Law / United States / 
Washington
AI companion chatbot disclosure and safety act
1st Sub. H.B. 2225, ch. 168, Laws of 2026 (new chapter, Title 19 RCW)
An AI transparency rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- User location
- Obligation class
- Content labelling, Disclosure, Governance
- Audit expectation
- none
What it requires
- If you operate an AI companion chatbot, disclose clearly and conspicuously that it is artificial and not human at the start of an interaction, at least every three hours during continued interaction, and at the start of every new session.NIST AI RMFMEASURE 2.8
- If you know the user is a minor, disclose proactively, take reasonable measures to prevent the chatbot from generating sexually explicit content or suggestive dialogue with them, and do not use manipulative engagement techniques designed to prolong an emotional attachment.NIST AI RMFMEASURE 2.8NIST AI RMFMAP 1.6
- Maintain protocols to detect and respond to expressions of self-harm or suicidal ideation, including referral to crisis resources, and publicly report on those protocols annually.NIST AI RMFMEASURE 2.6NIST AI RMFGOVERN 4.2
- A violation is treated as an unfair or deceptive act under the Consumer Protection Act rather than punished under a separate penalty scheme.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Section 6 makes a violation of the chapter an unfair or deceptive act in trade or commerce for the purpose of applying the consumer protection act, chapter 19.86 RCW. RCW 19.86.140 sets the civil penalty for a violation of RCW 19.86.020 at not more than $7,500 for each violation, recoverable by the attorney general, and adds an enhanced penalty of $5,000 for unlawful acts that target or impact specific individuals or communities based on demographic characteristics including age. The chapter states no penalty of its own.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,500
Who enforces it
Enforcement body
The Washington Attorney General under the Consumer Protection Act (RCW 19.86.080 and 19.86.140), and any person injured in his or her business or property through a private civil action under RCW 19.86.090; the chapter names no other agency.
Settledness
- As of
- Open questions
- Does an assistant that keeps memory of earlier sessions "sustain a relationship across multiple interactions" within the definition of AI companion chatbot in section 2(1)(a) of chapter 168, Laws of 2026, or must it also exhibit "anthropomorphic features"?
- What makes an AI companion chatbot "directed to minors" under section 4(1) of chapter 168, Laws of 2026, a term that section 2 does not define?
- Does the hourly notice in section 4(2)(b) replace the three-hour notice in section 3(2)(b) for a user the operator knows is a minor, or must an operator satisfy both?
- Does a user who is harmed by a violation but loses no money or property have a claim under RCW 19.86.090, the private remedy that section 6 reaches by treating a violation as an unfair or deceptive act, given that it requires injury in "business or property"?
What it makes you log
Who may demand the log
Public
Logging duty
The act's disclosure duties name no record. Section 5(3) requires an operator to publicly disclose the number of crisis referral notifications issued to users in the preceding calendar year, a figure that cannot be stated without counting each notification as it is issued over the year.
- Kind
- Implicit
- As of
- Provision
- Sec. 5(3)
What this law does
An operator of an AI companion chatbot, an AI system a reasonable person could mistake for a human conversational partner, must clearly and conspicuously disclose at the start of an interaction, at least every three hours during continued interaction, and at the start of every new session that the user is talking with an artificial system.
Where the operator knows the user is a minor, it must additionally disclose proactively, implement reasonable measures against sexually explicit or suggestive content, and prohibit manipulative engagement techniques designed to prolong an emotional attachment. An operator must also maintain protocols to detect and respond to expressions of self-harm or suicidal ideation, including crisis-resource referrals, and publicly report on those protocols annually.
A violation is enforced as an unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW, rather than through a standalone penalty.
When LexLint raises it
When your app profile says your app serves under-18s or deploys a companion chatbot.
Back to the example · Lint your app
Page updated .