Proposed Substitute House Bill 2157 (H-3136.1/26) — By Representative Ryu, Original Bill
Summary
Proposed Substitute House Bill 2157 (H-3136.1/26), House Technology, Economic Development, and Veterans Committee, By Representative Ryu, with a staff summary dated January 22, 2026. The summary says the original bill establishes that developers and deployers of high-risk artificial intelligence (AI) systems are required to use reasonable care to protect consumers from algorithmic discrimination. It lists changes in the proposed substitute, including added definitions of personal information, predeployment impact assessment and system card, and a modified exemption for financial institutions subject to the Equal Credit Opportunity Act. The brief description is Regulating high-risk artificial intelligence system development, deployment, and use.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Proposed Substitute House Bill 2157 (H-3136.1/26) — By Representative Ryu, Original Bill.”
Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/2026-01-23-a33673-d292370-2157-pshb-h-3136-1-64de56a3e1/
, SHA-256 dfde2915cc8190454a7d77159c591bb4c175b2f2e02a9fd56e665f88191927f4.Full text
Proposed Substitute House Bill 2157 (H-3136.1/26)
House Technology, Economic Development, and Veterans Committee
By Representative Ryu
Original Bill:
The bill establishes that developers and deployers of high-risk artificial intelligence (AI) systems are required to use
reasonable care to protect consumers from algorithmic discrimination. It also establishes requirements for developers
and deployers of high-risk AI systems relating to transparency and risk management.
Proposed Substitute House Bill (H-3136.1/26) compared to the Original Bill:
• Adds creed and citizenship status as protected statuses under the definition of “algorithmic discrimination” and
specifies that algorithmic discrimination includes differential treatment based on "the presence of any sensory,
mental, or physical disability" instead of "disability," and "honorably discharged veteran or military status"
instead of "veteran status;"
• Adds a definition of “personal information” aligned with RCW 19.373.010 and changes one instance of “personal
data” in the bill to “personal information;”
• Adds a definition of “predeployment impact assessment;”
• Adds a definition of “system card;”
• Modifies the exemption for financial institutions by exempting financial institutions that are subject to the Equal
Credit Opportunity Act, instead of financial institutions that are subject to state or federal regulator guidance
that applies to the use of high-risk AI systems;
• Modifies the exemption relating to insurers by specifying that the chapter does not apply to any insurer
“regulated under Title 48 RCW” or any high-risk AI system developed “or acquired and” deployed by an insurer,
instead of any high-risk AI system “developed by or for or deployed by” an insurer.
Staff: Emily Poole
Date: January 22, 2026
BILL REQUEST - CODE REVISER'S OFFICE
BILL REQ. #: H-3136.1/26
ATTY/TYPIST: CC:ajr
BRIEF DESCRIPTION: Regulating high-risk artificial intelligence
system development, deployment, and use.
1 AN ACT Relating to regulating high-risk artificial intelligence
2 system development, deployment, and use; adding a new chapter to
3 Title 19 RCW; and providing an effective date.
4 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:
5 NEW SECTION. Sec. 1. The definitions in this section apply
6 throughout this chapter unless the context clearly requires
7 otherwise.
8 (1)(a) "Algorithmic discrimination" means the use of an
9 artificial intelligence system that results in an unlawful
10 differential treatment or impact that disfavors an individual or
11 group of individuals on the basis of their color, creed, the presence
12 of any sensory, mental, or physical disability, ethnicity, genetic
13 information, limited proficiency in the English language, national
14 origin, race, religion, reproductive health, sex, sexual orientation,
15 honorably discharged veteran or military status, citizen or
16 immigration status, actual or perceived age, or other classification
17 protected under state or federal law.
18 (b) "Algorithmic discrimination" does not include:
19 (i) The offer, license, or use of a high-risk artificial
20 intelligence system by a developer or deployer for the sole purpose
21 of the developer's or deployer's self-testing to identify, mitigate,
Code Rev/CC:ajr 1 H-3136.1/26
1 or prevent discrimination or otherwise ensure compliance with state
2 and federal law;
3 (ii) The expansion of an applicant, customer, or participant pool
4 to increase diversity or redress historical discrimination; or
5 (iii) An act or omission by or on behalf of a private club or
6 other establishment not in fact open to the public, as set forth in
7 Title II of the civil rights act of 1964, 42 U.S.C. Sec. 2000a(e), as
8 subsequently amended.
9 (2)(a) "Artificial intelligence system" means machine learning
10 systems and related technologies that use data to train statistical
11 models for the purpose of enabling computer systems to perform tasks
12 normally associated with human intelligence or perception, such as
13 computer vision, speech or natural language processing, and content
14 generation.
15 (b) "Artificial intelligence system" does not include any
16 artificial intelligence system that is used for development,
17 prototyping, and research activities before such artificial
18 intelligence system is made available to deployers or consumers.
19 (3) "Consequential decision" means any decision that has a
20 material legal, or similarly significant, effect on the provision or
21 denial to any consumer of:
22 (a) Parole, probation, a pardon, or any other release from
23 incarceration or court supervision;
24 (b) Education enrollment or an education opportunity;
25 (c) Access to employment;
26 (d) A financial or lending service;
27 (e) Access to health care services;
28 (f) Housing;
29 (g) Insurance;
30 (h) Marital status; or
31 (i) A legal service.
32 (4)(a) "Consumer" means a natural person who is a resident of
33 Washington and is acting only in an individual or household context.
34 (b) "Consumer" does not include a natural person acting in a
35 commercial or employment context.
36 (5) "Deployer" means any person doing business in Washington that
37 deploys or uses a high-risk artificial intelligence system to make a
38 consequential decision in Washington.
39 (6) "Developer" means any person doing business in Washington
40 that develops or intentionally and substantially modifies a high-risk
Code Rev/CC:ajr 2 H-3136.1/26
1 artificial intelligence system that is offered, sold, leased, given,
2 or otherwise made available to deployers or consumers in Washington
3 and who earns more than $100,000 in gross annual revenue.
4 (7)(a) "Facial recognition" means the use of a computer system
5 that, for the purpose of attempting to determine the identity of an
6 unknown individual, uses an algorithm to compare the facial biometric
7 data of an unknown individual derived from a photograph, video, or
8 image to a database of photographs or images and associated facial
9 biometric data in order to identify potential matches to an
10 individual.
11 (b) "Facial recognition" does not include facial verification
12 technology, which involves the process of comparing an image or
13 facial biometric data of a known individual, where such information
14 is provided by that individual, to an image database, or to
15 government documentation containing an image of the known individual,
16 to identify a potential match in pursuit of the individual's
17 identity.
18 (8)(a) "General-purpose artificial intelligence model" means a
19 model used by an artificial intelligence system or other system that:
20 (i) Displays significant generality; (ii) is capable of competently
21 performing a wide range of distinct tasks; and (iii) can be
22 integrated into a variety of downstream applications or systems.
23 (b) "General-purpose artificial intelligence model" does not
24 include any artificial intelligence model that is used for
25 development, prototyping, and research activities before such
26 artificial intelligence model is made available to deployers or
27 consumers.
28 (9) "Generative artificial intelligence system" means an
29 artificial intelligence system that generates novel data or content
30 based on a foundation model.
31 (10)(a) "High-risk artificial intelligence system" means any
32 artificial intelligence system that is specifically intended to
33 autonomously make, or be a substantial factor in making, a
34 consequential decision. A system or service is not a "high-risk
35 artificial intelligence system" if it is intended to: (i) Perform a
36 narrow procedural task; (ii) improve the result of a previously
37 completed human activity; (iii) detect any decision-making patterns
38 or any deviations from preexisting decision-making patterns; or (iv)
39 perform a preparatory task to an assessment relevant to a
40 consequential decision.
Code Rev/CC:ajr 3 H-3136.1/26
1 (b) "High-risk artificial intelligence system" does not include
2 any of the following technologies:
3 (i) Antifraud technology that does not use facial recognition
4 technology;
5 (ii) Antimalware technology;
6 (iii) Antivirus technology;
7 (iv) Artificial intelligence-enabled video games;
8 (v) Autonomous vehicle technology;
9 (vi) Calculators;
10 (vii) Cybersecurity technology;
11 (viii) Databases;
12 (ix) Data storage;
13 (x) Firewall technology;
14 (xi) Internet domain registration;
15 (xii) Internet website loading;
16 (xiii) Networking;
17 (xiv) Spam and robocall filtering;
18 (xv) Spell-checking technology;
19 (xvi) Spreadsheets;
20 (xvii) Web caching;
21 (xviii) Web hosting or any similar technology; or
22 (xix) Technology that communicates with consumers in natural
23 language for the purpose of providing users with information, making
24 referrals or recommendations, and answering questions and is subject
25 to an acceptable use policy that prohibits generating content that is
26 discriminatory or unlawful.
27 (11)(a) "Intentional and substantial modification" means a
28 deliberate change made to: (i) An artificial intelligence system that
29 results, at the time when the change is implemented and any time
30 thereafter, in a new material risk of algorithmic discrimination; or
31 (ii) a general-purpose artificial intelligence model that affects
32 compliance of the general-purpose artificial intelligence model,
33 materially changes the purpose of the general-purpose artificial
34 intelligence model, or results in a new reasonably foreseeable risk
35 of algorithmic discrimination.
36 (b) "Intentional and substantial modification" does not include:
37 (i) Any customization made by deployers that:
38 (A) Is based on legitimate nondiscriminatory business
39 justifications;
Code Rev/CC:ajr 4 H-3136.1/26
1 (B) Is within the scope and purpose of the artificial
2 intelligence tool; and
3 (C) Does not result in a material change to the risks of
4 algorithmic discrimination; or
5 (ii) A change made to a high-risk artificial intelligence system,
6 or the performance of a high-risk artificial intelligence system, if:
7 (A) The high-risk artificial intelligence system continues to
8 learn after such high-risk artificial intelligence system is offered,
9 sold, leased, licensed, given, or otherwise made available to a
10 deployer, or deployed; and
11 (B) Such change is made to such high-risk artificial intelligence
12 system as a result of such learning and was predetermined by the
13 deployer or the third party contracted by the deployer and included
14 within the initial impact assessment of such high-risk artificial
15 intelligence system as required by section 3 of this act.
16 (12) "Machine learning" means the process by which artificial
17 intelligence is developed using data and algorithms to draw
18 inferences therefrom to automatically adapt or improve its accuracy
19 without explicit programming.
20 (13)(a) "Person" includes any individual, corporation,
21 partnership, association, cooperative, limited liability company,
22 trust, joint venture, or any other legal or commercial entity and any
23 successor, representative, agent, agency, or instrumentality thereof.
24 (b) "Person" does not include any government or political
25 subdivision.
26 (14) "Personal information" has the same meaning as defined in
27 RCW 19.373.010.
28 (15) "Predeployment impact assessment" means a process that helps
29 an organization understand the potential benefits and risks
30 associated with deploying an artificial intelligence system. This
31 includes systematically identifying, evaluating, and managing risks
32 and impacts from the development, deployment, and use of an
33 artificial intelligence system.
34 (16) "Principal basis" means the use of an output of a high-risk
35 artificial intelligence system to make a decision without human
36 review, oversight, involvement, or intervention or without meaningful
37 consideration by a human.
38 (17)(a) "Substantial factor" means a factor that: (i) Uses the
39 principal basis for making a consequential decision; (ii) is capable
Code Rev/CC:ajr 5 H-3136.1/26
1 of altering the outcome of a consequential decision; and (iii) is
2 generated by an artificial intelligence system.
3 (b) "Substantial factor" includes any use of an artificial
4 intelligence system to generate any content, decision, prediction, or
5 recommendation concerning a consumer that is used as the principal
6 basis to make a consequential decision concerning the consumer.
7 (18) "Synthetic content" means information, such as images,
8 video, audio clips, and, to the extent practicable, text, that has
9 been significantly modified or generated by algorithms, including by
10 artificial intelligence.
11 (19) "System card" means a document that outlines how technology
12 is used within an organization, focusing on aspects such as business,
13 technology, and risk. In the context of artificial intelligence, a
14 system card details the model's capabilities, limitations, safety
15 measures, and ethical considerations, and it represents the
16 evaluation of machine learning-based automated decision outcomes.
17 (20) "Trade secret" means information, including a formula,
18 pattern, compilation, program, device, method, technique, or process,
19 that derives independent economic value, actual or potential, from
20 not being generally known to, and not being readily ascertainable by
21 proper means by, other persons who can obtain economic value from its
22 disclosure or use and is the subject of efforts that are reasonable
23 under the circumstances to maintain its secrecy.
24 NEW SECTION. Sec. 2. (1) A developer of a high-risk artificial
25 intelligence system shall use reasonable care to protect consumers
26 from any known or reasonably foreseeable risks of algorithmic
27 discrimination arising from the intended and contracted uses of the
28 high-risk artificial intelligence system. In a civil action brought
29 against a developer pursuant to this chapter, there is a rebuttable
30 presumption that a developer of a high-risk artificial intelligence
31 system used reasonable care as required by this subsection (1) if the
32 developer complied with the requirements of this section.
33 (2) A developer of a high-risk artificial intelligence system may
34 not offer, sell, lease, give, or otherwise provide to a deployer or
35 other developer a high-risk artificial intelligence system unless the
36 developer makes available to the deployer or other developer:
37 (a) A statement disclosing the intended uses of such high-risk
38 artificial intelligence system;
39 (b) Documentation disclosing the following:
Code Rev/CC:ajr 6 H-3136.1/26
1 (i) The known or reasonably known limitations of such high-risk
2 artificial intelligence system, including any and all known or
3 reasonably foreseeable risks of algorithmic discrimination arising
4 from the intended uses of such high-risk artificial intelligence
5 system;
6 (ii) The purpose of such high-risk artificial intelligence system
7 and its intended outputs, benefits, and uses;
8 (iii) A summary describing how such high-risk artificial
9 intelligence system was evaluated for performance and for mitigation
10 of algorithmic discrimination before it was licensed, sold, leased,
11 given, or otherwise made available to a deployer or other developer;
12 (iv) A description of the measures the developer has taken to
13 mitigate known or reasonably foreseeable risks of algorithmic
14 discrimination that may arise from the reasonably foreseeable
15 deployment or use of such high-risk artificial intelligence system;
16 and
17 (v) A description of how the high-risk artificial intelligence
18 system should be used, not be used, and be monitored by an individual
19 when such system is used to make, or is a substantial factor in
20 making, a consequential decision; and
21 (c) Any additional documentation that is reasonably necessary to
22 assist the deployer or other developer in understanding the outputs
23 and monitoring performance of the high-risk artificial intelligence
24 system for risks of algorithmic discrimination.
25 (3) A developer that offers, sells, leases, gives, or otherwise
26 makes available to a deployer or other developer a high-risk
27 artificial intelligence system shall make available to the deployer
28 or other developer to the extent feasible and necessary, information
29 and documentation to enable the deployer, other developer, or a third
30 party contracted by the deployer to complete an impact assessment
31 required by section 3(3) of this act. Such information and
32 documentation must include artifacts, such as system cards or
33 predeployment impact assessments, including relevant risk management
34 policies and impact assessments.
35 (4) A developer that also serves as a deployer for a high-risk
36 artificial intelligence system may not be required to generate the
37 documentation required by this section unless such high-risk
38 artificial intelligence system is provided to an unaffiliated entity
39 acting as a deployer or as otherwise required by law.
Code Rev/CC:ajr 7 H-3136.1/26
1 (5) High-risk artificial intelligence systems that are in
2 conformity with the latest version of the artificial intelligence
3 risk management framework published by the national institute of
4 standards and technology, standard ISO/IEC 42001 of the international
5 organization for standardization, or another nationally or
6 internationally recognized risk management framework for artificial
7 intelligence systems, or parts thereof, are presumed to be in
8 conformity with related requirements set out in this section.
9 (6) For a disclosure required pursuant to this section, a
10 developer shall, no later than 90 days after the developer performs
11 an intentional and substantial modification to a high-risk artificial
12 intelligence system, update such disclosure as necessary to ensure
13 that such disclosure remains accurate.
14 (7)(a) A developer of a high-risk generative artificial
15 intelligence system that generates or substantially modifies
16 synthetic content shall ensure that the outputs of such high-risk
17 artificial intelligence system: (i) Are identifiable and detectable
18 in a manner that is accessible by consumers using industry-standard
19 tools or tools provided by the developer; (ii) comply with any
20 applicable accessibility requirements, as synthetic content, to the
21 extent reasonably feasible; and (iii) apply such identification at
22 the time the output is generated.
23 (b) If such synthetic content is an audio, image, or video format
24 that forms part of an evidently artistic, creative, satirical,
25 fictional, or analogous work or program, the requirement for
26 identifying outputs of high-risk artificial intelligence systems
27 pursuant to (a) of this subsection (7) is limited to a manner that
28 does not hinder the display or enjoyment of such work or program.
29 (c) The identification of outputs required by (a) of this
30 subsection (7) do not apply to: (i) Synthetic content that consists
31 exclusively of text, is published to inform the public on any matter
32 of public interest, or is unlikely to mislead a reasonable person
33 consuming such synthetic content; or (ii) the outputs of a high-risk
34 artificial intelligence system that performs an assistive function
35 for standard editing, does not substantially alter the input data
36 provided by the developer, or is used to detect, prevent,
37 investigate, or prosecute any crime as authorized by law.
38 (8) Where multiple developers directly contribute to the
39 development of a high-risk artificial intelligence system, each
40 developer is subject to the obligations and operating standards
Code Rev/CC:ajr 8 H-3136.1/26
1 applicable to developers pursuant to this section solely with respect
2 to its activities contributing to the development of the high-risk
3 artificial intelligence system.
4 (9) Nothing in this section may be construed to require a
5 developer to disclose any trade secret, information that could create
6 a security risk, or other confidential or proprietary information
7 protected under state or federal law.
8 NEW SECTION. Sec. 3. (1) A deployer of a high-risk artificial
9 intelligence system shall use reasonable care to protect consumers
10 from any known or reasonably foreseeable risks of algorithmic
11 discrimination. In a civil action brought against a deployer pursuant
12 to this chapter, there is a rebuttable presumption that a deployer of
13 a high-risk artificial intelligence system used reasonable care as
14 required by this subsection (1) if the deployer complied with the
15 provisions of this section.
16 (2)(a) A deployer may not deploy or use a high-risk artificial
17 intelligence system to make a consequential decision unless the
18 deployer has designed and implemented a risk management policy and
19 program for such high-risk artificial intelligence system. The risk
20 management policy must specify the principles, processes, and
21 personnel that the deployer must use in maintaining the risk
22 management program to identify, mitigate, and document any risk of
23 algorithmic discrimination that is a reasonably foreseeable
24 consequence of deploying or using such high-risk artificial
25 intelligence system to make a consequential decision.
26 (b) A risk management policy and program designed, implemented,
27 and maintained pursuant to this section is presumed to be in
28 conformity with related requirements set out in this section if the
29 policy and program align with the guidance and standards set forth in
30 the latest version of:
31 (i) The artificial intelligence risk management framework
32 published by the national institute of standards and technology;
33 (ii) Standard ISO/IEC 42001 of the international organization for
34 standardization; or
35 (iii) A nationally or internationally recognized risk management
36 framework for artificial intelligence systems with requirements that
37 are substantially equivalent to, and at least as stringent as, the
38 guidance and standards described in (b)(i) and (ii) of this
39 subsection (2).
Code Rev/CC:ajr 9 H-3136.1/26
1 (c) High-risk artificial intelligence systems that are in
2 conformity with the latest version of the artificial intelligence
3 risk management framework published by the national institute of
4 standards and technology, standard ISO/IEC 42001 of the international
5 organization for standardization, or another nationally or
6 internationally recognized risk management framework for artificial
7 intelligence systems, or parts thereof, are presumed to be in
8 conformity with related requirements set out in this section.
9 (3)(a) Except as provided in (c) of this subsection (3), a
10 deployer may not deploy or use a high-risk artificial intelligence
11 system to make a consequential decision unless the deployer has
12 completed an impact assessment for such high-risk artificial
13 intelligence system. The deployer shall complete an impact assessment
14 for a high-risk artificial intelligence system before the deployer
15 initially deploys such high-risk artificial intelligence system and
16 before a significant update to such high-risk artificial intelligence
17 system is used to make a consequential decision.
18 (b) An impact assessment completed pursuant to (a) of this
19 subsection (3) must include, at a minimum:
20 (i) A statement by the deployer disclosing the purpose, intended
21 use cases, and deployment context of, and benefits afforded by, the
22 high-risk artificial intelligence system;
23 (ii) A statement by the deployer disclosing whether the
24 deployment or use of the high-risk artificial intelligence system
25 poses any known or reasonably foreseeable risk of algorithmic
26 discrimination and, if so, the nature of such algorithmic
27 discrimination and the steps that have been taken, to the extent
28 feasible, to mitigate such risk;
29 (iii) For each postdeployment impact assessment completed
30 pursuant to this section, whether the intended use cases of the high-
31 risk artificial intelligence system as updated were consistent with,
32 or varied from, the developer's intended uses of such high-risk
33 artificial intelligence system;
34 (iv) A description of the categories of data the high-risk
35 artificial intelligence system processes as inputs and the outputs
36 such high-risk artificial intelligence system produces;
37 (v) If the deployer used data to customize the high-risk
38 artificial intelligence system, an overview of the categories of data
39 the deployer used to customize such high-risk artificial intelligence
40 system;
Code Rev/CC:ajr 10 H-3136.1/26
1 (vi) A list of any metrics used to evaluate the performance and
2 known limitations of the high-risk artificial intelligence system;
3 (vii) A description of any transparency measures taken concerning
4 the high-risk artificial intelligence system, including any measures
5 taken to disclose to a consumer that such high-risk artificial
6 intelligence system is in use when such high-risk artificial
7 intelligence system is in use;
8 (viii) A description of any postdeployment monitoring performed
9 and user safeguards provided concerning such high-risk artificial
10 intelligence system, including any oversight process established by
11 the deployer to address issues arising from deployment or use of such
12 high-risk artificial intelligence system as such issues arise; and
13 (ix) An analysis of such high-risk artificial intelligence
14 system's validity and reliability in accordance with standard
15 industry practices.
16 (c)(i) A single impact assessment may address a comparable set of
17 high-risk artificial intelligence systems deployed or used by a
18 deployer.
19 (ii) If a deployer completes an impact assessment for the purpose
20 of complying with another applicable law or regulation, such impact
21 assessment satisfies the relevant requirements established in this
22 section if such impact assessment is reasonably similar in scope and
23 effect to the impact assessment that would otherwise be completed
24 pursuant to this section.
25 (iii) A deployer that completes an impact assessment pursuant to
26 this section shall maintain such impact assessment and all records
27 concerning the impact assessment for three years. Throughout the
28 period of time that a high-risk artificial intelligence system is
29 deployed and for a period of at least three years following the final
30 deployment of the high-risk artificial intelligence system, the
31 deployer shall retain all records concerning each impact assessment
32 conducted on the high-risk artificial intelligence system, including
33 all raw data used to evaluate the performance and known limitations
34 of such system.
35 (4) Not later than the time that a deployer uses a high-risk
36 artificial intelligence system to interact with a consumer, the
37 deployer shall disclose to the consumer that the consumer is
38 interacting with an artificial intelligence system. At such time, the
39 deployer shall also disclose to the consumer:
40 (a) The purpose of such high-risk artificial intelligence system;
Code Rev/CC:ajr 11 H-3136.1/26
1 (b) The nature of such system;
2 (c) The nature of the consequential decision;
3 (d) The contact information for the deployer; and
4 (e) A description of the artificial intelligence system in plain
5 language, which must include:
6 (i) A description of the personal characteristics or attributes
7 that such system will measure or assess;
8 (ii) The method by which the system measures or assesses such
9 attributes or characteristics;
10 (iii) How such attributes or characteristics are relevant to the
11 consequential decisions for which the system should be used;
12 (iv) Any human components of such system; and
13 (v) How any automated components of such system are used to
14 inform such consequential decisions.
15 (5) A deployer that has deployed a high-risk artificial
16 intelligence system to make a consequential decision concerning a
17 consumer shall transmit to the consumer the consequential decision
18 without undue delay. If such consequential decision is adverse to the
19 consumer and based on personal information beyond information that
20 the consumer provided directly to the deployer, the deployer shall
21 provide to the consumer a statement disclosing the principal reason
22 or reasons for the consequential decision, including:
23 (a) The degree to which and manner in which the high-risk
24 artificial intelligence system contributed to the consequential
25 decision;
26 (b) The type of data that was processed by such system in making
27 the consequential decision; and
28 (c) The sources of such data.
29 (6) A deployer shall make readily available a clear statement
30 summarizing how the deployer manages any reasonably foreseeable risk
31 of algorithmic discrimination that may arise from the use or
32 deployment of the high-risk artificial intelligence system.
33 (7) For a disclosure required pursuant to this section, each
34 deployer shall, no later than 30 days after the deployer is notified
35 by the developer that the developer has performed an intentional and
36 substantial modification to a high-risk artificial intelligence
37 system, update such disclosure as necessary to ensure that such
38 disclosure remains accurate.
39 (8) A deployer who performs an intentional and substantial
40 modification to a high-risk artificial intelligence system shall
Code Rev/CC:ajr 12 H-3136.1/26
1 comply with the documentation and disclosure requirements for
2 developers pursuant to section 2 of this act.
3 (9) Nothing in this section may be construed to require a
4 deployer to disclose any trade secret, information that could create
5 a security risk, or other confidential or proprietary information
6 protected under state or federal law.
7 NEW SECTION. Sec. 4. (1) Nothing in this chapter may be
8 construed to restrict a developer's or deployer's ability to do the
9 following:
10 (a) Comply with federal, state, or municipal ordinances or
11 regulations;
12 (b) Comply with a civil, criminal, or regulatory inquiry,
13 investigation, subpoena, or summons by federal, state, local, or
14 other governmental authorities;
15 (c) Cooperate with law enforcement agencies concerning conduct or
16 activity that the developer or deployer reasonably and in good faith
17 believes may violate federal, state, or local law, ordinances, or
18 regulations;
19 (d) Investigate, establish, exercise, prepare for, or defend
20 legal claims;
21 (e) Provide a product or service specifically requested by a
22 consumer;
23 (f) Perform under a contract to which a consumer is a party,
24 including fulfilling the terms of a written warranty;
25 (g) Take steps at the request of a consumer prior to entering
26 into a contract;
27 (h) Take immediate steps to protect an interest that is essential
28 for the life or physical safety of the consumer or another
29 individual;
30 (i) Prevent, detect, protect against, or respond to security
31 incidents, identity theft, fraud, harassment, or malicious or
32 deceptive activities;
33 (j) Take actions to prevent, detect, protect against, report, or
34 respond to the production, generation, incorporation, or
35 synthesization of child sex abuse material, or any illegal activity,
36 preserve the integrity or security of systems, or investigate,
37 report, or prosecute those responsible for any such action;
38 (k) Engage in public or peer-reviewed scientific or statistical
39 research in the public interest that adheres to all other applicable
Code Rev/CC:ajr 13 H-3136.1/26
1 ethics and privacy laws and is approved, monitored, and governed by
2 an institutional review board that determines, or similar independent
3 oversight entities that determine, that the expected benefits of the
4 research outweigh the risks associated with such research and whether
5 the developer or deployer has implemented reasonable safeguards to
6 mitigate the risks associated with such research;
7 (l) Assist another developer or deployer with any of the
8 obligations imposed by this chapter; or
9 (m) Take any action that is in the public interest in the areas
10 of public health, community health, or population health, but solely
11 to the extent that such action is subject to suitable and specific
12 measures to safeguard the public.
13 (2) The obligations imposed on developers or deployers by this
14 chapter do not restrict a developer's or deployer's ability to:
15 (a) Conduct internal research to develop, improve, or repair
16 products, services, or technologies;
17 (b) Effectuate a product recall;
18 (c) Identify and repair technical errors that impair existing or
19 intended functionality; or
20 (d) Perform internal operations that are reasonably aligned with
21 the expectations of the consumer or reasonably anticipated based on
22 the consumer's existing relationship with the developer or deployer.
23 (3) Nothing in this chapter may be construed to impose any
24 obligation on a developer or deployer to disclose trade secrets or
25 information protected from disclosure by state or federal law.
26 (4) The obligations imposed on developers or deployers by this
27 chapter do not apply where compliance by the developer or deployer
28 with such obligations would violate an evidentiary privilege under
29 federal law or the laws of Washington.
30 (5) Nothing in this chapter may be construed to impose any
31 obligation on a developer or deployer that adversely affects the
32 legally protected rights or freedoms of any person, including the
33 rights of any person to freedom of speech or freedom of the press
34 guaranteed in the First Amendment to the Constitution of the United
35 States.
36 (6) The obligations imposed on developers or deployers by this
37 chapter do not apply to any artificial intelligence system that is
38 acquired by or for the federal government or any federal agency or
39 department, including the United States department of commerce, the
40 United States department of defense, and the national aeronautics and
Code Rev/CC:ajr 14 H-3136.1/26
1 space administration, unless such artificial intelligence system is a
2 high-risk artificial intelligence system that is used to make, or is
3 a substantial factor in making, a decision concerning employment or
4 housing.
5 (7) The obligations imposed on developers or deployers by this
6 chapter are satisfied with respect to a financial institution, if
7 such financial institution is subject to the equal credit opportunity
8 act, 15 U.S.C. Sec. 1691 et seq., and its implementing regulations.
9 (8)(a) The provisions of this chapter do not apply to any insurer
10 regulated under Title 48 RCW, or any high-risk artificial
11 intelligence system developed or acquired and deployed by an insurer
12 for use in the business of insurance, if such insurer is regulated
13 and supervised by the office of the insurance commissioner or a
14 comparable federal regulating body and subject to examination by such
15 entity under any existing statutes, rules, or regulations pertaining
16 to unfair trade practices and unfair discrimination, or published
17 guidance or regulations that apply to the use of high-risk artificial
18 intelligence systems and such guidance or regulations aid in the
19 prevention and mitigation of algorithmic discrimination caused by the
20 use of a high-risk artificial intelligence system or any risk of
21 algorithmic discrimination that is reasonably foreseeable as a result
22 of the use of a high-risk artificial intelligence system.
23 (b) Nothing in this chapter may be construed to delegate existing
24 regulatory oversight of the business of insurance to any department
25 or agency other than the office of the insurance commissioner.
26 (9) The provisions of this chapter do not apply to the
27 development of an artificial intelligence system that is used
28 exclusively for research, training, testing, or other predeployment
29 activities performed by active participants of any sandbox software
30 or sandbox environment established and subject to oversight by a
31 designated agency or other government entity and that is in
32 compliance with the provisions of this chapter.
33 (10) The provisions of this chapter do not apply to a developer
34 or deployer, or other person who develops, deploys, puts into
35 service, or intentionally modifies, as applicable, a high-risk
36 artificial intelligence system that:
37 (a) Has been approved, authorized, certified, cleared, developed,
38 or granted by a federal agency acting within the scope of the federal
39 agency's authority, or by a regulated entity subject to the
40 supervision and regulation of the federal housing finance agency; or
Code Rev/CC:ajr 15 H-3136.1/26
1 (b) Is in compliance with standards established by a federal
2 agency or by a regulated entity subject to the supervision and
3 regulation of the federal housing finance agency, if the standards
4 are substantially equivalent or more stringent than the requirements
5 of this chapter.
6 (11) The provisions of this chapter do not apply to a developer
7 or deployer, or other person that facilitates or engages in the
8 provision of telemedicine, as defined in RCW 70.41.020, or is a
9 covered entity within the meaning of the federal health insurance
10 portability and accountability act of 1996 (42 U.S.C. Sec. 1320d et
11 seq.) and the regulations promulgated under such federal act, as both
12 may be amended from time to time, if such developer, deployer, or
13 person is providing:
14 (a) Health care recommendations that are generated by an
15 artificial intelligence system and require a health care provider
16 subject to RCW 18.130.040 to take action to implement the
17 recommendations; or
18 (b) Services utilizing an artificial intelligence system for an
19 administrative, quality measurement, security, or internal cost or
20 performance improvement function.
21 (12) If a developer or deployer engages in any action authorized
22 by an exemption set forth in this section, the developer or deployer
23 bears the burden of demonstrating that such action qualifies for such
24 exemption.
25 (13) If a developer or deployer withholds information pursuant to
26 an exemption set forth in this chapter for which disclosure would
27 otherwise be required by this chapter, including the exemption from
28 disclosure of trade secrets, the developer or deployer shall notify
29 the subject of disclosure and provide a basis for withholding the
30 information. If a developer or deployer redacts any information
31 pursuant to an exemption from disclosure, the developer or deployer
32 shall notify the subject of disclosure that the developer or deployer
33 is redacting such information and provide the basis for such decision
34 to redact.
35 (14) For purposes of this section:
36 (a) "Financial institution" means a bank, out-of-state bank,
37 credit union, out-of-state credit union, federal credit union,
38 mortgage lender, or savings institution organized under state or
39 federal law, or any subsidiary, affiliate, or service provider of a
40 financial institution.
Code Rev/CC:ajr 16 H-3136.1/26
1 (b) "Insurer" has the same meaning as defined in RCW 48.01.050.
2 NEW SECTION. Sec. 5. (1) In addition to any other remedy
3 provided by law, a person may file a civil action against a developer
4 or deployer for a violation of this chapter. If a court finds that
5 the developer or deployer violated this chapter, the court may enjoin
6 the violation and award reasonable attorneys' fees and costs.
7 (2) In an action brought pursuant to this section, it is an
8 affirmative defense that the developer or deployer:
9 (a) Discovered a violation of any provision of this chapter;
10 (b) Cured such violation no later than 45 days after discovering
11 the violation;
12 (c) Provided notice to the person bringing the civil action
13 pursuant to this section that such violation has been cured and
14 provides accompanying evidence that the violation has been cured; and
15 (d) Is otherwise in compliance with the requirements of this
16 chapter.
17 NEW SECTION. Sec. 6. This chapter is declared to be remedial,
18 with the purposes of protecting consumers and ensuring consumers
19 receive information about consequential decisions affecting them. The
20 provisions of this chapter granting rights or protections to
21 consumers are construed broadly and exemptions construed narrowly.
22 NEW SECTION. Sec. 7. If any provision of this act or its
23 application to any person or circumstance is held invalid, the
24 remainder of the act or the application of the provision to other
25 persons or circumstances is not affected.
26 NEW SECTION. Sec. 8. Sections 1 through 6 and 9 of this act
27 constitute a new chapter in Title 19 RCW.
28 NEW SECTION. Sec. 9. This act takes effect January 1, 2027.
--- END ---
Code Rev/CC:ajr 17 H-3136.1/26
File and source
- File
- 2026-01-23_a33673_d292370_2157-pshb-h-3136-1.pdf
- Size
- 254,615 bytes
- SHA-256
- dfde2915cc8190454a7d77159c591bb4c175b2f2e02a9fd56e665f88191927f4
- Original
- No public link identified.