The short version
- Washington: new laws on companion chatbots, labeling of AI-generated content, and deepfakes of real people. Its existing anti-discrimination and health data laws apply to AI use without naming it.
- Idaho: a chatbot disclosure law starting July 1, 2027, plus narrow laws on deepfakes, AI-generated abuse material, and schools.
- Not enacted: Washington did not pass an AI training data transparency bill or a Colorado-style high-risk AI bill in 2026.
- Out of state: Colorado's replacement automated decision law starts January 1, 2027, and the EU AI Act reaches U.S. companies whose AI output is used in the EU.
Washington
| Law | What it covers | Effective |
|---|---|---|
| HB 2225 (2026), Chapter 168 | AI companion chatbots: disclose they are not human, protections for minors, self-harm protocols; enforced under the Consumer Protection Act | January 1, 2027 |
| HB 1170 (2026), Chapter 167 | Generative AI providers with over 1,000,000 monthly users must embed provenance data in AI-created or altered images, audio, and video; state agencies must disclose when people are interacting with AI; enforced by the attorney general | February 1, 2027 |
| SSB 5886 (2026), Chapter 69 | Adds AI "forged digital likeness" of a real person to the Personality Rights Act, RCW 63.60 | June 11, 2026 |
| HB 1205 (2025), Chapter 51 | Bans knowing distribution of a forged digital likeness | July 27, 2025 |
| RCW 49.60 (Law Against Discrimination) | Applies to hiring decisions however they are made, for employers with eight or more employees | In effect |
| RCW 19.373 (My Health My Data Act) | Any processing of consumer health data, including through AI tools; private right of action through the Consumer Protection Act | In effect |
HB 2225 targets AI companion chatbots, not ordinary customer service bots. Washington's AI task force, created by SB 5838 in 2024, issued its final report on July 1, 2026; the Attorney General says lawmakers enacted four of its eleven recommendations in whole or in part.
Idaho
| Law | What it covers | Effective |
|---|---|---|
| SB 1297 (2026), Conversational AI Safety Act | Disclosure that users are talking to AI where they could be misled, extra disclosure and protections for minors, a suicide-response protocol; excludes customer service bots; attorney general enforcement, up to $1,000 per violation | July 1, 2027 |
| SB 1227 (2026) | Generative AI in K to 12 education | July 1, 2026 |
| H 575 (2024) | Crime of disclosing explicit synthetic media | July 1, 2024 |
| H 465 (2024) | Crime covering AI-generated child sexual abuse material | July 1, 2024 |
| H 664 (2024) | Relief against synthetic media in election communications | March 25, 2024 |
Idaho has no general AI liability or high-risk AI statute.
Colorado, the EU, and federal changes
| Rule | What matters for WA and ID businesses | Key dates |
|---|---|---|
| Colorado SB 26-189 (automated decision-making technology) | Replaced the 2024 Colorado AI Act. Businesses using automated decision technology in consequential decisions, such as hiring or lending, must notify people and explain adverse decisions; enforced by the Colorado attorney general only | Signed May 14, 2026; key duties January 1, 2027 |
| EU AI Act | Applies to companies outside the EU whose AI systems or output are used in the EU | Transparency duties from August 2, 2026; high-risk systems such as hiring and credit from December 2, 2027; AI in regulated products from August 2, 2028 |
| Executive Order 14365 (December 2025) | Directs a federal task force to challenge state AI laws | An executive order does not by itself preempt state law |
| EEOC | Removed its AI hiring guidance in January 2025 | The underlying federal laws still apply |
| OMB M-25-22 (April 2025) | Federal agencies should consider requiring vendors to disclose AI use, and bar AI vendors from using non-public agency data to train publicly or commercially available AI | Applies to newer federal solicitations |
What this means for insurance
New AI laws create new ways to be sued or investigated, and many come with consumer protection enforcement. The policies that respond are the same ones covered in the AI liability guide: E&O for wrong output, EPLI for hiring tools, cyber for privacy and security, and D&O for leadership. Regulatory fines are often uninsurable, but defense costs may be covered.