AI Frontier Institute

Regulating high-risk artificial intelligence system development, deployment, and use.

View primary source →

SB 6120 has not been enacted. It was referred to the Environment, Energy & Technology committee after its first reading on 2026-01-14. If enacted, it would add a new chapter to Title 19 RCW regulating "high-risk artificial intelligence systems". These are AI systems intended to autonomously make, or be a substantial factor in making, consequential decisions about Washington consumers. Consequential decisions cover parole and probation, education, employment, financial or lending services, health care, housing, insurance, marital status, and legal services (Sec. 1). Developers would have to use reasonable care to protect consumers from known or foreseeable algorithmic discrimination. They would also have to give deployers a statement of intended uses and documentation of limitations, evaluation, and mitigation measures. They would have to update these disclosures within 90 days of an intentional and substantial modification. Developers of high-risk generative AI would have to make synthetic content outputs identifiable and detectable, with exceptions (Sec. 2). Deployers would have to use reasonable care and keep a risk management policy and program. They would have to complete impact assessments before deployment and before significant updates, and keep the records for three years. They would also have to tell consumers they are interacting with an AI system, explain adverse decisions based on personal data beyond what the consumer provided, and post a risk-management statement (Sec. 3). Conformity with the NIST AI Risk Management Framework, ISO/IEC 42001, or a similar framework creates a presumption of conformity (Secs. 2 and 3). Trade secrets need not be disclosed. Many exemptions apply, including for certain federal systems, financial institutions, insurers, HIPAA-covered entities and telemedicine in specified circumstances, and federally approved systems (Sec. 4). A person could sue a developer or deployer for violations and seek an injunction and attorneys' fees and costs. It is an affirmative defense if the violation was cured within 45 days of discovery, with notice and evidence given to the plaintiff (Sec. 5). The chapter would be construed broadly for consumer protections and narrowly for exemptions (Sec. 6). The act would take effect January 1, 2027 (Sec. 9).

← Back to the tracker