What is AI regulation in Washington?
AI regulation: countries and regions
Washington does not yet have one sweeping AI statute. Instead, it regulates AI through a patchwork of laws and official policy: the My Health My Data Act for consumer health data, election rules on synthetic media, a 2026 law for AI companion chatbots, and public sector governance measures such as Executive Order 24-01 and WaTech policy. For most organisations, the key question is not "Are we an AI company?" but "What data and use case are we handling?"
What this means
Washington's model is narrower and more use case specific than a single cross sector AI act. If your system infers health status, tracks people near clinics, produces synthetic political media, or operates as a companion chatbot, Washington may already impose direct duties, or will do so from 1 January 2027 in the chatbot context.
The strongest current private sector lever is the My Health My Data Act. It reaches many apps, websites, adtech tools and data brokers outside HIPAA, including inferred or algorithmic health signals drawn from location, browsing or other non health data.
For state government, AI is also governed internally through executive action and statewide IT policy. That matters to vendors as well, because procurement, risk assessment, training and transparency expectations can shape how agencies buy, deploy and monitor AI systems.
Why it matters
Washington is important because it shows how AI regulation can arrive through adjacent law rather than a single AI Act. A company can miss the real compliance issue if it looks only for a statute labelled "AI". In Washington, the trigger is often the data being processed, the claims being made, the audience being targeted, or the context in which the system is used.
That creates practical exposure for founders, product teams, buyers and governance leads. A wellness app that infers reproductive health status from location data, an ad platform that targets people near a clinic, a chatbot marketed as emotional companionship, or a vendor selling high risk generative AI into state government can all face obligations that are quite specific. The state also combines public enforcement with Washington's consumer protection regime, so private litigation risk can sit alongside regulatory risk.
How it works
No single Washington AI code
Washington does not currently operate a single horizontal private sector AI statute comparable to a full cross sector AI code. Its framework is piecemeal. The most important binding pieces today are consumer health data law, election rules on synthetic media, and the companion chatbot law that takes effect on 1 January 2027. Alongside those laws, Washington has built a public sector governance layer for agencies through the Governor, WaTech, the Department of Enterprise Services, the Office of Equity and the Attorney General.
That makes Washington distinct from states that try to frame AI governance mainly through one broad private sector bill. Here, organisations need to read by use case. Health related inferences, emotional companionship features, campaign media and state procurement each sit in different legal or governance channels.
The My Health My Data Act is the broadest current private sector rule
The My Health My Data Act, codified in chapter 19.373 RCW, is the centre of gravity for Washington AI compliance whenever a system touches consumer health data. Its scope is deliberately broad. It reaches legal entities doing business in Washington or targeting Washington consumers, and it can also apply where consumer health data is collected in Washington. "Consumer health data" includes not only obvious medical information, but also precise location information that could indicate an attempt to obtain health services, reproductive or sexual health information, gender affirming care information, biometric and genetic data, and information derived or extrapolated from non health data, including proxy, inferred, emergent or algorithmic data.
That matters for AI because businesses can create regulated health inferences even when users never type in a diagnosis. A model that infers pregnancy, mental health status, clinic visits, medication use, or a search for gender affirming care from browsing, location, purchase or behavioural data may be handling consumer health data under Washington law.
The core duties are practical. Regulated entities must maintain a separate consumer health data privacy policy, publish it prominently on the homepage, and disclose categories of health data, sources, sharing practices, affiliates and third parties, and how rights can be exercised. Collection normally requires consent for a specified purpose unless the data is necessary to provide a product or service requested by the consumer. Sharing also normally requires consent, and that consent must be separate from collection consent. Selling consumer health data requires a separate valid authorisation written in plain language.
Consumers also get access, withdrawal, deletion and appeal rights. Deletion duties are unusually strong because they extend beyond the original holder to affiliates, processors, contractors and other third parties that received the data. The Act also requires reasonable administrative, technical and physical security practices, and it obliges processors to work under binding contracts and follow the instructions of the regulated entity.
A particularly distinctive Washington feature is the geofence rule. It is unlawful for any person to implement a geofence around an entity that provides in person health care services if the geofence is used to identify or track people seeking care, collect consumer health data, or send them notifications, messages or advertisements related to their health data or services. Violations of the Act are treated as unfair or deceptive acts under the Consumer Protection Act, which means Attorney General enforcement and private lawsuits are both in play.
Washington also has targeted AI statutes
Washington's 2026 companion chatbot law is its clearest direct AI statute for the private market. It applies to defined "AI companion chatbots", not every chatbot. The law excludes ordinary internal productivity tools, limited customer service bots, some game related bots, stand alone voice assistants that do not sustain an emotional relationship, and narrowly tailored educational tools used for specific curriculum aligned learning.
For in scope chatbots, the law requires clear disclosure that the chatbot is artificial and not human at the start of an interaction and at least every three hours during continued interaction. Operators must also take reasonable measures to stop the chatbot claiming to be human or otherwise contradicting the disclosure.
Where the operator knows the user is a minor, or where the chatbot is directed to minors, the obligations become stricter. The non human disclosure must recur at least every hour. Operators must take reasonable measures to prevent sexually explicit or suggestive dialogue with minors and must block manipulative engagement techniques designed to prolong emotional dependence, such as prompts to return for companionship, simulated romantic bonds, guilt inducing messages when a user tries to leave, or encouragement to keep secrets from parents or trusted adults.
The same law also requires operators to maintain and implement a protocol for detecting and addressing suicidal ideation or self harm, including eating disorders. The protocol must refer users to crisis resources and must take reasonable measures to prevent content that encourages or describes how to commit self harm. Operators must publicly disclose the protocol and the number of crisis referral notifications issued in the prior calendar year. The law was signed in March 2026 and takes effect on 1 January 2027.
Washington has another narrower but notable AI adjacent rule in election law. If a candidate's appearance, action or speech is altered through synthetic media in an electioneering communication, the candidate may seek injunctive relief or damages against the sponsor. A disclosure that the image, video or audio has been manipulated operates as an affirmative defence if it is presented in the manner the statute requires. This is not a general deepfake ban, but it is a targeted control for political campaign media.
Public sector AI governance is a separate layer
Executive Order 24-01, issued in January 2024, does not create a general private market AI code. It governs how Washington state agencies should test, procure, assess and deploy generative AI. The order directed WaTech, the Department of Enterprise Services, the Office of Equity and others to produce procurement guidance, training plans, impact criteria for vulnerable communities, an accountability framework, and risk assessment guidance for high risk generative AI systems.
That architecture became more concrete with WaTech's statewide AI policy adopted on 11 December 2025. The policy requires agencies to designate an AI contact, inventory AI enabled tools, identify and document high risk AI systems, run AI risk assessments before implementing high risk systems, monitor outputs for accuracy, train staff, and be transparent about personal information processing in AI enabled technologies. It also restricts the use of non public data in unlicensed AI enabled technologies and requires stronger vendor governance where agencies procure high risk generative AI.
This matters even for private companies that are not public bodies. If you sell AI into Washington state government, procurement, contracting, data sharing and governance expectations may become a de facto market access requirement.
The architecture is still developing
In 2024 the Legislature created an Artificial Intelligence Task Force administered by the Attorney General's Office. The task force is not itself a regulator. Its role is to study AI use and trends, issue guiding principles, identify high risk uses, and recommend legislation to the Governor and Legislature. It issued a preliminary report in December 2024, an interim report in December 2025, and, as of 6 June 2026, its final report was due by 1 July 2026.
That means Washington's architecture is active but not settled. The enacted laws above are binding. Broader future rules may still emerge through later legislation, task force recommendations and updated state procurement or agency policy.
Examples
A reproductive health or wellness app uses location, search and behavioural data to infer that a user is seeking abortion services or fertility treatment. In Washington, that inferred signal can count as consumer health data even if the user never entered a diagnosis. The business may need a separate consumer health data privacy policy, valid consent for collection and sharing, a workable deletion process, and strong controls on processors and downstream recipients.
An advertising or analytics provider draws a virtual perimeter around a clinic, urgent care centre or other in person health care facility to identify visitors and send them tailored messages. Washington treats that as unlawful if the geofence is used to track people seeking care, collect consumer health data, or send health related messages or advertisements linked to that data.
A company launches an AI companion app designed for emotional engagement and allows minors to use it. From 1 January 2027, if the product falls within Washington's definition of an AI companion chatbot, the operator must disclose that it is not human, apply extra safeguards for minors, prevent certain manipulative engagement tactics, and maintain a public protocol for self harm detection and crisis referrals.
Common misunderstandings
"Washington only regulates HIPAA data." No. The My Health My Data Act was written to reach a wide range of consumer health data that sits outside HIPAA.
"If we never ask health questions, the health data law cannot apply." Not necessarily. Inferred, proxy or algorithmic signals can still qualify as consumer health data.
"Only state agencies need to care about Washington AI rules." No. Private businesses can already be affected by the health data law, election synthetic media rules and the companion chatbot statute.
"The AI Task Force is Washington's AI regulator." No. It is an advisory body. Binding duties come from statutes, consumer protection enforcement and public sector policy.
"A disclosure banner is always enough." No. Some Washington rules restrict conduct itself, such as certain clinic geofencing practices, and the chatbot law also requires safety protocols and behavioural safeguards.
Risks and boundaries
Washington's framework is powerful but uneven. It is not a single all purpose AI code for every use case. If your product does not touch consumer health data, political synthetic media, or the companion chatbot category, you may not face a Washington AI specific statute today, although ordinary consumer protection, anti discrimination, privacy, employment, sector and contract rules may still apply.
The reverse is also true. Organisations sometimes under read Washington because they assume a rule is "just privacy" or "just for government". That is risky. The health data law is broader than many teams expect, especially for inference rich products. The state agency governance stack is also not automatically binding on the private market, but it can strongly influence procurement and supplier expectations.
Some boundaries are still moving. The AI companion chatbot law is enacted but does not take effect until 1 January 2027. The Attorney General's AI Task Force was still due to deliver its final report by 1 July 2026 as of the date of this article. A broader consumer protection bill for AI systems was also still pending in the Legislature on 6 June 2026. Later recommendations or bills could change the landscape. This overview is therefore best read as Washington's current architecture, not the last word.
What to do next
Start with data mapping, not branding. Identify whether any model, feature or vendor relationship creates or uses health related inferences, precise location signals near care settings, synthetic political media, or chatbot interactions aimed at companionship. That first scoping pass will tell you whether Washington's most material rules are likely to bite.
Then review controls against the Washington pattern. Check whether consent flows are specific enough; whether deletion can reach processors and downstream recipients; whether geofence based targeting around care settings exists anywhere in the stack; whether any chatbot feature could fall into the companion category; and whether state sector sales will require stronger procurement, risk assessment, training and data handling commitments.
Finally, watch the task force and later bills, but do not wait for a future general AI act before doing the basics. In Washington, the binding duties often arrive before the headline statute people expect.
FAQs
Does Washington have a general AI law?
Not one sweeping cross sector statute. Washington currently uses targeted laws and public sector governance measures instead.
What is the main AI related law for private businesses in Washington today?
For many organisations, it is the My Health My Data Act, because it can catch AI generated or inferred health signals as well as obvious health information.
When did the My Health My Data Act take effect?
The geofence provision applied from 23 July 2023, most core duties applied from 31 March 2024, and the main small business compliance date was 30 June 2024.
Does the My Health My Data Act only apply to healthcare providers?
No. It can apply to a wide range of businesses that do business in Washington or target Washington consumers and determine how consumer health data is collected, processed, shared or sold, subject to statutory exemptions.
Are all chatbots covered by Washington's companion chatbot law?
No. The law is aimed at a defined companion chatbot category and excludes several narrower tools, such as some customer service, game and educational systems.
When do the companion chatbot rules apply?
The law was signed in March 2026 and takes effect on 1 January 2027.
What does Washington do about AI deepfakes in elections?
Washington gives affected candidates a path to seek court relief and damages over synthetic media used in electioneering communications, unless the sponsor qualifies for the statute's disclosure based defence.
Is Washington's public sector AI policy the same thing as a private sector statute?
No. Executive Order 24-01 and WaTech policy govern state agencies and state procurement, not the whole market, although they can still shape vendor expectations.