House Bill 2157 — State of Washington, 69th Legislature, 2026 Regular Session
Summary
House Bill 2157, State of Washington, 69th Legislature, 2026 Regular Session, by Representatives Ryu, Stearns, Ramel, and others, prefiled 12/16/25, read first time 01/12/26 and referred to the Committee on Technology, Economic Development, & Veterans. The bill is an act relating to regulating high-risk artificial intelligence system development, deployment, and use, adding a new chapter to Title 19 RCW, and providing an effective date. The opening text defines terms including algorithmic discrimination, artificial intelligence system, and consequential decision.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“House Bill 2157 — State of Washington, 69th Legislature, 2026 Regular Session.”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2026-01-14-a33628-bill-2157-e3ee7462d8/
, SHA-256 3f401c114f047acde8fcf0963823dcc5e222213a2396ca8cdd59518600a27d89.Full text
H-2556.1
HOUSE BILL 2157
State of Washington 69th Legislature 2026 Regular Session
By Representatives Ryu, Stearns, Ramel, Parshley, Reeves, Reed,
Santos, Zahn, Street, Duerr, Gregerson, Ormsby, Scott, Shavers, Thai,
Macri, Fosse, Pollet, and Donaghy
Prefiled 12/16/25. Read first time 01/12/26. Referred to Committee
on Technology, Economic Development, & Veterans.
1 AN ACT Relating to regulating high-risk artificial intelligence
2 system development, deployment, and use; adding a new chapter to
3 Title 19 RCW; and providing an effective date.
4 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:
5 NEW SECTION. Sec. 1. The definitions in this section apply
6 throughout this chapter unless the context clearly requires
7 otherwise.
8 (1)(a) "Algorithmic discrimination" means the use of an
9 artificial intelligence system that results in an unlawful
10 differential treatment or impact that disfavors an individual or
11 group of individuals on the basis of their actual or perceived age,
12 color, disability, ethnicity, genetic information, limited
13 proficiency in the English language, national origin, race, religion,
14 reproductive health, sex, sexual orientation, veteran status, or
15 other classification protected under state or federal law.
16 (b) "Algorithmic discrimination" does not include:
17 (i) The offer, license, or use of a high-risk artificial
18 intelligence system by a developer or deployer for the sole purpose
19 of the developer's or deployer's self-testing to identify, mitigate,
20 or prevent discrimination or otherwise ensure compliance with state
21 and federal law;
p. 1 HB 2157
1 (ii) The expansion of an applicant, customer, or participant pool
2 to increase diversity or redress historical discrimination; or
3 (iii) An act or omission by or on behalf of a private club or
4 other establishment not in fact open to the public, as set forth in
5 Title II of the civil rights act of 1964, 42 U.S.C. Sec. 2000a(e), as
6 subsequently amended.
7 (2)(a) "Artificial intelligence system" means machine learning
8 systems and related technologies that use data to train statistical
9 models for the purpose of enabling computer systems to perform tasks
10 normally associated with human intelligence or perception, such as
11 computer vision, speech or natural language processing, and content
12 generation.
13 (b) "Artificial intelligence system" does not include any
14 artificial intelligence system that is used for development,
15 prototyping, and research activities before such artificial
16 intelligence system is made available to deployers or consumers.
17 (3) "Consequential decision" means any decision that has a
18 material legal, or similarly significant, effect on the provision or
19 denial to any consumer of:
20 (a) Parole, probation, a pardon, or any other release from
21 incarceration or court supervision;
22 (b) Education enrollment or an education opportunity;
23 (c) Access to employment;
24 (d) A financial or lending service;
25 (e) Access to health care services;
26 (f) Housing;
27 (g) Insurance;
28 (h) Marital status; or
29 (i) A legal service.
30 (4)(a) "Consumer" means a natural person who is a resident of
31 Washington and is acting only in an individual or household context.
32 (b) "Consumer" does not include a natural person acting in a
33 commercial or employment context.
34 (5) "Deployer" means any person doing business in Washington that
35 deploys or uses a high-risk artificial intelligence system to make a
36 consequential decision in Washington.
37 (6) "Developer" means any person doing business in Washington
38 that develops or intentionally and substantially modifies a high-risk
39 artificial intelligence system that is offered, sold, leased, given,
p. 2 HB 2157
1 or otherwise made available to deployers or consumers in Washington
2 and who earns more than $100,000 in gross annual revenue.
3 (7)(a) "Facial recognition" means the use of a computer system
4 that, for the purpose of attempting to determine the identity of an
5 unknown individual, uses an algorithm to compare the facial biometric
6 data of an unknown individual derived from a photograph, video, or
7 image to a database of photographs or images and associated facial
8 biometric data in order to identify potential matches to an
9 individual.
10 (b) "Facial recognition" does not include facial verification
11 technology, which involves the process of comparing an image or
12 facial biometric data of a known individual, where such information
13 is provided by that individual, to an image database, or to
14 government documentation containing an image of the known individual,
15 to identify a potential match in pursuit of the individual's
16 identity.
17 (8)(a) "General-purpose artificial intelligence model" means a
18 model used by an artificial intelligence system or other system that:
19 (i) Displays significant generality; (ii) is capable of competently
20 performing a wide range of distinct tasks; and (iii) can be
21 integrated into a variety of downstream applications or systems.
22 (b) "General-purpose artificial intelligence model" does not
23 include any artificial intelligence model that is used for
24 development, prototyping, and research activities before such
25 artificial intelligence model is made available to deployers or
26 consumers.
27 (9) "Generative artificial intelligence system" means an
28 artificial intelligence system that generates novel data or content
29 based on a foundation model.
30 (10)(a) "High-risk artificial intelligence system" means any
31 artificial intelligence system that is specifically intended to
32 autonomously make, or be a substantial factor in making, a
33 consequential decision. A system or service is not a "high-risk
34 artificial intelligence system" if it is intended to: (i) Perform a
35 narrow procedural task; (ii) improve the result of a previously
36 completed human activity; (iii) detect any decision-making patterns
37 or any deviations from preexisting decision-making patterns; or (iv)
38 perform a preparatory task to an assessment relevant to a
39 consequential decision.
p. 3 HB 2157
1 (b) "High-risk artificial intelligence system" does not include
2 any of the following technologies:
3 (i) Antifraud technology that does not use facial recognition
4 technology;
5 (ii) Antimalware technology;
6 (iii) Antivirus technology;
7 (iv) Artificial intelligence-enabled video games;
8 (v) Autonomous vehicle technology;
9 (vi) Calculators;
10 (vii) Cybersecurity technology;
11 (viii) Databases;
12 (ix) Data storage;
13 (x) Firewall technology;
14 (xi) Internet domain registration;
15 (xii) Internet website loading;
16 (xiii) Networking;
17 (xiv) Spam and robocall filtering;
18 (xv) Spell-checking technology;
19 (xvi) Spreadsheets;
20 (xvii) Web caching;
21 (xviii) Web hosting or any similar technology; or
22 (xix) Technology that communicates with consumers in natural
23 language for the purpose of providing users with information, making
24 referrals or recommendations, and answering questions and is subject
25 to an acceptable use policy that prohibits generating content that is
26 discriminatory or unlawful.
27 (11)(a) "Intentional and substantial modification" means a
28 deliberate change made to: (i) An artificial intelligence system that
29 results, at the time when the change is implemented and any time
30 thereafter, in a new material risk of algorithmic discrimination; or
31 (ii) a general-purpose artificial intelligence model that affects
32 compliance of the general-purpose artificial intelligence model,
33 materially changes the purpose of the general-purpose artificial
34 intelligence model, or results in a new reasonably foreseeable risk
35 of algorithmic discrimination.
36 (b) "Intentional and substantial modification" does not include:
37 (i) Any customization made by deployers that:
38 (A) Is based on legitimate nondiscriminatory business
39 justifications;
p. 4 HB 2157
1 (B) Is within the scope and purpose of the artificial
2 intelligence tool; and
3 (C) Does not result in a material change to the risks of
4 algorithmic discrimination; or
5 (ii) A change made to a high-risk artificial intelligence system,
6 or the performance of a high-risk artificial intelligence system, if:
7 (A) The high-risk artificial intelligence system continues to
8 learn after such high-risk artificial intelligence system is offered,
9 sold, leased, licensed, given, or otherwise made available to a
10 deployer, or deployed; and
11 (B) Such change is made to such high-risk artificial intelligence
12 system as a result of such learning and was predetermined by the
13 deployer or the third party contracted by the deployer and included
14 within the initial impact assessment of such high-risk artificial
15 intelligence system as required by section 3 of this act.
16 (12) "Machine learning" means the process by which artificial
17 intelligence is developed using data and algorithms to draw
18 inferences therefrom to automatically adapt or improve its accuracy
19 without explicit programming.
20 (13)(a) "Person" includes any individual, corporation,
21 partnership, association, cooperative, limited liability company,
22 trust, joint venture, or any other legal or commercial entity and any
23 successor, representative, agent, agency, or instrumentality thereof.
24 (b) "Person" does not include any government or political
25 subdivision.
26 (14) "Principal basis" means the use of an output of a high-risk
27 artificial intelligence system to make a decision without human
28 review, oversight, involvement, or intervention or without meaningful
29 consideration by a human.
30 (15)(a) "Substantial factor" means a factor that: (i) Uses the
31 principal basis for making a consequential decision; (ii) is capable
32 of altering the outcome of a consequential decision; and (iii) is
33 generated by an artificial intelligence system.
34 (b) "Substantial factor" includes any use of an artificial
35 intelligence system to generate any content, decision, prediction, or
36 recommendation concerning a consumer that is used as the principal
37 basis to make a consequential decision concerning the consumer.
38 (16) "Synthetic content" means information, such as images,
39 video, audio clips, and, to the extent practicable, text, that has
p. 5 HB 2157
1 been significantly modified or generated by algorithms, including by
2 artificial intelligence.
3 (17) "Trade secret" means information, including a formula,
4 pattern, compilation, program, device, method, technique, or process,
5 that derives independent economic value, actual or potential, from
6 not being generally known to, and not being readily ascertainable by
7 proper means by, other persons who can obtain economic value from its
8 disclosure or use and is the subject of efforts that are reasonable
9 under the circumstances to maintain its secrecy.
10 NEW SECTION. Sec. 2. (1) A developer of a high-risk artificial
11 intelligence system shall use reasonable care to protect consumers
12 from any known or reasonably foreseeable risks of algorithmic
13 discrimination arising from the intended and contracted uses of the
14 high-risk artificial intelligence system. In a civil action brought
15 against a developer pursuant to this chapter, there is a rebuttable
16 presumption that a developer of a high-risk artificial intelligence
17 system used reasonable care as required by this subsection (1) if the
18 developer complied with the requirements of this section.
19 (2) A developer of a high-risk artificial intelligence system may
20 not offer, sell, lease, give, or otherwise provide to a deployer or
21 other developer a high-risk artificial intelligence system unless the
22 developer makes available to the deployer or other developer:
23 (a) A statement disclosing the intended uses of such high-risk
24 artificial intelligence system;
25 (b) Documentation disclosing the following:
26 (i) The known or reasonably known limitations of such high-risk
27 artificial intelligence system, including any and all known or
28 reasonably foreseeable risks of algorithmic discrimination arising
29 from the intended uses of such high-risk artificial intelligence
30 system;
31 (ii) The purpose of such high-risk artificial intelligence system
32 and its intended outputs, benefits, and uses;
33 (iii) A summary describing how such high-risk artificial
34 intelligence system was evaluated for performance and for mitigation
35 of algorithmic discrimination before it was licensed, sold, leased,
36 given, or otherwise made available to a deployer or other developer;
37 (iv) A description of the measures the developer has taken to
38 mitigate known or reasonably foreseeable risks of algorithmic
39 discrimination that may arise from the reasonably foreseeable
p. 6 HB 2157
1 deployment or use of such high-risk artificial intelligence system;
2 and
3 (v) A description of how the high-risk artificial intelligence
4 system should be used, not be used, and be monitored by an individual
5 when such system is used to make, or is a substantial factor in
6 making, a consequential decision; and
7 (c) Any additional documentation that is reasonably necessary to
8 assist the deployer or other developer in understanding the outputs
9 and monitoring performance of the high-risk artificial intelligence
10 system for risks of algorithmic discrimination.
11 (3) A developer that offers, sells, leases, gives, or otherwise
12 makes available to a deployer or other developer a high-risk
13 artificial intelligence system shall make available to the deployer
14 or other developer to the extent feasible and necessary, information
15 and documentation to enable the deployer, other developer, or a third
16 party contracted by the deployer to complete an impact assessment
17 required by section 3(3) of this act. Such information and
18 documentation must include artifacts, such as system cards or
19 predeployment impact assessments, including relevant risk management
20 policies and impact assessments.
21 (4) A developer that also serves as a deployer for a high-risk
22 artificial intelligence system may not be required to generate the
23 documentation required by this section unless such high-risk
24 artificial intelligence system is provided to an unaffiliated entity
25 acting as a deployer or as otherwise required by law.
26 (5) High-risk artificial intelligence systems that are in
27 conformity with the latest version of the artificial intelligence
28 risk management framework published by the national institute of
29 standards and technology, standard ISO/IEC 42001 of the international
30 organization for standardization, or another nationally or
31 internationally recognized risk management framework for artificial
32 intelligence systems, or parts thereof, are presumed to be in
33 conformity with related requirements set out in this section.
34 (6) For a disclosure required pursuant to this section, a
35 developer shall, no later than 90 days after the developer performs
36 an intentional and substantial modification to a high-risk artificial
37 intelligence system, update such disclosure as necessary to ensure
38 that such disclosure remains accurate.
39 (7)(a) A developer of a high-risk generative artificial
40 intelligence system that generates or substantially modifies
p. 7 HB 2157
1 synthetic content shall ensure that the outputs of such high-risk
2 artificial intelligence system: (i) Are identifiable and detectable
3 in a manner that is accessible by consumers using industry-standard
4 tools or tools provided by the developer; (ii) comply with any
5 applicable accessibility requirements, as synthetic content, to the
6 extent reasonably feasible; and (iii) apply such identification at
7 the time the output is generated.
8 (b) If such synthetic content is an audio, image, or video format
9 that forms part of an evidently artistic, creative, satirical,
10 fictional, or analogous work or program, the requirement for
11 identifying outputs of high-risk artificial intelligence systems
12 pursuant to (a) of this subsection (7) is limited to a manner that
13 does not hinder the display or enjoyment of such work or program.
14 (c) The identification of outputs required by (a) of this
15 subsection (7) do not apply to: (i) Synthetic content that consists
16 exclusively of text, is published to inform the public on any matter
17 of public interest, or is unlikely to mislead a reasonable person
18 consuming such synthetic content; or (ii) the outputs of a high-risk
19 artificial intelligence system that performs an assistive function
20 for standard editing, does not substantially alter the input data
21 provided by the developer, or is used to detect, prevent,
22 investigate, or prosecute any crime as authorized by law.
23 (8) Where multiple developers directly contribute to the
24 development of a high-risk artificial intelligence system, each
25 developer is subject to the obligations and operating standards
26 applicable to developers pursuant to this section solely with respect
27 to its activities contributing to the development of the high-risk
28 artificial intelligence system.
29 (9) Nothing in this section may be construed to require a
30 developer to disclose any trade secret, information that could create
31 a security risk, or other confidential or proprietary information
32 protected under state or federal law.
33 NEW SECTION. Sec. 3. (1) A deployer of a high-risk artificial
34 intelligence system shall use reasonable care to protect consumers
35 from any known or reasonably foreseeable risks of algorithmic
36 discrimination. In a civil action brought against a deployer pursuant
37 to this chapter, there is a rebuttable presumption that a deployer of
38 a high-risk artificial intelligence system used reasonable care as
p. 8 HB 2157
1 required by this subsection (1) if the deployer complied with the
2 provisions of this section.
3 (2)(a) A deployer may not deploy or use a high-risk artificial
4 intelligence system to make a consequential decision unless the
5 deployer has designed and implemented a risk management policy and
6 program for such high-risk artificial intelligence system. The risk
7 management policy must specify the principles, processes, and
8 personnel that the deployer must use in maintaining the risk
9 management program to identify, mitigate, and document any risk of
10 algorithmic discrimination that is a reasonably foreseeable
11 consequence of deploying or using such high-risk artificial
12 intelligence system to make a consequential decision.
13 (b) A risk management policy and program designed, implemented,
14 and maintained pursuant to this section is presumed to be in
15 conformity with related requirements set out in this section if the
16 policy and program align with the guidance and standards set forth in
17 the latest version of:
18 (i) The artificial intelligence risk management framework
19 published by the national institute of standards and technology;
20 (ii) Standard ISO/IEC 42001 of the international organization for
21 standardization; or
22 (iii) A nationally or internationally recognized risk management
23 framework for artificial intelligence systems with requirements that
24 are substantially equivalent to, and at least as stringent as, the
25 guidance and standards described in (b)(i) and (ii) of this
26 subsection (2).
27 (c) High-risk artificial intelligence systems that are in
28 conformity with the latest version of the artificial intelligence
29 risk management framework published by the national institute of
30 standards and technology, standard ISO/IEC 42001 of the international
31 organization for standardization, or another nationally or
32 internationally recognized risk management framework for artificial
33 intelligence systems, or parts thereof, are presumed to be in
34 conformity with related requirements set out in this section.
35 (3)(a) Except as provided in (c) of this subsection (3), a
36 deployer may not deploy or use a high-risk artificial intelligence
37 system to make a consequential decision unless the deployer has
38 completed an impact assessment for such high-risk artificial
39 intelligence system. The deployer shall complete an impact assessment
40 for a high-risk artificial intelligence system before the deployer
p. 9 HB 2157
1 initially deploys such high-risk artificial intelligence system and
2 before a significant update to such high-risk artificial intelligence
3 system is used to make a consequential decision.
4 (b) An impact assessment completed pursuant to (a) of this
5 subsection (3) must include, at a minimum:
6 (i) A statement by the deployer disclosing the purpose, intended
7 use cases, and deployment context of, and benefits afforded by, the
8 high-risk artificial intelligence system;
9 (ii) A statement by the deployer disclosing whether the
10 deployment or use of the high-risk artificial intelligence system
11 poses any known or reasonably foreseeable risk of algorithmic
12 discrimination and, if so, the nature of such algorithmic
13 discrimination and the steps that have been taken, to the extent
14 feasible, to mitigate such risk;
15 (iii) For each postdeployment impact assessment completed
16 pursuant to this section, whether the intended use cases of the high-
17 risk artificial intelligence system as updated were consistent with,
18 or varied from, the developer's intended uses of such high-risk
19 artificial intelligence system;
20 (iv) A description of the categories of data the high-risk
21 artificial intelligence system processes as inputs and the outputs
22 such high-risk artificial intelligence system produces;
23 (v) If the deployer used data to customize the high-risk
24 artificial intelligence system, an overview of the categories of data
25 the deployer used to customize such high-risk artificial intelligence
26 system;
27 (vi) A list of any metrics used to evaluate the performance and
28 known limitations of the high-risk artificial intelligence system;
29 (vii) A description of any transparency measures taken concerning
30 the high-risk artificial intelligence system, including any measures
31 taken to disclose to a consumer that such high-risk artificial
32 intelligence system is in use when such high-risk artificial
33 intelligence system is in use;
34 (viii) A description of any postdeployment monitoring performed
35 and user safeguards provided concerning such high-risk artificial
36 intelligence system, including any oversight process established by
37 the deployer to address issues arising from deployment or use of such
38 high-risk artificial intelligence system as such issues arise; and
p. 10 HB 2157
1 (ix) An analysis of such high-risk artificial intelligence
2 system's validity and reliability in accordance with standard
3 industry practices.
4 (c)(i) A single impact assessment may address a comparable set of
5 high-risk artificial intelligence systems deployed or used by a
6 deployer.
7 (ii) If a deployer completes an impact assessment for the purpose
8 of complying with another applicable law or regulation, such impact
9 assessment satisfies the relevant requirements established in this
10 section if such impact assessment is reasonably similar in scope and
11 effect to the impact assessment that would otherwise be completed
12 pursuant to this section.
13 (iii) A deployer that completes an impact assessment pursuant to
14 this section shall maintain such impact assessment and all records
15 concerning the impact assessment for three years. Throughout the
16 period of time that a high-risk artificial intelligence system is
17 deployed and for a period of at least three years following the final
18 deployment of the high-risk artificial intelligence system, the
19 deployer shall retain all records concerning each impact assessment
20 conducted on the high-risk artificial intelligence system, including
21 all raw data used to evaluate the performance and known limitations
22 of such system.
23 (4) Not later than the time that a deployer uses a high-risk
24 artificial intelligence system to interact with a consumer, the
25 deployer shall disclose to the consumer that the consumer is
26 interacting with an artificial intelligence system. At such time, the
27 deployer shall also disclose to the consumer:
28 (a) The purpose of such high-risk artificial intelligence system;
29 (b) The nature of such system;
30 (c) The nature of the consequential decision;
31 (d) The contact information for the deployer; and
32 (e) A description of the artificial intelligence system in plain
33 language, which must include:
34 (i) A description of the personal characteristics or attributes
35 that such system will measure or assess;
36 (ii) The method by which the system measures or assesses such
37 attributes or characteristics;
38 (iii) How such attributes or characteristics are relevant to the
39 consequential decisions for which the system should be used;
40 (iv) Any human components of such system; and
p. 11 HB 2157
1 (v) How any automated components of such system are used to
2 inform such consequential decisions.
3 (5) A deployer that has deployed a high-risk artificial
4 intelligence system to make a consequential decision concerning a
5 consumer shall transmit to the consumer the consequential decision
6 without undue delay. If such consequential decision is adverse to the
7 consumer and based on personal data beyond information that the
8 consumer provided directly to the deployer, the deployer shall
9 provide to the consumer a statement disclosing the principal reason
10 or reasons for the consequential decision, including:
11 (a) The degree to which and manner in which the high-risk
12 artificial intelligence system contributed to the consequential
13 decision;
14 (b) The type of data that was processed by such system in making
15 the consequential decision; and
16 (c) The sources of such data.
17 (6) A deployer shall make readily available a clear statement
18 summarizing how the deployer manages any reasonably foreseeable risk
19 of algorithmic discrimination that may arise from the use or
20 deployment of the high-risk artificial intelligence system.
21 (7) For a disclosure required pursuant to this section, each
22 deployer shall, no later than 30 days after the deployer is notified
23 by the developer that the developer has performed an intentional and
24 substantial modification to a high-risk artificial intelligence
25 system, update such disclosure as necessary to ensure that such
26 disclosure remains accurate.
27 (8) A deployer who performs an intentional and substantial
28 modification to a high-risk artificial intelligence system shall
29 comply with the documentation and disclosure requirements for
30 developers pursuant to section 2 of this act.
31 (9) Nothing in this section may be construed to require a
32 deployer to disclose any trade secret, information that could create
33 a security risk, or other confidential or proprietary information
34 protected under state or federal law.
35 NEW SECTION. Sec. 4. (1) Nothing in this chapter may be
36 construed to restrict a developer's or deployer's ability to do the
37 following:
38 (a) Comply with federal, state, or municipal ordinances or
39 regulations;
p. 12 HB 2157
1 (b) Comply with a civil, criminal, or regulatory inquiry,
2 investigation, subpoena, or summons by federal, state, local, or
3 other governmental authorities;
4 (c) Cooperate with law enforcement agencies concerning conduct or
5 activity that the developer or deployer reasonably and in good faith
6 believes may violate federal, state, or local law, ordinances, or
7 regulations;
8 (d) Investigate, establish, exercise, prepare for, or defend
9 legal claims;
10 (e) Provide a product or service specifically requested by a
11 consumer;
12 (f) Perform under a contract to which a consumer is a party,
13 including fulfilling the terms of a written warranty;
14 (g) Take steps at the request of a consumer prior to entering
15 into a contract;
16 (h) Take immediate steps to protect an interest that is essential
17 for the life or physical safety of the consumer or another
18 individual;
19 (i) Prevent, detect, protect against, or respond to security
20 incidents, identity theft, fraud, harassment, or malicious or
21 deceptive activities;
22 (j) Take actions to prevent, detect, protect against, report, or
23 respond to the production, generation, incorporation, or
24 synthesization of child sex abuse material, or any illegal activity,
25 preserve the integrity or security of systems, or investigate,
26 report, or prosecute those responsible for any such action;
27 (k) Engage in public or peer-reviewed scientific or statistical
28 research in the public interest that adheres to all other applicable
29 ethics and privacy laws and is approved, monitored, and governed by
30 an institutional review board that determines, or similar independent
31 oversight entities that determine, that the expected benefits of the
32 research outweigh the risks associated with such research and whether
33 the developer or deployer has implemented reasonable safeguards to
34 mitigate the risks associated with such research;
35 (l) Assist another developer or deployer with any of the
36 obligations imposed by this chapter; or
37 (m) Take any action that is in the public interest in the areas
38 of public health, community health, or population health, but solely
39 to the extent that such action is subject to suitable and specific
40 measures to safeguard the public.
p. 13 HB 2157
1 (2) The obligations imposed on developers or deployers by this
2 chapter do not restrict a developer's or deployer's ability to:
3 (a) Conduct internal research to develop, improve, or repair
4 products, services, or technologies;
5 (b) Effectuate a product recall;
6 (c) Identify and repair technical errors that impair existing or
7 intended functionality; or
8 (d) Perform internal operations that are reasonably aligned with
9 the expectations of the consumer or reasonably anticipated based on
10 the consumer's existing relationship with the developer or deployer.
11 (3) Nothing in this chapter may be construed to impose any
12 obligation on a developer or deployer to disclose trade secrets or
13 information protected from disclosure by state or federal law.
14 (4) The obligations imposed on developers or deployers by this
15 chapter do not apply where compliance by the developer or deployer
16 with such obligations would violate an evidentiary privilege under
17 federal law or the laws of Washington.
18 (5) Nothing in this chapter may be construed to impose any
19 obligation on a developer or deployer that adversely affects the
20 legally protected rights or freedoms of any person, including the
21 rights of any person to freedom of speech or freedom of the press
22 guaranteed in the First Amendment to the Constitution of the United
23 States.
24 (6) The obligations imposed on developers or deployers by this
25 chapter do not apply to any artificial intelligence system that is
26 acquired by or for the federal government or any federal agency or
27 department, including the United States department of commerce, the
28 United States department of defense, and the national aeronautics and
29 space administration, unless such artificial intelligence system is a
30 high-risk artificial intelligence system that is used to make, or is
31 a substantial factor in making, a decision concerning employment or
32 housing.
33 (7) The obligations imposed on developers or deployers by this
34 chapter are satisfied for a financial institution, if such financial
35 institution is subject to the jurisdiction of any state or federal
36 regulator under any published guidance or regulations that apply to
37 the use of high-risk artificial intelligence systems and such
38 guidance or regulations.
39 (8)(a) The provisions of this chapter do not apply to any
40 insurer, or any high-risk artificial intelligence system developed by
p. 14 HB 2157
1 or for or deployed by an insurer for use in the business of
2 insurance, if such insurer is regulated and supervised by the office
3 of the insurance commissioner or a comparable federal regulating body
4 and subject to examination by such entity under any existing
5 statutes, rules, or regulations pertaining to unfair trade practices
6 and unfair discrimination, or published guidance or regulations that
7 apply to the use of high-risk artificial intelligence systems and
8 such guidance or regulations aid in the prevention and mitigation of
9 algorithmic discrimination caused by the use of a high-risk
10 artificial intelligence system or any risk of algorithmic
11 discrimination that is reasonably foreseeable as a result of the use
12 of a high-risk artificial intelligence system.
13 (b) Nothing in this chapter may be construed to delegate existing
14 regulatory oversight of the business of insurance to any department
15 or agency other than the office of the insurance commissioner.
16 (9) The provisions of this chapter do not apply to the
17 development of an artificial intelligence system that is used
18 exclusively for research, training, testing, or other predeployment
19 activities performed by active participants of any sandbox software
20 or sandbox environment established and subject to oversight by a
21 designated agency or other government entity and that is in
22 compliance with the provisions of this chapter.
23 (10) The provisions of this chapter do not apply to a developer
24 or deployer, or other person who develops, deploys, puts into
25 service, or intentionally modifies, as applicable, a high-risk
26 artificial intelligence system that:
27 (a) Has been approved, authorized, certified, cleared, developed,
28 or granted by a federal agency acting within the scope of the federal
29 agency's authority, or by a regulated entity subject to the
30 supervision and regulation of the federal housing finance agency; or
31 (b) Is in compliance with standards established by a federal
32 agency or by a regulated entity subject to the supervision and
33 regulation of the federal housing finance agency, if the standards
34 are substantially equivalent or more stringent than the requirements
35 of this chapter.
36 (11) The provisions of this chapter do not apply to a developer
37 or deployer, or other person that facilitates or engages in the
38 provision of telemedicine, as defined in RCW 70.41.020, or is a
39 covered entity within the meaning of the federal health insurance
40 portability and accountability act of 1996 (42 U.S.C. Sec. 1320d et
p. 15 HB 2157
1 seq.) and the regulations promulgated under such federal act, as both
2 may be amended from time to time, if such developer, deployer, or
3 person is providing:
4 (a) Health care recommendations that are generated by an
5 artificial intelligence system and require a health care provider
6 subject to RCW 18.130.040 to take action to implement the
7 recommendations; or
8 (b) Services utilizing an artificial intelligence system for an
9 administrative, quality measurement, security, or internal cost or
10 performance improvement function.
11 (12) If a developer or deployer engages in any action authorized
12 by an exemption set forth in this section, the developer or deployer
13 bears the burden of demonstrating that such action qualifies for such
14 exemption.
15 (13) If a developer or deployer withholds information pursuant to
16 an exemption set forth in this chapter for which disclosure would
17 otherwise be required by this chapter, including the exemption from
18 disclosure of trade secrets, the developer or deployer shall notify
19 the subject of disclosure and provide a basis for withholding the
20 information. If a developer or deployer redacts any information
21 pursuant to an exemption from disclosure, the developer or deployer
22 shall notify the subject of disclosure that the developer or deployer
23 is redacting such information and provide the basis for such decision
24 to redact.
25 (14) For purposes of this section:
26 (a) "Financial institution" means a bank, out-of-state bank,
27 credit union, out-of-state credit union, federal credit union,
28 mortgage lender, or savings institution organized under state or
29 federal law, or any subsidiary, affiliate, or service provider of a
30 financial institution.
31 (b) "Insurer" has the same meaning as defined in RCW 48.01.050.
32 NEW SECTION. Sec. 5. (1) In addition to any other remedy
33 provided by law, a person may file a civil action against a developer
34 or deployer for a violation of this chapter. If a court finds that
35 the developer or deployer violated this chapter, the court may enjoin
36 the violation and award reasonable attorneys' fees and costs.
37 (2) In an action brought pursuant to this section, it is an
38 affirmative defense that the developer or deployer:
39 (a) Discovered a violation of any provision of this chapter;
p. 16 HB 2157
1 (b) Cured such violation no later than 45 days after discovering
2 the violation;
3 (c) Provided notice to the person bringing the civil action
4 pursuant to this section that such violation has been cured and
5 provides accompanying evidence that the violation has been cured; and
6 (d) Is otherwise in compliance with the requirements of this
7 chapter.
8 NEW SECTION. Sec. 6. This chapter is declared to be remedial,
9 with the purposes of protecting consumers and ensuring consumers
10 receive information about consequential decisions affecting them. The
11 provisions of this chapter granting rights or protections to
12 consumers are construed broadly and exemptions construed narrowly.
13 NEW SECTION. Sec. 7. If any provision of this act or its
14 application to any person or circumstance is held invalid, the
15 remainder of the act or the application of the provision to other
16 persons or circumstances is not affected.
17 NEW SECTION. Sec. 8. Sections 1 through 6 and 9 of this act
18 constitute a new chapter in Title 19 RCW.
19 NEW SECTION. Sec. 9. This act takes effect January 1, 2027.
--- END ---
p. 17 HB 2157
File and source
- File
- 2026-01-14_a33628_bill_2157.pdf
- Size
- 122,017 bytes
- SHA-256
- 3f401c114f047acde8fcf0963823dcc5e222213a2396ca8cdd59518600a27d89
- Our copy
- 2026-01-14_a33628_bill_2157.pdf
- Original
- No public link identified.