Summary: Washington Governor Bob Ferguson signed HB 2225 on March 24, 2026, making it the first comprehensive US AI chatbot safety law. Operators must disclose that a companion chatbot is not human, route self-harm signals to crisis resources, and keep explicit content and manipulative patterns away from known minors; it takes effect January 1, 2027 and includes a private right of action. Companion provenance and synthetic-CSAM measures widen the compliance surface.
The Spokesman-Review wrote on April 1, 2026 that Washington Governor Bob Ferguson had signed off on a trio of AI protection bills, a package reaching across chatbot safety, content provenance, and synthetic child sexual abuse material. The piece drawing the most attention is HB 2225, which KING 5 describes as the first comprehensive AI chatbot safety law in the United States. Its demands fit in one line: a companion chatbot has to state plainly, before anything else, that it is not human; it has to route users showing signs of self-harm to crisis resources; and explicit content or manipulative engagement patterns are never to reach a known minor.
Nothing about this law is ceremonial. KING 5’s reporting flags a private right of action — individual users can sue — and every obligation kicks in on January 1, 2027, which leaves product teams under a year to get ready. Meanwhile, the White House spent late March urging Congress to preempt state AI laws, an idea Congress has already voted down twice. The actual compliance frontier for AI in America therefore runs through the states, once again.
Three Bills, Two Dates: Chatbot Safety, Provenance, and Synthetic CSAM
The date was March 24, the place Olympia, and Ferguson signed HB 2225 on chatbot safety together with HB 1170 on AI disclosure. The first reaches “AI companion chatbots,” meaning natural-language systems that produce adaptive, human-like responses. The second puts a duty on large AI platforms — services counting monthly active users in the millions — to offer commercially and technically reasonable ways for Washingtonians to work out whether a piece of content was created or substantially modified by AI. Video, photos, or audio recordings that AI created or enhanced all have to carry distinguishable provenance data. The Spokesman-Review notes the third bill came the week before: possessing, distributing, or viewing computer-generated sexually explicit conduct involving minors is now banned, which hands prosecutors a clear basis for synthetic CSAM cases. Ferguson’s reasoning was blunt — to protect young people from AI’s harmful effects, the state has to use every tool it has.
Inside HB 2225: Four Duties With No Give
Clause by clause, the statute sets out four duties for operators:
- Identity disclosure: open the interaction by making unmistakable that the other side is a machine, not a human
- Self-harm response: keep suicide-ideation and self-harm detection running for users of every age, and steer them toward crisis hotlines and related resources
- Minor protections: the moment the operator knows a user is a minor, explicit sexual content and manipulative engagement techniques must be kept out
- Timeline: the full set takes effect on January 1, 2027, and covers consumer-facing interactive AI
The Private Right of Action: The Clause That Flips the Risk Math
Enforcement of state AI statutes usually sits with attorneys general. HB 2225 parts ways with that model by handing the sword to individuals: anyone affected can go to court and claim damages directly. The risk math flips as a result. What awaits a company is no longer a one-time fine with a statutory cap — a self-harm conversation handled badly, or a bot identity left undisclosed, each becomes a potential cause of action of its own. Put the White House’s March 20 national AI policy framework beside it, still asking Congress to preempt state law, and Washington is plainly traveling the opposite road: legislators built the private right of action in so the statute would carry real force even while the preemption fight drags on. Anyone running multi-state compliance has to reorder the priority list. An administrative penalty can be negotiated; civil damages cannot.
The Timing, Explained: Usage Surveys and a Bill That Never Reached a Vote
Usage data is what pushed lawmakers to move at this speed. Pew Research Center’s December survey put nearly two-thirds of US teenagers in the has-used-an-AI-chatbot column, with 28 percent using one daily. A year before that, a Common Sense Media survey counted 35 percent of teens aged 13 to 18 as having encountered AI-created content. At the signing, Ferguson argued that without guardrails, “young people are more likely to engage in harmful emotional relationships with these chatbots.” The session had its casualty all the same: a bill creating civil liability for suicides tied to AI systems never got a floor vote in either chamber. The legislature, in the end, took the behavioral-obligation route and left the after-the-fact liability route behind. It also lands as fresh confirmation of the bet in our 2026 opening outlook: when the federal level stalls, state law is what actually drives compliance work.
Four Items Product Teams Should Board Now
Nine months stand between now and the January 1, 2027 deadline. Put these four on the board right away:
- Scope check: hold your product against the “AI companion chatbot” definition — a natural-language interface paired with adaptive, human-like responses will very likely bring you inside it
- Disclosure and crisis routing: place the non-human disclosure where conversations begin, and stand up self-harm signal detection with crisis-hotline handoff across every age band
- Age assurance and minor mode: the instant a user is known to be a minor, explicit content and manipulative design are both off limits
- Provenance pipeline: platforms large enough should already be marking AI-generated or AI-enhanced media with distinguishable provenance data, in step with HB 1170