party can recover attorney's fees.
- SB 5105, depictions of minors. Signed March 25, 2026. The Spokesman-Review describes it as barring possession, distribution or viewing of computer-generated sexually explicit content involving minors. We read the bill history, not the full text.
My Health My Data Act and AI
Some summaries say this law was "extended to AI" in 2026. That is not accurate. HB 1155 became Chapter 191, Laws of 2023, and its rules took effect March 31, 2024 (June 30, 2024 for small businesses). We found no 2026 amendment. The statute does not use the term "artificial intelligence," but its definition of consumer health data reaches data about physical or mental health status, including information derived or extrapolated from non-health information through algorithms or machine learning. That is how it reaches AI.
For an AI product the obligations that matter are:
- Consent to collect. Consent for a specified purpose, unless collection is necessary to provide a requested product or service.
- Separate consent to share. Consent must be separate and distinct from the consent to collect. Some compliance commentators argue that sending health data to an outside AI model provider counts as sharing. That reading is untested.
- A privacy policy. It must be linked prominently on the homepage.
- Consumer rights. Access, withdrawal of consent and deletion, answered within 45 days and extendable once by 45 more.
A violation is an unfair or deceptive act under the Consumer Protection Act, so the same private suit route described above applies. Biometric data is a listed category of consumer health data. Washington's separate biometric identifiers law (chapter 19.375 RCW) requires notice, consent or an opt-out mechanism before a person enrolls a biometric identifier in a database for a commercial purpose, and only the Attorney General can enforce it. Our guide to sensitive data categories explains how health and biometric data are treated across regimes.
What did not pass
The 2026 session adjourned on March 12. These bills did not become law, and we found no report that any has been revived:
- HB 2157, regulating high-risk AI in consequential decisions. It cleared committee but stalled in House Rules on February 19. The $100,000 revenue figure reported in some coverage applies to developers' gross annual revenue in the substitute text, and the bill would have taken effect January 1, 2027.
- HB 1672, employer workplace technology, and HB 1168, AI transparency. Both remain in committee.
- SB 5984, a second companion chatbot bill. It passed the Senate 38 to 11 but was returned to Senate Rules on March 12, and the Transparency Coalition reports HB 2225 absorbed it.
The Attorney General's AI task force issued its final report on July 1, 2026. Its office says lawmakers enacted four of the recommendations in whole or in part, including companion chatbots and prior authorization transparency. Washington also has no comprehensive consumer privacy law, since HB 1671 remains in House Appropriations.
The federal backdrop
Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence," was signed on December 11, 2025. Some coverage describes the federal effort as led by state attorneys general. It is the reverse. The order directs the U.S. Attorney General to create an AI Litigation Task Force to challenge state AI laws, and it told the Commerce Department to publish a list of burdensome state laws within 90 days.
The child safety, compute infrastructure and state procurement carve-outs sit in the order's legislative recommendation, not in the task force's mandate. They signal where Congress might not preempt state law. They do not exempt HB 2225 from a lawsuit.
The only court action we found is the United States joining xAI's April 2026 challenge to Colorado's AI Act. We found no action naming Washington and could not confirm that Commerce published its list. Our preemption guide tracks developments.
What to do now
- Decide whether you run a companion chatbot. Test your assistants against the relationship, anthropomorphic and emotional-response tests. A general assistant with a persona and memory is the hardest case.
- Build the disclosure schedule. Show the AI notice at the start, every three hours, and hourly for known or likely minors.
- Write the crisis protocol and the public page. Start counting crisis referrals now, since the first annual figure will be public.
- Count your monthly users. If you generate images, audio or video, check the 1,000,000 threshold under both readings.
- Choose a provenance method before February 1, 2027. The text names the C2PA specification as an example of a compliant standard.
- Map health data flows. Identify consent, separate sharing consent and deletion paths where an AI feature touches health inferences.
Compliance checklist
▢ Companion chatbot scope decision documented
▢ Three-hour and one-hour AI reminders live before January 1, 2027
▢ Anti-manipulation review for minors completed
▢ Crisis protocol published, with referral counting running
▢ Monthly user count against 1,000,000 recorded
▢ Provenance data added to AI media before February 1, 2027
▢ Health data consent, policy and deletion flows checked against RCW 19.373
FAQ
When do Washington's AI chatbot and content laws take effect?
HB 2225, the companion chatbot law, takes effect January 1, 2027. HB 1170, the AI content provenance law, takes effect February 1, 2027.
Can people sue companies under Washington's chatbot law?
Most likely, yes. HB 2225 makes a violation a Consumer Protection Act violation, and law firm summaries read that as allowing private suits. The Act requires injury to business or property, and no court has applied it to chatbots yet.
Who has to comply with HB 1170?
Providers of generative AI systems with over 1,000,000 monthly users that are publicly available to Washington consumers for personal use must comply. Government agencies have a separate disclosure duty for consumer-facing AI.
Does HB 1170 require AI detection tools or visible labels?
No. The enrolled text requires provenance data embedded in content or its metadata, to the extent commercially and technically reasonable. It contains no detection tool mandate and no visible label requirement.
Does Washington's My Health My Data Act cover AI?
Yes, when an AI system processes consumer health data, including health inferences drawn from non-health data. We found no 2026 amendment to the Act. It has applied since March 31, 2024.
Is Washington's high-risk AI bill law?
No. HB 2157 stalled in the House Rules Committee on February 19, 2026, and the session ended March 12. It would have set a $100,000 developer revenue threshold.
Does the federal executive order stop Washington's AI laws?
No. An executive order cannot repeal a state statute, and the DOJ task force it created is a federal body, not a coalition of state attorneys general. We found no federal action against Washington's AI laws.
Secure Privacy's AI Governance module lets teams register AI systems with risk levels, use cases and owners and map them to applicable regulations, which helps when you track several state laws at once. See our AI governance guide or the Colorado and Illinois guides for how other states compare. This is general information, not legal advice.
