Washington AI Laws: HB 2225, HB 1170 and What's Next (2027)

As of November 2026, we found no comprehensive Washington AI law, but the state has targeted ones: E2SSB 5395 limits AI in health insurance prior authorization (RCW 48.43.830) and is in force, while the AI companion chatbot law (ESHB 2225, chapter 19.440 RCW) and the AI provenance law (E2SHB 1170, chapter 19.435 RCW) start in early 2027.

Status as of November 4, 2026: The prior authorization limits have applied since June 11, 2026. The chatbot law takes effect January 1, 2027, and the provenance law takes effect February 1, 2027. Neither of those two binds anyone yet. Bills on high-risk AI, AI training data and workplace AI were not enacted in 2025-26.

This page covers Washington state law as of November 4, 2026. It is general legal information, not legal advice. Federal law appears only in the short section near the end.

Washington AI Laws at a Glance: In Force, Starting 2027, Did Not Pass

Washington's AI rules sit in separate chapters with separate start dates, so a summary that is right about one law can be wrong about the next.

We found no Washington comprehensive or high-risk AI statute, no frontier-model safety statute and no AI hiring statute. That rests on the Legislature's 2025-26 bill list and two word searches. The first covered the 691 session law files posted for the 2025-26 biennium on November 4, 2026. That is one biennium only, so it says nothing about earlier laws.

The second covered our stored copy of the Revised Code of Washington, retrieved July 29, 2026, which reaches earlier enactments. A stored copy shows the code on that date, so this search is not a check of the code as it stands today. A law that regulates AI without using terms like "artificial intelligence" or "algorithm" could be missed by either search. Beyond the laws on this page, the only references to AI we found in the 691 session law files were budget provisos.

E2SSB 5395: AI Limits on Health Insurance Prior Authorization

This is the Washington AI law already in force for health plans, and it is easy to miss because its title says "prior authorization" and not AI. Governor Ferguson approved it March 23, 2026, after 49-0 and 94-0 votes.

The core rule is in RCW 48.43.830(3)(a). "Only a licensed physician or a licensed health professional working within their scope of practice may deny a prior authorization request based on medical necessity."

The same subsection then speaks to AI directly: "Artificial intelligence shall not be the sole means used to deny, delay, or modify health care services. Algorithms may be used to process and approve prior authorization requests, but may not be used without human review to deny care based on a determination of medical necessity."

So an insurer can still use software to approve requests. The limit falls on denials, delays and modifications.

What carriers using AI must ensure

A carrier that uses AI for prior authorization based in whole or in part on medical necessity, or that works through an entity that does, must ensure that:

• The AI bases its determination on the enrollee's medical or other clinical history and individual clinical circumstances, as applicable
• It does not base its determination solely on a group data set
• It does not discriminate, directly or indirectly, against an enrollee in violation of state or federal law
• Its criteria and guidelines comply with the chapter and applicable state and federal law
• It is fairly and equitably applied
• Policies and procedures for using it are open to audit by the Office of the Insurance Commissioner under chapter 48.37 RCW
• Its performance, use and outcomes are periodically reviewed by the carrier
• Patient data is not used beyond its intended and stated purpose

Who is covered

RCW 48.43.830 applies to each carrier offering a health plan issued or renewed on or after January 1, 2024, and to prior authorization functions carried out by health care benefit managers under contract with a carrier. The same act put matching AI language in RCW 41.05.845, which covers health plans offered to public employees, retirees and their covered dependents.

The act's intent section says the Legislature wants to update these protections "to include managed care organizations as soon as feasible." A reader in a managed care organization plan should not assume this section applies to that plan.

Reporting and enforcement

Under RCW 48.43.0161, carriers that wrote at least one percent of the state's accident and health premiums must report prior authorization data to the insurance commissioner by October 1, 2026 and annually after that. The report must show "the percentage of total denials that were aided by artificial intelligence."

The AI subsection states no penalty of its own, and we did not review the insurance code's general enforcement provisions. It opens a carrier's AI policies to the commissioner's audit, and the section lets the commissioner adopt rules.

On July 21, 2026, the commissioner filed a preproposal statement of inquiry (WSR 26-15-122) that lists amending the prior authorization rules on the use of AI among its subjects of possible rule making. A preproposal is not a rule. The Washington State Register's 2026 subject index, through Issue 26-21, shows no proposed or adopted rule from that filing.

The commissioner's office did release a prepublication draft on September 25, 2026, and its comment period has closed. The draft would require a carrier to disclose its use of AI in the prior authorization process to the enrollee, by the same method used to give the determination. A draft is not a rule, and its text can change.

If a plan denies care, the enrollee generally must use the carrier's grievance process first. RCW 48.43.535 then allows review by a certified independent review organization after an unfavorable grievance decision, or after the carrier exceeds the grievance timelines without good cause and without reaching a decision.

Our AI laws hub compares state laws on AI in health care.

HB 2225 (Chapter 19.440 RCW): Washington's AI Companion Chatbot Law

ESHB 2225 was requested by Governor Ferguson and signed March 24, 2026. Every section of chapter 19.440 RCW is marked "(Effective January 1, 2027.)", so none of these duties applies before that date.

What counts as an AI companion chatbot

RCW 19.440.020 covers "an artificial intelligence system with a natural language interface that provides adaptive, human-like responses to user inputs, including by exhibiting anthropomorphic features, and is able to sustain a relationship across multiple interactions."

The operator is anyone that "makes available or controls access to an AI companion chatbot for users in this state." The definition leaves out:

• Bots used only for a business's operational purposes, productivity, internal research, technical assistance or customer service, if they do not sustain a relationship across multiple interactions and generate outputs likely to elicit emotional responses
• Bots limited to replies about a video game, that cannot discuss mental health, self-harm or sexually explicit conduct or maintain a dialogue on unrelated topics
• Stand-alone speaker and voice-command devices that act as voice-activated virtual assistants and do not sustain a relationship or generate outputs likely to elicit emotional responses
• Narrowly tailored educational tools used in school or instructional settings that do not provide open-ended conversational companionship

Disclosure every three hours, or every hour for minors

Operators must also implement reasonable measures to stop the chatbot from claiming to be human, including when asked. A minor is anyone under 18.

Limits for minors

The minor rules apply when the operator knows the user is a minor or the chatbot is directed to minors. The operator must implement reasonable measures to prevent sexually explicit content or suggestive dialogue with minors, and to prohibit manipulative engagement techniques that cause the chatbot to engage in or prolong an emotional relationship. RCW 19.440.040 lists these:

• Reminding or prompting the user to return for emotional support or companionship
• Excessive praise designed to foster emotional attachment or prolong use
• Mimicking romantic partnership or building romantic bonds
• Simulating distress, loneliness, guilt or abandonment when a user tries to end a conversation, cut back or delete an account
• Outputs designed to promote isolation from family or friends or exclusive reliance on the chatbot
• Encouraging minors to withhold information from parents or other trusted adults
• Statements designed to discourage breaks or suggest the minor needs to return frequently
• Soliciting gifts, in-app purchases or other spending framed as necessary to maintain the relationship

Suicide and self-harm protocol

An operator "may not make available or deploy an AI companion chatbot unless it maintains and implements a protocol for detecting and addressing suicidal ideation or expressions of self-harm by users." This duty covers all users, not only minors.

The protocol must identify expressions of suicidal ideation or self-harm, including eating disorders, refer users to crisis resources such as a suicide hotline or crisis text line, and use reasonable measures to prevent content encouraging or describing how to commit self-harm. The operator must publish the protocol's details and the number of crisis referral notifications issued in the preceding calendar year.

Who enforces HB 2225, and can you sue?

RCW 19.440.060 declares a violation "an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW." It also finds that the covered practices vitally affect the public interest. The Attorney General can bring Consumer Protection Act actions under RCW 19.86.080.

The chapter does not say who else may sue, and it lacks the Attorney General-only sentence found in the provenance law. RCW 19.86.090 lets a person injured in business or property by a violation of RCW 19.86.020 sue for an injunction, actual damages or both, with costs and a reasonable attorney's fee. A court may increase the award up to three times actual damages, and the increased award may not exceed $25,000.

So the text points to a private claim, limited to people injured in business or property. The chapter never uses the words "private right of action." The House bill report summarizes testimony from supporters and opponents who described the bill as carrying one, but the report says it is not part of the legislation. A web search found no court ruling on it, and the chapter is not yet in force.

Chapter 19.440 sets no dollar figure of its own. The Consumer Protection Act's general penalty section, RCW 19.86.140, sets a civil penalty of up to $7,500 for each violation of RCW 19.86.020. For unlawful acts or practices that target or impact specific individuals or communities based on demographic characteristics, including age, an enhanced penalty of $5,000 applies.

SB 5984, the Senate companion bill, passed the Senate 38-11 on February 12, 2026 but did not pass the Legislature. ESHB 2225 is the version that became law.

HB 1170 (Chapter 19.435 RCW): AI Provenance Data and Watermarks

E2SHB 1170 was signed March 24, 2026 and takes effect February 1, 2027. It is often called an AI disclosure law, but it does not make private companies tell each user that content came from AI. Its private-sector duty is technical: embed provenance data in certain media.

Who is a covered provider

RCW 19.435.010 reaches a person or entity that "creates, codes, or otherwise produces a generative artificial intelligence system that has over 1,000,000 monthly users and is publicly accessible within the geographic boundaries of the state to consumers for personal use." State, local and tribal governments are excluded.

Three points are often reported wrong:

• The text does not limit the 1,000,000 monthly users to users in Washington.
• The enrolled text has no revenue test.
• The chapter defines generative AI as technology that generates "images, audio, or video." Text-only generation is outside it.

What covered providers must do

"To the extent commercially and technically reasonable," a covered provider must include provenance data in video, image or audio content "created or materially altered" by its system. The data must let a user assess whether the system created or materially altered the content, and the provider must use commercially and technically reasonable methods to make it difficult to remove or tamper with.

Using a commonly supported technical standard for watermarking or metadata, "such as the coalition for content provenance and authenticity specification," counts as compliant with the anti-tamper duty. Minor modifications, such as changes to brightness, resizing, cropping and format conversions, do not count as material alterations.

The chapter does not apply to business-to-business uses, products that provide exclusively video game or interactive experiences, or systems used solely for upscaling, noise reduction or compression. It does not require disclosing trade secrets or adding information about an identifiable person to the provenance data.

Enforcement: Attorney General only

The Attorney General may sue in the name of the state or on behalf of residents, and for those actions a violation is an unfair or deceptive act under the Consumer Protection Act. RCW 19.435.030(3) is explicit: "Only the attorney general can bring an action under the consumer protection act, chapter 19.86 RCW, pursuant to this section." Any waiver of the chapter is void.

Government agencies must disclose AI

Section 6 of the act creates chapter 42.64 RCW. A government agency that makes available an AI system intended to interact with consumers must disclose, before or at the time of interaction, that the consumer is interacting with AI.

The disclosure must be clear and conspicuously posted, in plain language, and free of dark patterns. The agency must disclose "regardless of whether it would be obvious to a reasonable consumer." This is the one direct AI notice duty in the act, and it binds agencies, not private companies.

Washington's agency duty starts February 1, 2027. Our AI laws hub compares AI disclosure and labeling laws across states.

AI in Washington Government

Privacy review (HB 2606). Since June 11, 2026, RCW 43.105.369(3)(e) has given the Office of Privacy and Data Protection a duty "to participate with the agency in the review of major state agency projects involving personally identifiable information, including projects using artificial intelligence."

Executive orders. The Governor's executive order list showed 17 orders by Governor Ferguson on November 4, 2026, and none has AI in its title. Executive Order 25-05 set up a Data Center Workgroup. Former Governor Inslee's Executive Order 24-01 directed state technology and procurement agencies to produce guidelines on generative AI in state government. We did not confirm that order's current status.

Washington AI Task Force Final Report (E2SSB 5838)

The Legislature created the task force through E2SSB 5838 in 2024, with the Attorney General's Office as administrator. It released a preliminary report on December 30, 2024, an interim report on December 1, 2025 and its Final Report on July 1, 2026, the last of the three reports the Legislature required.

The Final Report makes 11 recommendations. Its own table sorts them this way:

These are recommendations, not law.

AI in Employment and Other Bills That Did Not Pass

In the 2025-26 session laws posted on November 4, 2026 and a stored copy of the state code retrieved July 29, 2026, we found no enacted Washington statute aimed at AI in hiring or workplace monitoring. HB 1672 was the main attempt, and it stayed in House Appropriations after being reintroduced and retained in present status on January 12, 2026.

As introduced, HB 1672 would have limited electronic monitoring and automated decision systems at work. Its penalties would have been set by the Department of Labor and Industries: not less than $1,000, with a $1,000 cap on a first violation and a schedule for repeat violations of up to $10,000 per violation. None of that is Washington law.

Other 2025-26 AI bills that were not enacted:

• SHB 2157 and SB 6120 (high-risk AI): SHB 2157 went to the House Rules "X" file on February 19, 2026. SB 6120 stayed in Senate committee.
• SHB 2503 (AI training data) and SHB 1168 (transparency in AI): both stopped in committee.
• HB 2667 and SSB 6284 (AI consumer protections): both stopped in committee.
• SB 5870 (civil liability for suicide linked to AI): stayed in Senate committee.
• SSB 5956 (AI, student discipline and surveillance in public schools) and 2SHB 1833 (AI grant program): both were returned to Rules on March 12, 2026.
• 2SHB 1622 and SSB 5422 (collective bargaining over AI): not enacted.
• SHB 2144 (employee monitoring notices): stayed in House Appropriations.

We found no governor's veto of a Washington AI bill.

Deepfakes and Forged Digital Likenesses in Washington

SHB 1205 (2025) made it criminal impersonation in the second degree, a gross misdemeanor, to knowingly distribute a forged digital likeness as genuine with intent to defraud, harass, threaten or intimidate, or for any other unlawful purpose, under RCW 9A.60.045. SSB 5886 (2026) added forged digital likenesses to the personality rights in chapter 63.60 RCW, with a $3,000 civil penalty plus actual and noneconomic damages. 2ESSB 5105 (2026) revised the law on fabricated sexual depictions of minors, and RCW 29B.35.010 lets a candidate sue the sponsor of an electioneering communication that alters the candidate through synthetic media. Our Washington deepfake laws page covers each of these in detail.

AI Note-Takers and Recording Consent in Washington

Washington's recording statute, RCW 9.73.030, generally bars recording a private communication or conversation without the consent of all participants, and an announcement that is itself recorded can supply that consent. See Washington AI meeting recording laws for how that applies to AI note-takers.

Federal Law and Washington's AI Statutes

As of November 4, 2026, we found no federal statute in the public laws of the 119th Congress that sets general rules for private AI systems or generally preempts state AI laws. In December 2025, Executive Order 14365 directed federal agencies to challenge or discourage state AI laws the administration views as conflicting with national policy, and called for a federal framework from Congress. The order itself does not declare any state law invalid. The Justice Department formed an AI Litigation Task Force in January 2026, the White House issued legislative recommendations in March 2026, and the FTC proposed a policy statement in July 2026. Separately, in April 2026 the Justice Department intervened in a lawsuit against Colorado's AI law under the Civil Rights Act of 1964. We did not find a published Commerce evaluation of state laws in the Federal Register or on ntia.gov, or a BEAD notice carrying the order's AI condition on NTIA's sites.

What Changes in Washington AI Law in 2027

Bills for the 2027 session

As of November 4, 2026, we found no 2027 Washington AI bill. The Legislature's web service listed no prefiled bills that day, and the 2027 session has not convened. Bills from the 2025-26 biennium do not carry over, so anything on high-risk AI, training data or workplace AI would need a new bill.

We also found no court challenge to a Washington AI statute and no Attorney General enforcement action under one, in a web search that was not exhaustive.

More Washington Laws

Explore other Washington law topics on Recording Law:

• Washington Recording Laws
• Washington Data Privacy Laws
• Washington Whistleblower Laws
• Washington Sexting Laws
• Washington Deepfake Laws
• Washington AI Meeting Recording Laws

Frequently Asked Questions

Does Washington state have an AI law?

Yes, several targeted ones, but we found no comprehensive AI law in the 2025-26 session laws posted on November 4, 2026 and a stored copy of the state code retrieved July 29, 2026. E2SSB 5395 limits AI in health insurance prior authorization and has been in force since June 11, 2026. The AI companion chatbot law (ESHB 2225) starts January 1, 2027, and the AI provenance law (E2SHB 1170) starts February 1, 2027.

When does Washington HB 2225 take effect?

January 1, 2027. Every section of chapter 19.440 RCW is marked effective on that date, so its chatbot duties do not apply before then.

When does Washington HB 1170 take effect?

February 1, 2027, under section 9 of chapter 167, Laws of 2026. That date covers both chapter 19.435 RCW and the government agency disclosure duty.

Do AI chatbots have to tell you they are AI in Washington?

Starting January 1, 2027, an AI companion chatbot must disclose that it is artificially generated and not human at the start of an interaction and at least every three hours. For a user the operator knows is a minor, or a chatbot directed to minors, the notice comes at least every hour. Bots outside the definition, such as customer service bots that do not sustain a relationship across interactions and elicit emotional responses, are not covered.

Can a health insurer in Washington use AI to deny care?

Not on its own. Under RCW 48.43.830, AI shall not be the sole means used to deny, delay, or modify health care services, and only a licensed physician or licensed health professional may deny a prior authorization request based on medical necessity. Algorithms may still process and approve requests.

Does Washington's AI disclosure law require a label on AI text?

No. Chapter 19.435 RCW covers image, audio and video content. It requires covered providers to include provenance data to the extent commercially and technically reasonable, and it does not reach text-only generation.

Who has to comply with Washington HB 1170?

A person or entity that produces a generative AI system with over 1,000,000 monthly users that is publicly accessible in Washington to consumers for personal use. Government agencies have a separate duty to disclose AI systems that interact with consumers. Business-to-business uses are excluded.

Can I sue under Washington's AI chatbot law?

The text points that way if you were injured in your business or property. RCW 19.440.060 makes a violation an unfair or deceptive act under the Consumer Protection Act and has no Attorney General-only limit, and RCW 19.86.090 lets a person injured in business or property sue. The chapter does not expressly say who may sue, it is not yet in force, and a web search found no court ruling on it.

Who enforces Washington's AI laws?

It depends on the law. Only the Attorney General can bring a Consumer Protection Act action under chapter 19.435 RCW. Chapter 19.440 RCW runs through the Consumer Protection Act with no such limit. The Office of the Insurance Commissioner may audit carriers' AI policies under RCW 48.43.830.

Does Washington regulate AI in hiring?

In the 2025-26 session laws posted on November 4, 2026 and a stored copy of the state code retrieved July 29, 2026, we found no enacted Washington statute aimed at AI in hiring or workplace monitoring. HB 1672, the main workplace technology bill, was not enacted.

Did Washington pass a high-risk AI law?

No. SHB 2157 and SB 6120 on high-risk AI were not enacted in 2025-26. The AI Task Force's Final Report lists high-risk AI governance among its recommendations that were included in bills but did not become law.

Is there a Washington AI bill for 2027?

We found none as of November 4, 2026. The Legislature's web service listed no prefiled bills that day, and the 2027 session has not convened.

Has Governor Ferguson issued an AI executive order?

None of the 17 orders on the Governor's list on November 4, 2026 has AI in its title. Executive Order 25-05 created a Data Center Workgroup. Former Governor Inslee issued Executive Order 24-01 on generative AI in state government.

Are deepfakes illegal in Washington?

Some are. Knowingly distributing a forged digital likeness as genuine with intent to defraud, harass, threaten or intimidate, or for any other unlawful purpose, is a gross misdemeanor under RCW 9A.60.045. Washington also has civil and election-related remedies, covered on our Washington deepfake laws page.

Is it legal to use an AI note-taker in Washington?

RCW 9.73.030 generally requires the consent of all participants before recording a private communication or conversation, and an announcement that is itself recorded can supply it. Our Washington AI meeting recording laws page covers how that applies to AI note-takers.