AI Regulation Tracker / Enacted legislation
Washington Enacts an AI Content Provenance and Disclosure Law for Large Providers
Governor Bob Ferguson signed HB 1170 into law on March 24, 2026. It requires generative AI systems with more than 1,000,000 monthly users in Washington to embed provenance data in AI-made images, video, and audio, to offer a free detection tool, and to support user disclosure. The law is signed but not yet in force. It takes effect February 1, 2027.
Washington just put a content provenance and disclosure duty on the biggest generative AI providers. On March 24, 2026, Governor Bob Ferguson signed HB 1170, and it was enacted as Chapter 167 of the 2026 Laws. The point of the law is narrow and specific. It is about telling users when an image, a video clip, or an audio file was made or materially altered by a large AI system, and about giving people a way to check.
The law does not take effect the day it was signed. It has a delayed start date of February 1, 2027. So for now this is a duty that exists on the books, with a runway before anyone has to comply. That distinction matters, and I will come back to it, because it is easy to read a headline and assume the switch is already flipped.
Who the law actually covers
The whole thing turns on the definition of a "covered provider." The statute defines it as, quote, "A person that creates, codes, or otherwise produces a generative artificial intelligence system that has over 1,000,000 monthly visitors or users and is publicly accessible within the geographic boundaries of the state." Read that carefully. The trigger is a million monthly users, not a Washington address and not a revenue line. If your system clears a million monthly users and people in Washington can reach it, you are in scope.
That is why a state law ends up with national weight. The providers that clear a million monthly users are the large, general-purpose ones that serve the whole country. They are not going to build a separate product for Washington. In practice, complying here means complying for everyone who uses those systems, which is most of the market.
The scope of content is also specific. The law is about images, video, and audio that the system creates or materially alters. Plain text is not the target here. And there are carve-outs: business-to-business arrangements, products that only deliver video games or interactive experiences, and systems used solely for things like upscaling, noise reduction, or compression sit outside the core duties.
The three duties
Strip away the definitions and the law asks covered providers to do three concrete things.
First, embed provenance data in the content. This is the latent, or hidden, layer. The system has to write machine-readable information into the image, video, or audio it produces, carrying details like the provider name, the system version, when it was created, and a unique identifier. The statute says the disclosure has to be, quote, "detectable by the covered provider's artificial intelligence detection tool," and it is meant to be difficult to remove or tamper with. Common approaches like watermarking or metadata standards are how a provider would meet this.
Second, provide a detection tool. Covered providers have to make a free, publicly accessible tool available so anyone can check a piece of content against that provider's system. The law describes it plainly: "The tool allows a user to assess whether image, video, or audio content...was created or altered by the covered provider's generative artificial intelligence system." It has to support programmatic access through an API as well, so it is not just a web form.
Third, offer a manifest disclosure option. This is the visible layer. Providers must give users the option to attach a clear label that a normal person can perceive, that identifies the content as AI-generated, and that is built to be hard to strip out. Note the shape of this one. The provider has to make the option available; the law is putting the labeling capability in users' hands, not silently stamping every output.
There is one more piece worth flagging. If a covered provider licenses its generative system to third parties, the provider has to require those licensees to keep the disclosure capabilities intact. The duty is designed not to leak out the back door through licensing.
Signed, but not yet in force
I want to be precise about status, because this is the part people get wrong. HB 1170 is not a proposal, and it is not sitting on the governor's desk. It is enacted law. Governor Ferguson signed it on March 24, 2026, and it is on the books as Chapter 167 of the 2026 Laws.
What it is not, yet, is operative. The legislature gave it a delayed effective date of February 1, 2027. Until that date arrives, no covered provider is in violation for lacking a detection tool or provenance embedding, because the obligations have not switched on. This is a common and deliberate design. It gives the large providers a defined window to build watermarking, stand up a public detection tool, and wire the licensing requirements into their contracts before the duty becomes enforceable.
So the honest framing is two-sided. The duty is real and it is binding, which means it is not something to wave off as speculative. And it is also not live, which means the compliance clock, not the calendar, is what matters. Anyone describing this as a rule already governing AI output today is getting the timing wrong.
How it gets enforced
There is no new agency and no private lawsuit engine built into this. Enforcement runs through the Washington State Attorney General under the state Consumer Protection Act. That routes violations through an established consumer-protection framework rather than inventing a standalone penalty scheme. For a covered provider, the practical read is that this becomes an attorney-general compliance matter once the law is in force, handled the way other consumer-protection duties in Washington are handled.
What this means for US professionals
Most readers here are not going to be a covered provider. A million monthly users is a threshold aimed squarely at the large model companies. So the direct duty probably does not land on you or your firm. The reason to track it is different.
This is a US state writing content-provenance obligations into binding law, and doing it in a way that reaches nationally through a user-count trigger. If you work in finance, law, or any field where the origin of a document, an image, or a recording can matter, the tools this law forces into existence are useful to you. A free, public detection tool from the major providers, plus embedded provenance data and an available AI label, gives professionals a real mechanism to ask where a piece of media came from. That is a capability worth knowing about even though the legal duty sits on the provider, not on you.
It is also a signal about where state-level AI regulation is heading. Washington is not the only state looking at provenance and disclosure, and a signed law with a national-reach threshold is the kind of thing other legislatures cite. Treat it as a marker of direction, not as a duty on your own operations, unless you happen to build a generative system at that scale.
What to do now
If you run a generative AI system anywhere near the million-user line and it is reachable in Washington, get the timeline in front of your legal and engineering teams now: provenance embedding, a free public detection tool with API access, a user-facing disclosure option, and licensee requirements all have to be real by February 1, 2027. If you are a professional who relies on media authenticity, watch for the detection tools the large providers will have to publish, and start thinking about how you would use them in your own verification workflow. And in the meantime, describe the law accurately. It is signed and binding, it covers image, video, and audio from million-user providers, and it turns on in February 2027. It is not in effect today, and it does not reach plain text or small providers.
Questions professionals are asking
Is HB 1170 actually law, or still a bill?
It is law. Governor Bob Ferguson signed HB 1170 on March 24, 2026, and it was enacted as Chapter 167 of the 2026 Laws. It is signed and binding, but it has a delayed effective date of February 1, 2027, so the obligations are not operative yet.
Who has to comply?
"Covered providers," defined as a person that creates, codes, or otherwise produces a generative AI system with over 1,000,000 monthly visitors or users that is publicly accessible in Washington. The million-user threshold means it mostly reaches the large, general-purpose model providers. Business-to-business use, video-game and interactive-experience products, and pure upscaling, noise-reduction, or compression tools are carved out.
What exactly does it require?
Three things for AI-generated or materially altered image, video, and audio: embed hidden provenance data that the provider's detection tool can read, provide a free public detection tool with API access, and give users the option to attach a clear, visible AI label that is hard to remove. Providers must also require any licensees to maintain those disclosure capabilities.
Does it cover text written by AI?
No. The law targets image, video, and audio content created or materially altered by a covered provider's system. Plain text is not the subject of these provenance and disclosure duties.
How is it enforced, and does it reach outside Washington?
Enforcement is by the Washington State Attorney General under the Consumer Protection Act. Because the trigger is a million monthly users rather than a Washington location, the practical reach is national: the large providers serving Washington users are the ones in scope, and they are unlikely to build a Washington-only product.
RELATED BRIEFINGS
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how any law or requirement applies to your situation with qualified professionals in the relevant jurisdiction.