A New Law for a New Product Category
Most AI regulation to date has targeted AI systems by risk level, use case, or sector. Washington State took a different approach. HB 2225 targets a product category: the AI companion chatbot. Governor Bob Ferguson signed the bill on March 24, 2026. It takes effect January 1, 2027.
That specificity is both the law’s strength and its primary compliance challenge. Operators need to answer one question before they can answer any others: does our product meet the statute’s definition of an AI companion chatbot? The answer determines whether everything else in this analysis applies.
The official legislative record exists at the Washington State Legislature’s official record. That text is the authoritative source for statutory definitions. Legal analysis from Hunton Andrews Kurth’s privacy and cybersecurity practice and KTS Law confirms the law’s existence, signing date, effective date, and the three core requirement categories. For coverage determinations, operators must go to the statutory text itself, legal blog summaries, including this analysis, are not a substitute.
What the Law Covers and Who It Applies To
HB 2225 applies to operators of AI companion chatbots. The law uses that term specifically. Companion chatbot is not the same as AI assistant, AI agent, AI tutor, or AI customer service tool, though some products could potentially qualify depending on how they’re designed and marketed. An AI product that simulates a social relationship, a friendship, a romantic connection, or an ongoing personal bond with a user is the clearest case. Products at the edges need statutory definition review.
Washington residents are the relevant jurisdictional hook. If a companion chatbot is accessible to Washington residents, which, practically, means any product available nationally, the operator is subject to the law’s requirements.
Enforcement runs through the Washington Consumer Protection Act. Violations are treated as unfair or deceptive acts. That classification carries meaningful exposure: it opens the door to private litigation, not just state regulatory action. A user who can demonstrate that an operator failed to comply with HB 2225’s requirements can bring a CPA claim. Class action risk exists for operators with large user bases.
The Three Requirement Categories in Plain Language
1. Mandatory Disclosure: Operators Must Say What the Chatbot Is
The law requires operators to clearly disclose that the chatbot is artificial. This is a baseline identity requirement. The chatbot cannot be presented in a way that would lead a reasonable user to believe they’re interacting with a human.
The compliance question here is design, not just copy. A disclosure buried in terms of service almost certainly doesn’t satisfy “clearly disclose.” An onboarding screen that explicitly establishes the AI nature of the product is the safer approach. The exact placement, wording, and timing of disclosure will require judgment, and almost certainly will be tested in early enforcement actions or litigation that interprets what “clearly” means operationally.
2. Minor Protections: Content and Design Constraints
The minor protections provisions are the law’s most operationally demanding category after mental health protocols. The law prohibits sexually explicit content directed at minors and prohibits manipulative engagement tactics targeting minors. These are not just content filters – they’re design constraints.
Manipulative engagement is broader than explicit content. A companion chatbot designed to maximize session length, deepen emotional dependency, or create social pressure to return could plausibly qualify as manipulative engagement. Dark patterns that exploit adolescent psychology, urgency, fear of missing out, manufactured intimacy, fall into the territory the law appears designed to address.
For EdTech companies and platforms serving K-12 or adolescent users, this provision warrants particular attention. An AI tutoring product that incorporates companionship features, a persistent persona, expressed affection, social dynamics, needs a clear read on whether it qualifies as a companion chatbot and whether its engagement design meets the manipulative engagement standard.
Age verification or age-based gating may become a practical compliance tool for operators who can’t otherwise guarantee that their product’s minor-specific restrictions function correctly. This is resource-intensive. Eight months is workable, but only if the design work starts now.
3. Mental Health Protocols: Detection and Response Requirements
This is the requirement that takes the most time to implement responsibly. The law requires operators to implement protocols for detecting and responding to suicidal ideation expressed by users.
The statutory requirement establishes the obligation but doesn’t prescribe technical implementation. What “detecting” means in practice, keyword detection, sentiment analysis, contextual understanding, a combination, is not specified. What “responding” requires is also open: a crisis resource referral, a conversation redirect, a human escalation path, mandatory session termination? The law creates the floor without specifying the architecture.
That ambiguity is itself a compliance risk. Operators who implement detection and response systems that function poorly, that miss clear expressions of distress, or that respond inappropriately, face both legal exposure and reputational harm that goes well beyond any CPA penalty. The standard here is one where getting it wrong has consequences beyond the courtroom.
Practical guidance is likely to emerge from two sources before January 2027: the Washington Attorney General’s office, which may issue interpretive guidance, and litigation or settlements that establish what the CPA’s unfair practices standard requires in this context. Operators shouldn’t wait for that guidance before building, but should architect their systems to accommodate updated requirements as guidance emerges.
Enforcement Mechanism and Penalty Exposure
The Consumer Protection Act enforcement model is significant. Washington’s CPA allows private plaintiffs to recover actual damages, up to $25,000 in enhanced penalties per violation, and attorney’s fees. For a companion chatbot with a large user base, the per-violation structure creates aggregate exposure that scales with the user population – not a single fine that a well-funded company can absorb.
State regulators can also bring CPA claims. The Washington Attorney General has an active consumer protection practice and has previously pursued technology enforcement actions. An operator who ignores HB 2225 is not facing a theoretical compliance risk. They’re facing a well-funded plaintiff class, capable private plaintiffs’ attorneys, and a state AG with relevant enforcement history.
The Compliance Gap Right Now
Most companion chatbot operators are not ready. That’s not a criticism, the law is new, the effective date is eight months out, and industry guidance doesn’t yet exist. But the gap between current state and January 2027 compliance is larger than many operators realize.
The three requirement categories require different types of work. Disclosure is primarily a design and UX project. Minor protections require content policy work, design audits, and potentially age verification infrastructure. Mental health protocols require technical development, clinical input, and ongoing monitoring capacity. None of these are fast compliance exercises.
A practical timeline works backward from January 1, 2027: legal analysis and applicability determination by May 2026; compliance architecture designed by July 2026; technical implementation complete by October 2026; testing and refinement through December 2026. That schedule has no slack. Operators who haven’t started the legal analysis shouldn’t wait.
What to Watch
New York’s RAISE Act, targeting frontier AI models with the same January 1, 2027 effective date, signals that two major states are setting simultaneous compliance deadlines. If New York’s law covers any companion chatbot functionality, operators may face a dual compliance requirement for the same calendar year. The Wire is tracking the RAISE Act for a future cycle.
The broader pattern: state-level AI consumer protection legislation is accelerating. Washington’s HB 2225 won’t be the last law in this category. The compliance architecture operators build for Washington will likely need to scale to additional state requirements before the end of 2027.
The TJS read: HB 2225 is narrow in scope but demanding in execution. The mental health protocol requirement in particular places this law in a different category from most AI disclosure or data protection regulations, it requires operators to make real-time judgments about user safety. Building that capability responsibly takes longer than eight months if you start today. It’s impossible if you start in October.
Note: This analysis draws on the official Washington State legislative record and legal analysis from Hunton Andrews Kurth and KTS Law. Precise statutory language should be verified against the full text of HB 2225 at the official Washington State Legislature record. This is not legal advice. Given the compliance-action framing of this deep-dive, human legal review is recommended before publication, see production flag below.
[ESCALATION: Human legal review recommended before publication of this deep-dive given the compliance-action framing and specific operational guidance provided.]