Substitute Senate Bill 6284 creates a new statutory framework added as new chapters to Title 19 RCW and Title 42 RCW and amends an uncodified 2024 provision. It requires developers and deployers of defined “high‑risk” artificial intelligence systems to adopt risk management policies and programs, perform initial and updated impact assessments, conduct at least annual reviews, and implement industry‑standard protections against known or reasonably foreseeable algorithmic discrimination. Deployers must notify consumers before a high‑risk AI system makes or substantially factors into a consequential decision (effective July 1, 2026) and must begin many of the risk management and impact assessment obligations on July 1, 2027. Developers and deployers must retain impact assessments and supporting records for at least three years. The bill includes exemptions for small entities (fewer than 50 full‑time equivalent employees in certain circumstances), HIPAA covered uses, certain federal and insurance or financial institution activities, and other carve‑outs described in the text. The bill is regulatory and procedural rather than criminal: it establishes compliance obligations, documentation and disclosure duties, and an enforcement procedure administered by the Washington attorney general. Violations are treated as unfair or deceptive acts under the consumer protection act and may be enforced only by the attorney general (no private right of action); the attorney general must give 45 days’ written notice before bringing an action and a first violation may be cured within 60 days of notice. Deployers who discover that a high‑risk system has caused algorithmic discrimination must notify the attorney general without unreasonable delay and no later than 90 days after discovery, and compliance with the chapter creates a rebuttable presumption of reasonable care in enforcement actions brought on or after July 1, 2027. The bill also extends and expands an artificial intelligence task force and creates an artificial intelligence workplace advisory group to develop workplace guidance, with specified reporting deadlines and an apparent expiration of the workplace advisory group provision on June 30, 2028. The extracted text is incomplete in places: portions referencing the national AI risk management framework, the full content of section 6 (including subsection 6(6)), the complete enforcement provisions in section 10, and some definitions and remaining exemptions are missing from the provided excerpts and cannot be determined from these facts alone.

If enacted, businesses that put AI systems into service to make or substantially influence consequential decisions about Washington residents will need to build and run formal risk management programs aligned with recognized frameworks (NIST, ISO/IEC 42001, or an attorney general–designated equivalent), complete impact assessments at deployment and after major modifications, perform at least annual reviews, keep records for three years, and provide clear consumer notice and plain‑language descriptions before AI-driven consequential decisions. Developers of high‑risk systems face similar program and documentation duties unless they have fewer than 50 full‑time equivalent employees; government agencies must conspicuously tell consumers when they are interacting with an AI system. If algorithmic discrimination is found, deployers must notify the attorney general without unreasonable delay and no later than 90 days, and compliance with these duties gives a rebuttable presumption of reasonable care in AG enforcement actions. The groups most affected are deployers and developers of high‑risk AI (including third‑party contractors they use), who will likely see added ongoing costs for staffing, audits, documentation, training, and possible consultants to meet frameworks and conduct assessments, plus operational changes to provide consumer notices and monitoring. The attorney general becomes the sole enforcement actor under the state consumer protection act, with a required 45‑day notice and a 60‑day cure opportunity for first violations, which reduces immediate private lawsuit risk but preserves state enforcement exposure. Certain entities—small operators under 50 FTE meeting conditions, HIPAA covered health actors in specified uses, regulated insurers, many federal acquisitions, and some financial institutions—have exemptions or carve‑outs. Some implementation details and portions of the risk framework and enforcement mechanics are not included in the excerpts, leaving limited uncertainty about exact scope and penalties.