Artificial Intelligence. Artificial intelligence (AI) is defined and understood in different ways. The National Institute of Standards and Technology (NIST), in its AI Risk Management Framework, defines an AI system as an engineered or machine-based system that can, for a given set of objectives, generate outputs such as predictions, recommendations, or decisions influencing real or virtual environments.
Artificial Intelligence Task Force. In 2024 the Legislature established the AI Task Force, administered by the Office of the Attorney General. The AI Task Force is tasked with assessing current uses and trends of AI and making recommendations to the Legislature regarding guidelines and potential legislation for the use of AI systems.
High Risk Artificial Intelligence Systems. Beginning July 1, 2027, each deployer of a high-risk AI system must use industry-standard means to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination.
A "high-risk artificial intelligence system" is defined as a system that is intended to autonomously make, or be a substantial factor in making, a consequential decision without meaningful human consideration.
Risk Management. Developers and deployers of high-risk AI systems, on or after July 1, 2027, must implement and maintain a risk management policy and program. The policy and program must specify and incorporate the principles, processes, and personnel that the deployer uses to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination. A deployer must use:
Impact Assessments. Deployers of high-risk AI systems, on or after July 1, 2027, must complete an impact assessment that evaluates and documents:
Consumer Notice. Each time a deployer uses an AI system in making a consequential decision, the deployer must provide notice to the consumer with certain disclosures.
In any enforcement action, there is a rebuttable presumption that a deployer used reasonable care if the deployer was in compliance with the requirements of this act.
Exemptions. Developers with fewer than 50 full-time equivalent employees are exempt from the risk management requirements under the act. Deployers are exempt from the risk management and impact assessment requirements if they:
The requirements in the act must not be construed to apply to federal agencies, the use of AI for research, performance of work in contract with certain federal agencies, HIPAA covered entities under certain circumstances, insurers regulated by the Office of the Insurance Commissioner or a comparable federal body, certain financial institutions, and other entities under specific conditions as provided in the act.
Enforcement. The attorney general may bring an enforcement action under the Consumer Protection Act. Before commencing an enforcement action, the attorney general must provide 45 days written notice to a deployer or developer that is out of compliance with the act.
Government Disclosure. A government agency that makes available an AI system intended to interact with consumers must provide certain disclosures to each consumer, before or at the time of interaction, that the consumer is interacting with an AI system.
Artificial Intelligence Task Force. A new workgroup under the direction of the AI Task Force is established. The workgroup is charged with developing recommendations related to AI in the workplace. Membership is appointed by the attorney general and specified in the act
The expiration date for the AI Task Force is extended to June 30, 2028.
"Algorithmic discrimination" is defined to mean the use of an AI system that results in an unlawful differential impact that disfavors an individual or group on the basis of a protected class defined under the Washington laws against discrimination.
"Consequential decision" is defined to mean any decision that has a material legal or similarly significant impact on decisions including, but not limited to: pardon, parole, or release; educational enrollment; employment, financial or lending, health care, insurance.
The committee recommended a different version of the bill than what was heard. PRO: Artificial intelligence is increasingly present in our lives. There is a lot of fear around AI. But I also want to acknowledge that it is creating incredible advancements in human understanding in health care, in diagnostic accuracy. It's improving accessibility. It's personalizing education. It is being used to help find poachers in remote parts of the world to save endangered species. But, it also contains serious risks. This bill proposes to balance those that say we should spend our scarce regulatory resources on the high-risk applications where real harm could be done to Washingtonians. Our regulation should match the risk and that is what the bill fundamentally does. To make consequential decisions, AI systems must have a risk management policy in place so that they can identify and mitigate any potential discrimination. They must also do impact assessments so they can monitor how it's impacting consumers. It borrows from other states but does not overregulate so that we leave room for the development of new ideas. It also extends the task force. This bill uses rules so the benefits of AI do not come with preventable harms.
CON: We support extension of the task force and disclosure requirements by government agencies. We have concerns that the requirements in the bill will impact new businesses and risk chilling the beneficial uses of AI. In absence of a comprehensive federal framework, a patchwork of state laws and regulations will hurt small businesses. The way in which this bill defines artificial intelligence and consequential decision could encompass beneficial data-driven models while ignoring offline and real-world sources of potential discriminatory conduct. I am concerned about the concept of algorithmic discrimination in this bill. If a business used AI for a consequential decision and the result was discriminatory the business would be liable, not the tool.
OTHER: We would like you to know that the regulatory framework developed by the insurance commissioners prohibits unfair discrimination while requiring insurers to price coverage prospectively based on actuarily sound risk. This features a lawful risk classification where differential treatment of consumers is based on risk and not protected classes. As currently drafted, this could unintentionally treat regulator approved risk classification as discriminatory. Hospitals and HIPAA covered entities operate under significant regulation to protect patients. They may be using AI for administrative, operational, quality improvement, and clinical decision support functions. Our concern is that the bill could be interpreted to apply to routine uses, even when they do not make patient care decisions. As highly regulated financial institutions, credit unions operate under extensive oversight that does cover the use of AI. Our request is a separate parallel implementation structure for credit unions. We support strong consumer protections and our concern is that there is still significant legal uncertainty around this proposal. We have submitted language to exempt financial institutions so long as they comply with state and federal regulations. There's broad agreement that artificial intelligence, particularly high-risk, uses, deserves careful legislative attention. TechNet represents over 100 companies including developers and deployers. Some see this as workable and others are concerned about inconsistent standards across the US.