Artificial Intelligence. Artificial intelligence (AI) is defined and understood in different ways. The National Institute of Standards and Technology (NIST), in its AI Risk Management Framework, defines an AI system as an engineered or machine-based system that can, for a given set of objectives, generate outputs such as predictions, recommendations, or decisions influencing real or virtual environments.

Artificial Intelligence Task Force. In 2024 the Legislature established the AI Task Force, administered by the Office of the Attorney General. The AI Task Force is tasked with assessing current uses and trends of AI and making recommendations to the Legislature regarding guidelines and potential legislation for the use of AI systems.

High Risk Artificial Intelligence Systems. Beginning July 1, 2027, each deployer of a high-risk AI system must use industry-standard means to protect consumers from any known or reasonably foreseeable risks of algorithmic discrimination.

Risk Management. Deployers of high-risk AI systems, on or after July 1, 2027, must implement and maintain a risk management policy and program. The policy and program must specify and incorporate the principles, processes, and personnel that the deployer uses to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination. A deployer must use:

• a NIST or other nationally or internationally accepted framework; or
• comply with a framework that the attorney general designates.

Impact Assessments. Deployers of high-risk AI systems, on or after July 1, 2027, must complete an impact assessment that evaluates and documents:

• the systems purpose;
• an analysis of known or foreseeable risks of algorithmic discrimination;
• steps taken to mitigate risks;
• a description of the data, outputs, and metrics to evaluate the system; and
• a description of transparency measures, post-deployment monitoring and user safeguards.

Consumer Notice. Each time a deployer uses an AI system in making a consequential decision, the deployer must provide notice to the consumer with certain disclosures. 

In any enforcement action, there is a rebuttable presumption that a deployer used reasonable care if the deployer was in compliance with the requirements of this act.

Exemptions. Exempt AI systems and covered entities under the act include:

• deployers that employ fewer than 50 full time employees;
• deployers that do not use the deployers own data to train the AI system; and
• AI systems that are used for the intended uses as disclosed by the deployer and where the deployer makes available to consumers any impact assessment that includes information that is substantially similar to information in the impact assessment required under this act.

Enforcement. The attorney general may bring an enforcement action under the Consumer Protection Act. Before commencing an enforcement action, the attorney general must provide 45 days written notice to a deployer or developer that is out of compliance with the act.

Government Disclosure. A government agency that makes available an AI system intended to interact with consumers must provide certain disclosures to each consumer, before or at the time of interaction, that the consumer is interacting with an AI system. 

Artificial Intelligence Task Force. A new workgroup under the direction of the AI Task Force is established. The workgroup is charged with developing recommendations related to AI in the workplace. Membership is appointed by the attorney general.

The expiration date for the AI Task Force is extended to June 30, 2028.

"Algorithmic discrimination" is defined to mean the use of an AI system that results in an unlawful differential impact that disfavors an individual or group on the basis of a protected class defined under the Washington laws against discrimination.

"Consequential decision" is defined to mean any decision that has a material legal or similarly significant impact on decisions including, but not limited to: pardon, parole, or release; educational enrollment; employment, financial or lending, health care, insurance.

PRO: Artificial intelligence is increasingly present in our lives. There is a lot of fear around AI. But I also want to acknowledge that it is creating incredible advancements in human understanding in health care, in diagnostic accuracy. It's improving accessibility. It's personalizing education. It is being used to help find poachers in remote parts of the world to save endangered species. But, it also contains serious risks. This bill proposes to balance those that say we should spend our scarce regulatory resources on the high-risk applications where real harm could be done to Washingtonians. Our regulation should match the risk and that is what the bill fundamentally does. To make consequential decisions, AI systems must have a risk management policy in place so that they can identify and mitigate any potential discrimination. They must also do impact assessments so they can monitor how it's impacting consumers. It borrows from other states but does not overregulate so that we leave room for the development of new ideas. It also extends the task force. This bill uses rules so the benefits of AI do not come with preventable harms. 

CON: We support extension of the task force and disclosure requirements by government agencies. We have concerns that the requirements in the bill will impact new businesses and risk chilling the beneficial uses of AI. In absence of a comprehensive federal framework, a patchwork of state laws and regulations will hurt small businesses. The way in which this bill defines artificial intelligence and consequential decision could encompass beneficial data-driven models while ignoring offline and real-world sources of potential discriminatory conduct. I am concerned about the concept of algorithmic discrimination in this bill. If a business used AI for a consequential decision and the result was discriminatory the business would be liable, not the tool.

OTHER: We would like you to know that the regulatory framework developed by the insurance commissioners prohibits unfair discrimination while requiring insurers to price coverage prospectively based on actuarily sound risk. This features a lawful risk classification where differential treatment of consumers is based on risk and not protected classes. As currently drafted, this could unintentionally treat regulator approved risk classification as discriminatory. Hospitals and HIPAA covered entities operate under significant regulation to protect patients. They may be using AI for administrative, operational, quality improvement, and clinical decision support functions. Our concern is that the bill could be interpreted to apply to routine uses, even when they do not make patient care decisions. As highly regulated financial institutions, credit unions operate under extensive oversight that does cover the use of AI. Our request is a separate parallel implementation structure for credit unions. We support strong consumer protections and our concern is that there is still significant legal uncertainty around this proposal. We have submitted language to exempt financial institutions so long as they comply with state and federal regulations.  There's broad agreement that artificial intelligence, particularly high-risk, uses, deserves careful legislative attention. TechNet represents over 100 companies including developers and deployers. Some see this as workable and others are concerned about inconsistent standards across the US.