High-risk AI

AN ACT Relating to regulating high-risk artificial intelligence 1
system development, deployment, and use; adding a new chapter to 2
Title 19 RCW; and providing an effective date. 3
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:4
NEW SECTION. Sec. 1. The definitions in this section apply 5
throughout this chapter unless the context clearly requires 6
otherwise.7
(1)(a) "Algorithmic discrimination" means the use of an 8
artificial intelligence system that results in an unlawful 9
differential treatment or impact that disfavors an individual or 10
group of individuals on the basis of their actual or perceived age, 11
color, disability, ethnicity, genetic information, limited 12
proficiency in the English language, national origin, race, religion, 13
reproductive health, sex, sexual orientation, veteran status, or 14
other classification protected under state or federal law.15
(b) "Algorithmic discrimination" does not include:16
(i) The offer, license, or use of a high-risk artificial 17
intelligence system by a developer or deployer for the sole purpose 18
of the developer's or deployer's self-testing to identify, mitigate, 19
or prevent discrimination or otherwise ensure compliance with state 20
and federal law; 21
H-2556.1
HOUSE BILL 2157
State of Washington 69th Legislature 2026 Regular Session
By Representatives Ryu, Stearns, Ramel, Parshley, Reeves, Reed,
Santos, Zahn, Street, Duerr, Gregerson, Ormsby, Scott, Shavers, Thai,
Macri, Fosse, Pollet, and Donaghy
Prefiled 12/16/25. Read first time 01/12/26. Referred to Committee
on Technology, Economic Development, & Veterans.
p. 1 HB 2157
(ii) The expansion of an applicant, customer, or participant pool 1
to increase diversity or redress historical discrimination; or2
(iii) An act or omission by or on behalf of a private club or 3
other establishment not in fact open to the public, as set forth in 4
Title II of the civil rights act of 1964, 42 U.S.C. Sec. 2000a(e), as 5
subsequently amended. 6
(2)(a) "Artificial intelligence system" means machine learning 7
systems and related technologies that use data to train statistical 8
models for the purpose of enabling computer systems to perform tasks 9
normally associated with human intelligence or perception, such as 10
computer vision, speech or natural language processing, and content 11
generation. 12
(b) "Artificial intelligence system" does not include any 13
artificial intelligence system that is used for development, 14
prototyping, and research activities before such artificial 15
intelligence system is made available to deployers or consumers.16
(3) "Consequential decision" means any decision that has a 17
material legal, or similarly significant, effect on the provision or 18
denial to any consumer of: 19
(a) Parole, probation, a pardon, or any other release from 20
incarceration or court supervision; 21
(b) Education enrollment or an education opportunity;22
(c) Access to employment; 23
(d) A financial or lending service; 24
(e) Access to health care services; 25
(f) Housing; 26
(g) Insurance; 27
(h) Marital status; or 28
(i) A legal service. 29
(4)(a) "Consumer" means a natural person who is a resident of 30
Washington and is acting only in an individual or household context.31
(b) "Consumer" does not include a natural person acting in a 32
commercial or employment context. 33
(5) "Deployer" means any person doing business in Washington that 34
deploys or uses a high-risk artificial intelligence system to make a 35
consequential decision in Washington. 36
(6) "Developer" means any person doing business in Washington 37
that develops or intentionally and substantially modifies a high-risk 38
artificial intelligence system that is offered, sold, leased, given, 39
p. 2 HB 2157
or otherwise made available to deployers or consumers in Washington 1
and who earns more than $100,000 in gross annual revenue.2
(7)(a) "Facial recognition" means the use of a computer system 3
that, for the purpose of attempting to determine the identity of an 4
unknown individual, uses an algorithm to compare the facial biometric 5
data of an unknown individual derived from a photograph, video, or 6
image to a database of photographs or images and associated facial 7
biometric data in order to identify potential matches to an 8
individual. 9
(b) "Facial recognition" does not include facial verification 10
technology, which involves the process of comparing an image or 11
facial biometric data of a known individual, where such information 12
is provided by that individual, to an image database, or to 13
government documentation containing an image of the known individual, 14
to identify a potential match in pursuit of the individual's 15
identity. 16
(8)(a) "General-purpose artificial intelligence model" means a 17
model used by an artificial intelligence system or other system that: 18
(i) Displays significant generality; (ii) is capable of competently 19
performing a wide range of distinct tasks; and (iii) can be 20
integrated into a variety of downstream applications or systems.21
(b) "General-purpose artificial intelligence model" does not 22
include any artificial intelligence model that is used for 23
development, prototyping, and research activities before such 24
artificial intelligence model is made available to deployers or 25
consumers. 26
(9) "Generative artificial intelligence system" means an 27
artificial intelligence system that generates novel data or content 28
based on a foundation model. 29
(10)(a) "High-risk artificial intelligence system" means any 30
artificial intelligence system that is specifically intended to 31
autonomously make, or be a substantial factor in making, a 32
consequential decision. A system or service is not a "high-risk 33
artificial intelligence system" if it is intended to: (i) Perform a 34
narrow procedural task; (ii) improve the result of a previously 35
completed human activity; (iii) detect any decision-making patterns 36
or any deviations from preexisting decision-making patterns; or (iv) 37
perform a preparatory task to an assessment relevant to a 38
consequential decision. 39
p. 3 HB 2157
(b) "High-risk artificial intelligence system" does not include 1
any of the following technologies: 2
(i) Antifraud technology that does not use facial recognition 3
technology; 4
(ii) Antimalware technology; 5
(iii) Antivirus technology; 6
(iv) Artificial intelligence-enabled video games;7
(v) Autonomous vehicle technology; 8
(vi) Calculators; 9
(vii) Cybersecurity technology; 10
(viii) Databases; 11
(ix) Data storage; 12
(x) Firewall technology; 13
(xi) Internet domain registration; 14
(xii) Internet website loading; 15
(xiii) Networking; 16
(xiv) Spam and robocall filtering; 17
(xv) Spell-checking technology; 18
(xvi) Spreadsheets; 19
(xvii) Web caching; 20
(xviii) Web hosting or any similar technology; or21
(xix) Technology that communicates with consumers in natural 22
language for the purpose of providing users with information, making 23
referrals or recommendations, and answering questions and is subject 24
to an acceptable use policy that prohibits generating content that is 25
discriminatory or unlawful. 26
(11)(a) "Intentional and substantial modification" means a 27
deliberate change made to: (i) An artificial intelligence system that 28
results, at the time when the change is implemented and any time 29
thereafter, in a new material risk of algorithmic discrimination; or 30
(ii) a general-purpose artificial intelligence model that affects 31
compliance of the general-purpose artificial intelligence model, 32
materially changes the purpose of the general-purpose artificial 33
intelligence model, or results in a new reasonably foreseeable risk 34
of algorithmic discrimination. 35
(b) "Intentional and substantial modification" does not include:36
(i) Any customization made by deployers that: 37
(A) Is based on legitimate nondiscriminatory business 38
justifications; 39
p. 4 HB 2157
(B) Is within the scope and purpose of the artificial 1
intelligence tool; and 2
(C) Does not result in a material change to the risks of 3
algorithmic discrimination; or 4
(ii) A change made to a high-risk artificial intelligence system, 5
or the performance of a high-risk artificial intelligence system, if:6
(A) The high-risk artificial intelligence system continues to 7
learn after such high-risk artificial intelligence system is offered, 8
sold, leased, licensed, given, or otherwise made available to a 9
deployer, or deployed; and 10
(B) Such change is made to such high-risk artificial intelligence 11
system as a result of such learning and was predetermined by the 12
deployer or the third party contracted by the deployer and included 13
within the initial impact assessment of such high-risk artificial 14
intelligence system as required by section 3 of this act.15
(12) "Machine learning" means the process by which artificial 16
intelligence is developed using data and algorithms to draw 17
inferences therefrom to automatically adapt or improve its accuracy 18
without explicit programming. 19
(13)(a) "Person" includes any individual, corporation, 20
partnership, association, cooperative, limited liability company, 21
trust, joint venture, or any other legal or commercial entity and any 22
successor, representative, agent, agency, or instrumentality thereof.23
(b) "Person" does not include any government or political 24
subdivision. 25
(14) "Principal basis" means the use of an output of a high-risk 26
artificial intelligence system to make a decision without human 27
review, oversight, involvement, or intervention or without meaningful 28
consideration by a human. 29
(15)(a) "Substantial factor" means a factor that: (i) Uses the 30
principal basis for making a consequential decision; (ii) is capable 31
of altering the outcome of a consequential decision; and (iii) is 32
generated by an artificial intelligence system. 33
(b) "Substantial factor" includes any use of an artificial 34
intelligence system to generate any content, decision, prediction, or 35
recommendation concerning a consumer that is used as the principal 36
basis to make a consequential decision concerning the consumer.37
(16) "Synthetic content" means information, such as images, 38
video, audio clips, and, to the extent practicable, text, that has 39
p. 5 HB 2157
been significantly modified or generated by algorithms, including by 1
artificial intelligence. 2
(17) "Trade secret" means information, including a formula, 3
pattern, compilation, program, device, method, technique, or process, 4
that derives independent economic value, actual or potential, from 5
not being generally known to, and not being readily ascertainable by 6
proper means by, other persons who can obtain economic value from its 7
disclosure or use and is the subject of efforts that are reasonable 8
under the circumstances to maintain its secrecy. 9
NEW SECTION. Sec. 2. (1) A developer of a high-risk artificial 10
intelligence system shall use reasonable care to protect consumers 11
from any known or reasonably foreseeable risks of algorithmic 12
discrimination arising from the intended and contracted uses of the 13
high-risk artificial intelligence system. In a civil action brought 14
against a developer pursuant to this chapter, there is a rebuttable 15
presumption that a developer of a high-risk artificial intelligence 16
system used reasonable care as required by this subsection (1) if the 17
developer complied with the requirements of this section.18
(2) A developer of a high-risk artificial intelligence system may 19
not offer, sell, lease, give, or otherwise provide to a deployer or 20
other developer a high-risk artificial intelligence system unless the 21
developer makes available to the deployer or other developer:22
(a) A statement disclosing the intended uses of such high-risk 23
artificial intelligence system; 24
(b) Documentation disclosing the following: 25
(i) The known or reasonably known limitations of such high-risk 26
artificial intelligence system, including any and all known or 27
reasonably foreseeable risks of algorithmic discrimination arising 28
from the intended uses of such high-risk artificial intelligence 29
system; 30
(ii) The purpose of such high-risk artificial intelligence system 31
and its intended outputs, benefits, and uses; 32
(iii) A summary describing how such high-risk artificial 33
intelligence system was evaluated for performance and for mitigation 34
of algorithmic discrimination before it was licensed, sold, leased, 35
given, or otherwise made available to a deployer or other developer;36
(iv) A description of the measures the developer has taken to 37
mitigate known or reasonably foreseeable risks of algorithmic 38
discrimination that may arise from the reasonably foreseeable 39
p. 6 HB 2157
deployment or use of such high-risk artificial intelligence system; 1
and 2
(v) A description of how the high-risk artificial intelligence 3
system should be used, not be used, and be monitored by an individual 4
when such system is used to make, or is a substantial factor in 5
making, a consequential decision; and 6
(c) Any additional documentation that is reasonably necessary to 7
assist the deployer or other developer in understanding the outputs 8
and monitoring performance of the high-risk artificial intelligence 9
system for risks of algorithmic discrimination. 10
(3) A developer that offers, sells, leases, gives, or otherwise 11
makes available to a deployer or other developer a high-risk 12
artificial intelligence system shall make available to the deployer 13
or other developer to the extent feasible and necessary, information 14
and documentation to enable the deployer, other developer, or a third 15
party contracted by the deployer to complete an impact assessment 16
required by section 3 (3) of this act. Such information and 17
documentation must include artifacts, such as system cards or 18
predeployment impact assessments, including relevant risk management 19
policies and impact assessments. 20
(4) A developer that also serves as a deployer for a high-risk 21
artificial intelligence system may not be required to generate the 22
documentation required by this section unless such high-risk 23
artificial intelligence system is provided to an unaffiliated entity 24
acting as a deployer or as otherwise required by law.25
(5) High-risk artificial intelligence systems that are in 26
conformity with the latest version of the artificial intelligence 27
risk management framework published by the national institute of 28
standards and technology, standard ISO/IEC 42001 of the international 29
organization for standardization, or another nationally or 30
internationally recognized risk management framework for artificial 31
intelligence systems, or parts thereof, are presumed to be in 32
conformity with related requirements set out in this section.33
(6) For a disclosure required pursuant to this section, a 34
developer shall, no later than 90 days after the developer performs 35
an intentional and substantial modification to a high-risk artificial 36
intelligence system, update such disclosure as necessary to ensure 37
that such disclosure remains accurate. 38
(7)(a) A developer of a high-risk generative artificial 39
intelligence system that generates or substantially modifies 40
p. 7 HB 2157
synthetic content shall ensure that the outputs of such high-risk 1
artificial intelligence system: (i) Are identifiable and detectable 2
in a manner that is accessible by consumers using industry-standard 3
tools or tools provided by the developer; (ii) comply with any 4
applicable accessibility requirements, as synthetic content, to the 5
extent reasonably feasible; and (iii) apply such identification at 6
the time the output is generated. 7
(b) If such synthetic content is an audio, image, or video format 8
that forms part of an evidently artistic, creative, satirical, 9
fictional, or analogous work or program, the requirement for 10
identifying outputs of high-risk artificial intelligence systems 11
pursuant to (a) of this subsection (7) is limited to a manner that 12
does not hinder the display or enjoyment of such work or program.13
(c) The identification of outputs required by (a) of this 14
subsection (7) do not apply to: (i) Synthetic content that consists 15
exclusively of text, is published to inform the public on any matter 16
of public interest, or is unlikely to mislead a reasonable person 17
consuming such synthetic content; or (ii) the outputs of a high-risk 18
artificial intelligence system that performs an assistive function 19
for standard editing, does not substantially alter the input data 20
provided by the developer, or is used to detect, prevent, 21
investigate, or prosecute any crime as authorized by law.22
(8) Where multiple developers directly contribute to the 23
development of a high-risk artificial intelligence system, each 24
developer is subject to the obligations and operating standards 25
applicable to developers pursuant to this section solely with respect 26
to its activities contributing to the development of the high-risk 27
artificial intelligence system. 28
(9) Nothing in this section may be construed to require a 29
developer to disclose any trade secret, information that could create 30
a security risk, or other confidential or proprietary information 31
protected under state or federal law. 32
NEW SECTION. Sec. 3. (1) A deployer of a high-risk artificial 33
intelligence system shall use reasonable care to protect consumers 34
from any known or reasonably foreseeable risks of algorithmic 35
discrimination. In a civil action brought against a deployer pursuant 36
to this chapter, there is a rebuttable presumption that a deployer of 37
a high-risk artificial intelligence system used reasonable care as 38
p. 8 HB 2157
required by this subsection (1) if the deployer complied with the 1
provisions of this section. 2
(2)(a) A deployer may not deploy or use a high-risk artificial 3
intelligence system to make a consequential decision unless the 4
deployer has designed and implemented a risk management policy and 5
program for such high-risk artificial intelligence system. The risk 6
management policy must specify the principles, processes, and 7
personnel that the deployer must use in maintaining the risk 8
management program to identify, mitigate, and document any risk of 9
algorithmic discrimination that is a reasonably foreseeable 10
consequence of deploying or using such high-risk artificial 11
intelligence system to make a consequential decision.12
(b) A risk management policy and program designed, implemented, 13
and maintained pursuant to this section is presumed to be in 14
conformity with related requirements set out in this section if the 15
policy and program align with the guidance and standards set forth in 16
the latest version of: 17
(i) The artificial intelligence risk management framework 18
published by the national institute of standards and technology;19
(ii) Standard ISO/IEC 42001 of the international organization for 20
standardization; or 21
(iii) A nationally or internationally recognized risk management 22
framework for artificial intelligence systems with requirements that 23
are substantially equivalent to, and at least as stringent as, the 24
guidance and standards described in (b)(i) and (ii) of this 25
subsection (2). 26
(c) High-risk artificial intelligence systems that are in 27
conformity with the latest version of the artificial intelligence 28
risk management framework published by the national institute of 29
standards and technology, standard ISO/IEC 42001 of the international 30
organization for standardization, or another nationally or 31
internationally recognized risk management framework for artificial 32
intelligence systems, or parts thereof, are presumed to be in 33
conformity with related requirements set out in this section.34
(3)(a) Except as provided in (c) of this subsection (3), a 35
deployer may not deploy or use a high-risk artificial intelligence 36
system to make a consequential decision unless the deployer has 37
completed an impact assessment for such high-risk artificial 38
intelligence system. The deployer shall complete an impact assessment 39
for a high-risk artificial intelligence system before the deployer 40
p. 9 HB 2157
initially deploys such high-risk artificial intelligence system and 1
before a significant update to such high-risk artificial intelligence 2
system is used to make a consequential decision. 3
(b) An impact assessment completed pursuant to (a) of this 4
subsection (3) must include, at a minimum: 5
(i) A statement by the deployer disclosing the purpose, intended 6
use cases, and deployment context of, and benefits afforded by, the 7
high-risk artificial intelligence system; 8
(ii) A statement by the deployer disclosing whether the 9
deployment or use of the high-risk artificial intelligence system 10
poses any known or reasonably foreseeable risk of algorithmic 11
discrimination and, if so, the nature of such algorithmic 12
discrimination and the steps that have been taken, to the extent 13
feasible, to mitigate such risk; 14
(iii) For each postdeployment impact assessment completed 15
pursuant to this section, whether the intended use cases of the high-16
risk artificial intelligence system as updated were consistent with, 17
or varied from, the developer's intended uses of such high-risk 18
artificial intelligence system; 19
(iv) A description of the categories of data the high-risk 20
artificial intelligence system processes as inputs and the outputs 21
such high-risk artificial intelligence system produces;22
(v) If the deployer used data to customize the high-risk 23
artificial intelligence system, an overview of the categories of data 24
the deployer used to customize such high-risk artificial intelligence 25
system; 26
(vi) A list of any metrics used to evaluate the performance and 27
known limitations of the high-risk artificial intelligence system;28
(vii) A description of any transparency measures taken concerning 29
the high-risk artificial intelligence system, including any measures 30
taken to disclose to a consumer that such high-risk artificial 31
intelligence system is in use when such high-risk artificial 32
intelligence system is in use; 33
(viii) A description of any postdeployment monitoring performed 34
and user safeguards provided concerning such high-risk artificial 35
intelligence system, including any oversight process established by 36
the deployer to address issues arising from deployment or use of such 37
high-risk artificial intelligence system as such issues arise; and38
p. 10 HB 2157
(ix) An analysis of such high-risk artificial intelligence 1
system's validity and reliability in accordance with standard 2
industry practices. 3
(c)(i) A single impact assessment may address a comparable set of 4
high-risk artificial intelligence systems deployed or used by a 5
deployer. 6
(ii) If a deployer completes an impact assessment for the purpose 7
of complying with another applicable law or regulation, such impact 8
assessment satisfies the relevant requirements established in this 9
section if such impact assessment is reasonably similar in scope and 10
effect to the impact assessment that would otherwise be completed 11
pursuant to this section. 12
(iii) A deployer that completes an impact assessment pursuant to 13
this section shall maintain such impact assessment and all records 14
concerning the impact assessment for three years. Throughout the 15
period of time that a high-risk artificial intelligence system is 16
deployed and for a period of at least three years following the final 17
deployment of the high-risk artificial intelligence system, the 18
deployer shall retain all records concerning each impact assessment 19
conducted on the high-risk artificial intelligence system, including 20
all raw data used to evaluate the performance and known limitations 21
of such system. 22
(4) Not later than the time that a deployer uses a high-risk 23
artificial intelligence system to interact with a consumer, the 24
deployer shall disclose to the consumer that the consumer is 25
interacting with an artificial intelligence system. At such time, the 26
deployer shall also disclose to the consumer: 27
(a) The purpose of such high-risk artificial intelligence system;28
(b) The nature of such system; 29
(c) The nature of the consequential decision; 30
(d) The contact information for the deployer; and31
(e) A description of the artificial intelligence system in plain 32
language, which must include: 33
(i) A description of the personal characteristics or attributes 34
that such system will measure or assess; 35
(ii) The method by which the system measures or assesses such 36
attributes or characteristics; 37
(iii) How such attributes or characteristics are relevant to the 38
consequential decisions for which the system should be used;39
(iv) Any human components of such system; and 40
p. 11 HB 2157
(v) How any automated components of such system are used to 1
inform such consequential decisions. 2
(5) A deployer that has deployed a high-risk artificial 3
intelligence system to make a consequential decision concerning a 4
consumer shall transmit to the consumer the consequential decision 5
without undue delay. If such consequential decision is adverse to the 6
consumer and based on personal data beyond information that the 7
consumer provided directly to the deployer, the deployer shall 8
provide to the consumer a statement disclosing the principal reason 9
or reasons for the consequential decision, including:10
(a) The degree to which and manner in which the high-risk 11
artificial intelligence system contributed to the consequential 12
decision; 13
(b) The type of data that was processed by such system in making 14
the consequential decision; and 15
(c) The sources of such data. 16
(6) A deployer shall make readily available a clear statement 17
summarizing how the deployer manages any reasonably foreseeable risk 18
of algorithmic discrimination that may arise from the use or 19
deployment of the high-risk artificial intelligence system.20
(7) For a disclosure required pursuant to this section, each 21
deployer shall, no later than 30 days after the deployer is notified 22
by the developer that the developer has performed an intentional and 23
substantial modification to a high-risk artificial intelligence 24
system, update such disclosure as necessary to ensure that such 25
disclosure remains accurate. 26
(8) A deployer who performs an intentional and substantial 27
modification to a high-risk artificial intelligence system shall 28
comply with the documentation and disclosure requirements for 29
developers pursuant to section 2 of this act. 30
(9) Nothing in this section may be construed to require a 31
deployer to disclose any trade secret, information that could create 32
a security risk, or other confidential or proprietary information 33
protected under state or federal law. 34
NEW SECTION. Sec. 4. (1) Nothing in this chapter may be 35
construed to restrict a developer's or deployer's ability to do the 36
following:37
(a) Comply with federal, state, or municipal ordinances or 38
regulations; 39
p. 12 HB 2157
(b) Comply with a civil, criminal, or regulatory inquiry, 1
investigation, subpoena, or summons by federal, state, local, or 2
other governmental authorities; 3
(c) Cooperate with law enforcement agencies concerning conduct or 4
activity that the developer or deployer reasonably and in good faith 5
believes may violate federal, state, or local law, ordinances, or 6
regulations; 7
(d) Investigate, establish, exercise, prepare for, or defend 8
legal claims; 9
(e) Provide a product or service specifically requested by a 10
consumer; 11
(f) Perform under a contract to which a consumer is a party, 12
including fulfilling the terms of a written warranty;13
(g) Take steps at the request of a consumer prior to entering 14
into a contract; 15
(h) Take immediate steps to protect an interest that is essential 16
for the life or physical safety of the consumer or another 17
individual; 18
(i) Prevent, detect, protect against, or respond to security 19
incidents, identity theft, fraud, harassment, or malicious or 20
deceptive activities; 21
(j) Take actions to prevent, detect, protect against, report, or 22
respond to the production, generation, incorporation, or 23
synthesization of child sex abuse material, or any illegal activity, 24
preserve the integrity or security of systems, or investigate, 25
report, or prosecute those responsible for any such action;26
(k) Engage in public or peer-reviewed scientific or statistical 27
research in the public interest that adheres to all other applicable 28
ethics and privacy laws and is approved, monitored, and governed by 29
an institutional review board that determines, or similar independent 30
oversight entities that determine, that the expected benefits of the 31
research outweigh the risks associated with such research and whether 32
the developer or deployer has implemented reasonable safeguards to 33
mitigate the risks associated with such research; 34
(l) Assist another developer or deployer with any of the 35
obligations imposed by this chapter; or 36
(m) Take any action that is in the public interest in the areas 37
of public health, community health, or population health, but solely 38
to the extent that such action is subject to suitable and specific 39
measures to safeguard the public. 40
p. 13 HB 2157
(2) The obligations imposed on developers or deployers by this 1
chapter do not restrict a developer's or deployer's ability to:2
(a) Conduct internal research to develop, improve, or repair 3
products, services, or technologies; 4
(b) Effectuate a product recall; 5
(c) Identify and repair technical errors that impair existing or 6
intended functionality; or 7
(d) Perform internal operations that are reasonably aligned with 8
the expectations of the consumer or reasonably anticipated based on 9
the consumer's existing relationship with the developer or deployer.10
(3) Nothing in this chapter may be construed to impose any 11
obligation on a developer or deployer to disclose trade secrets or 12
information protected from disclosure by state or federal law.13
(4) The obligations imposed on developers or deployers by this 14
chapter do not apply where compliance by the developer or deployer 15
with such obligations would violate an evidentiary privilege under 16
federal law or the laws of Washington. 17
(5) Nothing in this chapter may be construed to impose any 18
obligation on a developer or deployer that adversely affects the 19
legally protected rights or freedoms of any person, including the 20
rights of any person to freedom of speech or freedom of the press 21
guaranteed in the First Amendment to the Constitution of the United 22
States. 23
(6) The obligations imposed on developers or deployers by this 24
chapter do not apply to any artificial intelligence system that is 25
acquired by or for the federal government or any federal agency or 26
department, including the United States department of commerce, the 27
United States department of defense, and the national aeronautics and 28
space administration, unless such artificial intelligence system is a 29
high-risk artificial intelligence system that is used to make, or is 30
a substantial factor in making, a decision concerning employment or 31
housing. 32
(7) The obligations imposed on developers or deployers by this 33
chapter are satisfied for a financial institution, if such financial 34
institution is subject to the jurisdiction of any state or federal 35
regulator under any published guidance or regulations that apply to 36
the use of high-risk artificial intelligence systems and such 37
guidance or regulations. 38
(8)(a) The provisions of this chapter do not apply to any 39
insurer, or any high-risk artificial intelligence system developed by 40
p. 14 HB 2157
or for or deployed by an insurer for use in the business of 1
insurance, if such insurer is regulated and supervised by the office 2
of the insurance commissioner or a comparable federal regulating body 3
and subject to examination by such entity under any existing 4
statutes, rules, or regulations pertaining to unfair trade practices 5
and unfair discrimination, or published guidance or regulations that 6
apply to the use of high-risk artificial intelligence systems and 7
such guidance or regulations aid in the prevention and mitigation of 8
algorithmic discrimination caused by the use of a high-risk 9
artificial intelligence system or any risk of algorithmic 10
discrimination that is reasonably foreseeable as a result of the use 11
of a high-risk artificial intelligence system. 12
(b) Nothing in this chapter may be construed to delegate existing 13
regulatory oversight of the business of insurance to any department 14
or agency other than the office of the insurance commissioner.15
(9) The provisions of this chapter do not apply to the 16
development of an artificial intelligence system that is used 17
exclusively for research, training, testing, or other predeployment 18
activities performed by active participants of any sandbox software 19
or sandbox environment established and subject to oversight by a 20
designated agency or other government entity and that is in 21
compliance with the provisions of this chapter. 22
(10) The provisions of this chapter do not apply to a developer 23
or deployer, or other person who develops, deploys, puts into 24
service, or intentionally modifies, as applicable, a high-risk 25
artificial intelligence system that: 26
(a) Has been approved, authorized, certified, cleared, developed, 27
or granted by a federal agency acting within the scope of the federal 28
agency's authority, or by a regulated entity subject to the 29
supervision and regulation of the federal housing finance agency; or30
(b) Is in compliance with standards established by a federal 31
agency or by a regulated entity subject to the supervision and 32
regulation of the federal housing finance agency, if the standards 33
are substantially equivalent or more stringent than the requirements 34
of this chapter. 35
(11) The provisions of this chapter do not apply to a developer 36
or deployer, or other person that facilitates or engages in the 37
provision of telemedicine, as defined in RCW 70.41.020, or is a 38
covered entity within the meaning of the federal health insurance 39
portability and accountability act of 1996 (42 U.S.C. Sec. 1320d et 40
p. 15 HB 2157
seq.) and the regulations promulgated under such federal act, as both 1
may be amended from time to time, if such developer, deployer, or 2
person is providing: 3
(a) Health care recommendations that are generated by an 4
artificial intelligence system and require a health care provider 5
subject to RCW 18.130.040 to take action to implement the 6
recommendations; or 7
(b) Services utilizing an artificial intelligence system for an 8
administrative, quality measurement, security, or internal cost or 9
performance improvement function. 10
(12) If a developer or deployer engages in any action authorized 11
by an exemption set forth in this section, the developer or deployer 12
bears the burden of demonstrating that such action qualifies for such 13
exemption. 14
(13) If a developer or deployer withholds information pursuant to 15
an exemption set forth in this chapter for which disclosure would 16
otherwise be required by this chapter, including the exemption from 17
disclosure of trade secrets, the developer or deployer shall notify 18
the subject of disclosure and provide a basis for withholding the 19
information. If a developer or deployer redacts any information 20
pursuant to an exemption from disclosure, the developer or deployer 21
shall notify the subject of disclosure that the developer or deployer 22
is redacting such information and provide the basis for such decision 23
to redact. 24
(14) For purposes of this section: 25
(a) "Financial institution" means a bank, out-of-state bank, 26
credit union, out-of-state credit union, federal credit union, 27
mortgage lender, or savings institution organized under state or 28
federal law, or any subsidiary, affiliate, or service provider of a 29
financial institution. 30
(b) "Insurer" has the same meaning as defined in RCW 48.01.050.31
NEW SECTION. Sec. 5. (1) In addition to any other remedy 32
provided by law, a person may file a civil action against a developer 33
or deployer for a violation of this chapter. If a court finds that 34
the developer or deployer violated this chapter, the court may enjoin 35
the violation and award reasonable attorneys' fees and costs.36
(2) In an action brought pursuant to this section, it is an 37
affirmative defense that the developer or deployer:38
(a) Discovered a violation of any provision of this chapter;39
p. 16 HB 2157
(b) Cured such violation no later than 45 days after discovering 1
the violation; 2
(c) Provided notice to the person bringing the civil action 3
pursuant to this section that such violation has been cured and 4
provides accompanying evidence that the violation has been cured; and5
(d) Is otherwise in compliance with the requirements of this 6
chapter. 7
NEW SECTION. Sec. 6. This chapter is declared to be remedial, 8
with the purposes of protecting consumers and ensuring consumers 9
receive information about consequential decisions affecting them. The 10
provisions of this chapter granting rights or protections to 11
consumers are construed broadly and exemptions construed narrowly.12
NEW SECTION. Sec. 7. If any provision of this act or its 13
application to any person or circumstance is held invalid, the 14
remainder of the act or the application of the provision to other 15
persons or circumstances is not affected.16
NEW SECTION. Sec. 8. Sections 1 through 6 and 9 of this act 17
constitute a new chapter in Title 19 RCW.18
NEW SECTION. Sec. 9. This act takes effect January 1, 2027.19
--- END ---
p. 17 HB 2157