Law / United States / 
Washington
AI content provenance and disclosure act
E2SHB 1170, ch. 167, Laws of 2026 (new chapter, Title 19 RCW)
An AI transparency rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Market targeting, Place of effect
- Obligation class
- Content labelling, Disclosure
- Audit expectation
- none
- Setting the rule reaches
- General
What it requires
- If your generative AI system has over 1,000,000 monthly Washington visitors or users, offer users the option to add a manifest disclosure identifying AI-generated image, video, or audio content as such, that is clear, conspicuous, and difficult to remove.NIST AI RMFMEASURE 2.8
- Separately, embed a latent, system-readable disclosure in the AI-generated image, video, or audio content itself, conveying your name, the generating system and version, and the content's creation date, and make it detectable by a free, public AI-detection tool you provide.NIST AI RMFMEASURE 2.8
- If you license your generative AI system to a third party, require by contract that the licensee preserve this disclosure capability.NIST AI RMFGOVERN 6.1
- A violation is treated as an unfair or deceptive act under the Consumer Protection Act rather than punished under a separate penalty scheme.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 6.1Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Log retention
The prohibition covers the detection tool the act requires, not the latent disclosure embedded in generated content itself.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Personal information collected from a user of the artificial intelligence detection tool, beyond the contact information of a user who opts in to being contacted after submitting feedback; any personal provenance data detected in content submitted to the tool; and content submitted to the tool for longer than necessary to comply with the section creating the tool.
Logging duty
The act requires a manifest, user-facing disclosure and a latent, machine-readable disclosure embedded in the AI-generated content itself, plus a public detection tool that reads embedded provenance data back out. It states no duty for the covered provider to create, keep, or later produce a separate record of a disclosure once the content carries it.
- Kind
- None
- As of
What this law does
A 'covered provider,' a person that creates, codes, or otherwise produces a generative AI system with over 1,000,000 monthly visitors or users publicly accessible in Washington, must offer users an optional, difficult-to-remove manifest disclosure identifying AI-generated image, video, or audio content as such, and must separately embed a latent (system-readable) disclosure in AI-generated image, video, or audio content conveying the provider's name, the generating system and version, and the content's creation date, detectable by the provider's own free public AI-detection tool.
A covered provider that licenses its generative AI system must require by contract that the licensee preserve this disclosure capability. A violation is enforced as an unfair or deceptive act under the Consumer Protection Act, chapter 19.86 RCW. The bill's introduced text also proposed a disclosure duty for a government agency using AI to interact with consumers; that duty is not confirmed against the final chaptered text and is not described further here.
When LexLint raises it
When your app profile says your app generates audio with AI, generates images with AI or generates video with AI.
Back to the example · Lint your app
Page updated .