Washington State AI Regulations: Current Status

Search "Washington AI law" and the honest answer is that there isn't one — not in the way there's a Colorado AI Act or a EU AI Act. What Washington has instead is five separate statutes, each written for a different problem, that happen to reach most AI products anyway: a 2023 health-data privacy law, a 2020 law about government use of facial recognition, and three 2026 arrivals covering companion chatbots, AI-generated media, and AI in health-insurance decisions. A compliance team that goes looking for "the Washington AI statute" and finds nothing can end up concluding the state is unregulated territory. It isn't. It's regulated by accumulation rather than by design, and that's arguably harder to get right, not easier.

Five statutes, not one

None of the five below was drafted as a general AI law, and that's the point: each one was built around a specific harm — health-data misuse, government surveillance, manipulative chatbots, deepfakes, wrongful insurance denials — and AI products get swept in because they happen to touch that harm. A system can clear four of the five and still be fully exposed under the fifth, because passing one doesn't say anything about the others. California and New York show the same pattern — a scattered set of statutes rather than one omnibus law — and so does Connecticut's 2026 statute, which replaced a failed Colorado-style bill with four narrower obligation tracks. Washington's version is now dense enough to need its own map.

The My Health My Data Act: not an AI law, but the broadest net

The My Health My Data Act (MHMDA), signed April 27, 2023, is Washington's most consequential AI-adjacent statute, and it contains the word "AI" nowhere in its text. It regulates any entity — not just HIPAA-covered providers — that collects "consumer health data," a term the statute defines broadly enough to cover inferred and derived health information, not just medical records. Most of its substantive duties, including the requirement to publish a privacy policy describing what health data is collected and why, took effect March 31, 2024 for larger regulated entities and June 30, 2024 for small businesses; a geofencing prohibition around health facilities took effect earlier, on July 23, 2023, because the legislature didn't set a separate date for it and Washington's default rule for new statutes applied.

The provision that should worry a product team the most is the sale-authorization rule: selling consumer health data requires a signed authorization that's separate and distinct from whatever consent covers ordinary collection or sharing. And unlike most state privacy statutes, MHMDA carries a private right of action through Washington's Consumer Protection Act — an individual doesn't need the attorney general to act first. None of this is AI-specific, but a symptom-checking chatbot, a mental-wellness app, or any AI feature that infers something about a user's health status is processing exactly the kind of data MHMDA was built to cover.

The 2020 facial-recognition law nobody associates with "AI regulation"

Three years before generative AI entered mainstream conversation, Washington passed ESSB 6280, a facial-recognition statute that took effect July 1, 2021 and still governs a slice of AI deployment today. It applies to state and local government agencies — and the vendors that supply them — using facial recognition services for identification, verification, or persistent tracking. Before adopting the technology, an agency has to publish an accountability report describing the system's capabilities and limits and how it was tested; law enforcement generally needs a warrant to use it in an investigation, absent an emergency; and the law carves out the Department of Licensing along with narrow permitted uses like locating missing persons.

This one rarely shows up in "Washington AI law" searches because it predates the current AI conversation and because it regulates government use rather than general commercial deployment. But any company selling facial-recognition software into a Washington state or local agency inherits the accountability-report and fairness-testing obligations as part of that contract, regardless of how new or old the underlying model is.

HB 2225: companion chatbots get a disclosure duty and real teeth

Signed by Governor Bob Ferguson on March 24, 2026, HB 2225 is Washington's first statute written specifically for AI companion chatbots — systems designed to simulate a sustained, human-like relationship with a user. It excludes ordinary customer-service bots, general-purpose virtual assistants, and narrowly tailored educational or in-game tools, so the scope is meant to catch persona-driven companion products, not every conversational interface a business runs.

The core obligation is disclosure on a schedule: a covered chatbot has to tell the user it's artificial at the start of an interaction, and repeat that disclosure at least every three hours for adult users and every hour for users the operator knows are minors. The bot also can't claim to be human if a user asks, or otherwise generate output that contradicts the disclosure. Operators of chatbots used by minors additionally need reasonable measures against sexually explicit or suggestive output and a working crisis-referral protocol for users expressing self-harm risk. What separates HB 2225 from most comparable state statutes is enforcement: a violation is treated as an unfair or deceptive act under Washington's Consumer Protection Act, which means an individual user can sue directly rather than waiting on the attorney general. The obligations take effect January 1, 2027, which leaves a real but narrowing runway to build the disclosure cadence into the product rather than retrofitting it under deadline pressure.

HB 1170: provenance data for AI-generated images, video, and audio

Washington's second 2026 arrival, HB 1170, targets AI-generated media rather than conversation. Signed the same day as HB 2225, it requires covered providers to offer a free tool letting the public check whether a piece of image, video, or audio content was created or materially altered by their generative AI system, and to support both an optional visible label and embedded disclosure data identifying the provider, system version, and a timestamp. Reporting on who counts as a "covered provider" has been inconsistent: an earlier draft used a compute-and-revenue test modeled on frontier-AI definitions elsewhere, but the Washington State Senate's own bill report on the final, amended version describes the enacted threshold as providers with more than one million monthly users of a publicly accessible generative AI system in the state — a materially different and much lower bar. Companies near either threshold should check the enrolled statute directly rather than relying on secondary summaries, this one included. HB 1170 is enforced exclusively through the attorney general, with no private right of action, and its obligations begin in February 2027.

SB 5395: AI can help decide prior authorization, but can't say no alone

The one 2026 Washington AI statute already in force is SB 5395, the Prior Authorization Transparency Act, effective June 11, 2026. It applies to health carriers, health benefit managers, and public employee health plans, and it draws a specific line: AI can be used to process and even approve a prior-authorization request, but a denial based on medical necessity has to be reviewed and made by a licensed health care provider — AI can't be the final word on a "no." Carriers also have to report to the state insurance commissioner how many prior-authorization denials involved AI assistance, giving the state an ongoing data trail on how much weight insurers are actually putting on automated review. Unlike HB 2225, SB 5395 doesn't create a private right of action — it's enforced through the insurance commissioner's existing regulatory authority over carriers, the same channel Washington uses for other insurance-practice violations.

Where this lands on a real company

Take Rainier Wellness, a hypothetical Seattle-based telehealth startup running a chat-based symptom-triage assistant with a warm, persistent persona it markets as a "wellness companion." Rainier has to run its product against all five statutes, not pick the one that seems most relevant. MHMDA applies immediately, because a symptom-triage tool collects exactly the kind of inferred health data the statute defines broadly, and that means a compliant privacy policy and — if Rainier ever sells aggregated data to a research partner — a separate signed authorization. HB 2225 is a live question too: if the assistant's "companion" branding and persistent personality push it into the statute's definition of a sustained human-like relationship, Rainier needs the three-hour disclosure cadence and crisis-referral protocol in place well before January 2027. If Rainier later signs a contract to feed its triage data into a health plan's prior-authorization workflow, SB 5395 kicks in immediately, requiring clinician review of any AI-influenced denial. Meanwhile, HB 1170 and the 2020 facial-recognition law almost certainly don't apply — Rainier isn't generating synthetic image or video content at the scale HB 1170 targets, and it isn't selling to a government agency. The lesson isn't that every statute applies to every company; it's that each one has its own trigger, and skipping the inventory step is how a team ends up compliant with the one law it already knew about and exposed under two it never checked.

What's still missing, and what to watch

As of this writing, Washington has not enacted anything resembling Colorado's general duty-of-care standard for high-risk AI systems, and nothing currently moving through the legislature looks likely to consolidate these five instruments into one statute. That's a deliberate pattern now, not an oversight: narrower, use-case-specific bills have passed in back-to-back sessions while broader AI bills elsewhere have stalled or been scaled back before signing, including Washington's own HB 1170, whose covered-provider threshold was narrowed during negotiation. The unresolved fight over whether federal law could eventually preempt statutes like these is worth tracking for exactly this reason — nothing currently in effect displaces any of Washington's five laws, but a compliance program built around today's patchwork should expect more additions, not fewer, in the next legislative session.