Creating content with AI is easy. Proving where that content came from gets harder once it moves across models, applications, editing tools, platforms, and distribution channels.
Was an image generated by AI or simply resized? Did a generative AI system materially alter a video? Which provider produced the content? Did its provenance data survive editing, conversion, or downstream distribution?
Washington’s new AI content transparency requirements put those questions into law.
Governor Bob Ferguson signed House Bill 1170 on March 24, 2026. The law takes effect February 1, 2027 and creates new provenance requirements for qualifying providers of generative AI systems that create or materially alter image, video, and audio content.
The law does not regulate every business that uses AI.
Its private-sector requirements focus on covered providers whose generative AI systems exceed a defined user threshold and remain publicly accessible to Washington consumers for personal use.
But the broader governance issue reaches further.
AI transparency requires more than a label. Organizations need to know which AI systems exist, who owns them, what data supports them, which models and versions teams use, and which controls apply as AI moves through enterprise workflows.
This guide explains Washington’s AI content transparency law, who must comply, what provenance data must accomplish, which activities fall outside the law, and how organizations can strengthen the governance behind AI transparency.
The Executive Snapshot
Washington AI Content Transparency Law: What Matters
- The law takes effect February 1, 2027. Washington enacted HB 1170 in March 2026 as Chapter 167 of the 2026 session laws.
- The private-sector rule targets large consumer-facing generative AI providers. A covered provider creates, codes, or otherwise produces a qualifying generative AI system with more than 1 million monthly users that is publicly accessible in Washington to consumers for personal use.
- The law focuses on image, video, and audio. Covered providers must include provenance data in qualifying content created or materially altered by their systems when commercially and technically reasonable.
- Provenance must help users assess content origin. Providers must use commercially and technically reasonable methods to make that provenance data difficult to remove or tamper with.
- The operational gap is AI context. Provenance technology can identify content origin, but governance teams still need visibility into AI systems, ownership, models, data, policies, and risk across the environment.
What Is the Washington AI Content Transparency Law?
Washington’s AI content transparency law comes from HB 1170, legislation addressing content developed or modified by artificial intelligence.
The private-sector provisions now appear in Chapter 19.435 RCW, titled Artificial Intelligence: Disclosures.
The law establishes provenance requirements for certain consumer-facing generative AI providers.
Under the statute, provenance data means information embedded in digital content or included in its metadata for the purpose of verifying the content’s authenticity, origin, or history of modification.
For covered providers, that means qualifying AI-generated or materially altered image, video, and audio content must carry data that helps a user assess whether the provider’s generative AI system created or materially changed it.
The law also directs covered providers to use commercially and technically reasonable methods to make that provenance data difficult to remove or tamper with.
Washington specifically identifies commonly supported watermarking or metadata standards, including the Coalition for Content Provenance and Authenticity, or C2PA, specification, as one way to satisfy the anti-tampering requirement.
The law does not turn every AI disclosure practice into a Washington requirement.
Its final language is narrower than several earlier versions of HB 1170, which makes the enacted RCW the right source for 2027 compliance planning.
When Does Washington’s AI Content Transparency Law Take Effect?
Washington’s AI content transparency requirements take effect February 1, 2027.
Legislative Timeline
From AI Transparency Proposal to 2027 Requirements
Three milestones define the version organizations should use for compliance planning.
January 6, 2025
HB 1170 Prefiled
Washington lawmakers begin work on legislation addressing content created or modified with artificial intelligence.
March 24, 2026
Governor Signs HB 1170
Governor Bob Ferguson signs the final measure as Chapter 167 of the 2026 Laws of Washington.
February 1, 2027
Requirements Take Effect
Covered providers must meet the law’s applicable provenance requirements for qualifying generative AI content.
Regulatory takeaway: Use Chapter 19.435 RCW and the final enacted HB 1170 language for compliance planning. Earlier versions contained requirements that Washington removed before final passage.
Who Must Comply With Washington’s AI Content Transparency Law?
The law does not apply to every AI developer, enterprise AI user, or company offering software in Washington.
It creates a specific definition of a covered provider.
Regulatory Scope
Three Elements Define a Covered Provider
The provider, system scale, and consumer availability all matter.
Element 01
Produces the GenAI System
The person or entity creates, codes, or otherwise produces the generative AI system.
Element 02
More Than 1M Monthly Users
The generative AI system has more than 1,000,000 monthly users.
Element 03
Consumer Access in Washington
The system is publicly accessible within Washington to consumers for personal use.
Important distinction: Washington excludes state, local, and tribal governments from the covered-provider definition. The same legislation creates a separate AI disclosure rule for government agencies.
This scope matters for enterprises that use third-party generative AI.
A company using a commercial image generator internally does not automatically become the covered provider merely because employees use that system.
The law also states that Chapter 19.435 does not apply to business-to-business uses, sales, licensing, or distribution of generative AI systems.
That distinction prevents teams from treating Washington’s content provenance law as a universal enterprise AI mandate.
However, organizations still need enough AI governance visibility to determine which AI systems they build, provide, license, deploy, and use.
Scope analysis becomes much harder when teams cannot identify the AI systems operating across the environment or distinguish internally built AI from third-party services.
What Types of AI Content Does the Washington Law Cover?
Washington’s definition of generative artificial intelligence focuses on technology that generates:
- Images
- Audio
- Video
- Combinations of those media types
The provenance requirement applies when a covered provider’s generative AI system creates or materially alters qualifying content.
The law defines a material alteration as a significant change that substantially changes the data in the content.
It also identifies several modifications that do not count as material alterations when they do not significantly change the perceived content or meaning.
Content Scope
Material AI Changes vs. Minor Editing
Potentially Covered
Creation or Material Alteration
A significant AI-driven change that substantially alters the content data can trigger the provenance requirement when the other statutory conditions apply.
Generally Minor
Technical or Cosmetic Changes
Examples include brightness, contrast, color, sharpening, saturation, filters, resizing, scaling, cropping, format conversion, resampling, denoising, and removal of background audio noise when those changes do not significantly alter perceived content or meaning.
Key distinction: The final Washington law does not create a general provenance requirement for AI-generated text under Chapter 19.435.
What Provenance Data Does Washington Require?
A covered provider must include provenance data in qualifying image, video, and audio content to the extent commercially and technically reasonable.
The provenance data must allow a user to assess whether the provider’s generative AI system created or materially altered the content.
Covered providers must also use commercially and technically reasonable methods to make provenance data difficult to remove or tamper with.
Washington specifically recognizes the use of a commonly supported technical standard for watermarking or metadata, such as the C2PA specification, as compliant with this anti-tampering requirement.
The law does not require providers to place information about an identified or reasonably identifiable individual in the provenance data.
That creates two distinct governance layers:
- Content provenance: Technical information that helps establish AI origin or modification history.
- Enterprise AI governance: Organizational context about the AI system, model, owner, purpose, connected data, risk, and controls.
The first supports content authenticity.
The second helps the organization understand the system behind the content.
Organizations need both types of context when they want AI transparency that extends beyond a single file.
What Does Washington’s AI Content Law Exclude?
Understanding what the law excludes matters as much as understanding what it covers.
Scope Boundaries
Four Limits Organizations Should Know
01
B2B uses. Chapter 19.435 does not apply to business-to-business uses, sales, licensing, or distribution of generative AI systems.
02
Minor technical processing. Systems used solely for upscaling, noise reduction, or compression fall outside the chapter.
03
Certain interactive experiences. The statute excludes products, services, websites, or applications that provide exclusively video game or interactive experiences within the law’s defined scope.
04
Trade secrets. The chapter does not require disclosure of trade secrets or confidential or proprietary information about AI system design or use.
Operational takeaway: AI inventory and business context matter because the same technology may sit inside or outside direct Washington requirements depending on the provider, audience, use case, and system characteristics.
Why Provenance Technology Alone Is Not Enough
A provider can implement provenance metadata and still struggle with AI governance.
Consider an organization with multiple generative AI products.
One model produces images. Another creates audio. Product teams deploy different model versions across consumer and enterprise offerings. Some applications use first-party models, while others call third-party APIs.
The organization may implement provenance technology correctly at the content layer.
But governance teams still need to answer:
- Which generative AI systems are publicly available to consumers?
- Which systems exceed the statutory user threshold?
- Who owns each system?
- Which model and version powers each application?
- Which data sources support those models and workflows?
- Which systems serve consumer use cases versus B2B use cases?
- Which teams own provenance implementation and testing?
- How does the organization document changes over time?
Provenance can tell users something about the content. AI governance tells the organization something about the system that produced it.
The AI Transparency Gap
Five Gaps Between Content Provenance and AI Governance
These are operational governance gaps, not automatic findings of Washington law noncompliance.
Gap 01 / Discovery
Known AI Products vs. Actual AI Estate
What teams track: Approved generative AI products and major platforms.
What they may miss: Shadow AI, embedded models, development environments, third-party AI, and unregistered applications.
Close the gap: Discover AI systems across cloud, SaaS, code, development, and enterprise environments.
Gap 02 / Ownership
Model Inventory vs. Accountability
What teams track: Model names and applications.
What they may miss: Owners, business purpose, approval status, model versions, and responsible teams.
Close the gap: Connect every AI asset with ownership, purpose, model, policy, and business context.
Gap 03 / Data
Content Origin vs. Data Origin
What provenance shows: Whether qualifying content came from or changed through an AI system.
What governance may still need: The datasets, repositories, pipelines, and sensitive information connected to the AI system itself.
Close the gap: Connect AI inventory with data discovery, classification, and lineage context.
Gap 04 / Change
Initial Review vs. Model Evolution
What teams approve: A particular model, version, workflow, or product configuration.
What can change: Models, connected data, integrations, ownership, user populations, and deployment context.
Close the gap: Monitor AI inventory, risk, and governance context as systems change.
Gap 05 / Evidence
Transparency Policy vs. Governance Evidence
What teams publish: AI policies, disclosures, and transparency commitments.
What they may struggle to prove: Which systems the policy covers, who owns them, which controls apply, and whether teams addressed identified risks.
Close the gap: Connect policies, AI assets, assessments, ownership, and remediation evidence.
The Bigger Picture
Transparency Requires Context
Content provenance helps explain the media. AI governance helps explain the system, data, ownership, and risk behind it.
Next step: Connect AI transparency controls with enterprise AI and data intelligence.
How a Model Update Can Expose the Transparency Gap
Imagine a company operates a popular consumer-facing generative AI image service.
The provider adds provenance metadata to generated images and uses a supported technical standard to help protect that information from tampering.
The product team then deploys a new model version.
At the same time, another team changes an image-processing pipeline and adds a third-party component before users download finished content.
The organization now needs to answer several questions:
- Which model version generated the image?
- Did the downstream processing preserve the provenance data?
- Which team owns the new processing component?
- Does the new workflow still fall within the approved architecture?
- Which data sources and services support the updated model?
- Did the change alter the organization’s risk assessment?
- Can governance teams identify every consumer-facing system affected by the update?
The provenance standard addresses an important technical layer.
It does not create the enterprise AI inventory, ownership model, data context, risk assessment, or governance evidence needed to answer the rest.
This is where AI transparency becomes an AI governance problem.
AI Transparency Starts With AI Visibility
Do You Know Which AI Systems Sit Behind Your Content?
BigID helps organizations discover AI systems, connect models with owners and data, identify shadow AI, assess risk, and maintain governance evidence across enterprise environments.
Does Washington Require AI Watermarks?
Washington does not require one specific watermarking technology.
Instead, the law requires covered providers to include qualifying provenance data and use commercially and technically reasonable methods to make it difficult to remove or tamper with.
The statute states that using a commonly supported technical standard for watermarking or metadata, such as C2PA, satisfies that anti-tampering requirement.
That gives covered providers technical flexibility while establishing an outcome:
Users should have a practical way to assess whether qualifying image, video, or audio content came from or underwent material alteration through the provider’s generative AI system.
Organizations should distinguish this statutory content-provenance requirement from broader enterprise AI governance controls.
BigID does not replace media watermarking, content credentials, or provenance standards.
BigID addresses the surrounding governance layer by helping organizations discover and inventory AI systems, connect AI to enterprise data, establish ownership and business context, assess risk, and maintain evidence about governance activity.
Does the Washington AI Law Apply to Government Agencies?
HB 1170 also created a separate requirement for Washington government agencies.
Beginning February 1, 2027, a government agency that makes an AI system available to interact with consumers must tell the consumer that they are interacting with an AI system.
The agency must provide the disclosure before or at the time of interaction.
The disclosure must:
- Appear clearly and conspicuously.
- Use plain language.
- Avoid dark patterns.
The law allows an agency to use a hyperlink to direct a consumer to a separate disclosure page.
This government-agency provision appears separately in Chapter 42.64 RCW.
It differs from the private covered-provider provenance requirement under Chapter 19.435.
How Does Washington Enforce the AI Content Transparency Law?
Washington gives the state Attorney General authority to enforce Chapter 19.435.
For Attorney General enforcement actions, the statute treats conduct that violates the chapter as an unfair or deceptive act or practice and an unfair method of competition under Washington’s Consumer Protection Act.
Only the Attorney General can bring a Consumer Protection Act action under this specific enforcement provision.
Enforcement
Washington Connects AI Provenance to Consumer Protection
Attorney General
State Enforcement
The Washington Attorney General may bring an action to enforce the chapter.
Consumer Protection Act
Enforcement Framework
The law connects covered violations with Washington’s Consumer Protection Act for Attorney General enforcement.
Important: The enacted Chapter 19.435 does not contain the standalone $100,000 penalty language that appeared in some earlier legislative drafts. Organizations should use the final statute when describing enforcement.
How Should Organizations Prepare for Washington’s AI Content Transparency Law?
Organizations should begin with a legal scope determination, then connect that analysis to the AI systems and technical controls involved.
Operational Readiness
Seven Actions to Strengthen AI Transparency Readiness
01
Confirm regulatory scope. Determine which generative AI systems the organization creates or produces, their user populations, consumer availability in Washington, and applicable exclusions.
02
Discover AI systems. Identify models, applications, agents, APIs, development environments, embedded AI, and shadow AI across the enterprise.
03
Establish ownership. Connect AI systems with owners, business purpose, consumer or enterprise use, model versions, approvals, and responsible teams.
04
Implement provenance controls. Evaluate watermarking, metadata, C2PA, or other appropriate provenance technologies for qualifying content.
05
Test downstream workflows. Determine whether editing, conversion, processing, and distribution preserve required provenance data.
06
Connect AI with data context. Understand which datasets, repositories, pipelines, and sensitive information support AI systems.
07
Maintain governance evidence. Document AI inventory, ownership, risk assessments, applicable policies, technical controls, system changes, and remediation activity.
Key takeaway: This readiness framework combines statutory and operational considerations. Washington does not prescribe these seven steps as a mandatory compliance sequence.
How BigID Supports AI Transparency and Governance Readiness
Washington’s law establishes a technical provenance requirement for qualifying content.
BigID addresses a different but closely related layer: understanding and governing the AI systems, data, identities, ownership, and risk surrounding those content-generation workflows.
BigID’s AI Governance capabilities help organizations build a current inventory of AI systems and connect that inventory to the data and business context governance teams need.
- AI asset discovery: Discover models, agents, copilots, applications, AI libraries, vendor tools, and shadow AI across cloud, SaaS, code, development, and enterprise environments.
- AI inventory and ownership: Catalog AI systems with owners, purpose, datasets, controls, approvals, policies, assessments, and incidents.
- AI and data context: Connect AI models and applications with the enterprise data they train on, retrieve, or otherwise use.
- Data discovery and classification: Identify sensitive, regulated, confidential, and business-critical information associated with AI environments.
- AI risk assessments: Evaluate AI-related risks using system, data, policy, ownership, and business context.
- AI access governance: Understand how AI systems, applications, APIs, service accounts, and machine identities can reach sensitive enterprise data.
- Governance evidence: Maintain AI inventory, assessments, ownership, policy, risk, and remediation context for oversight and reporting.
BigID does not replace C2PA, digital watermarking, content credentials, media provenance metadata, or other technologies that implement Washington’s content-level provenance requirement.
BigID helps organizations govern the AI systems and data behind those transparency controls, so teams know which systems require attention, who owns them, what data they use, and how governance changes as AI environments evolve.
Why Washington’s AI Content Law Matters Beyond Covered Providers
Most enterprises will not meet Washington’s definition of a covered provider.
Many do not create consumer-facing generative AI systems with more than 1 million monthly users.
But the law reflects a broader change in AI governance.
Regulators increasingly expect organizations to distinguish AI-generated activity from human activity, document AI systems, establish accountability, and provide meaningful transparency about how AI enters products and services.
Content provenance addresses one part of that challenge.
Enterprise AI governance addresses the rest.
Organizations adopting AI at scale need to know:
- Which AI systems operate across the business?
- Which teams own them?
- Which models and versions do they use?
- What data supports them?
- What sensitive information can they access?
- Which laws and policies apply?
- Which risks require action?
- What evidence demonstrates governance?
As AI laws continue to diverge by jurisdiction and use case, a shared AI and data intelligence foundation gives organizations a more scalable way to answer those questions.
Explore BigID’s Global AI Regulation Tracker to compare AI laws, effective dates, requirements, and governance considerations across U.S. states and international jurisdictions.
Washington AI Content Transparency Law: Frequently Asked Questions
What is Washington’s AI Content Transparency Law?
Washington’s AI content transparency requirements come from HB 1170, enacted as Chapter 167 of the 2026 Laws of Washington. Chapter 19.435 RCW requires qualifying covered providers to include provenance data in certain image, video, and audio content created or materially altered by their generative AI systems.
When does Washington’s AI content transparency law take effect?
The law takes effect February 1, 2027.
Who qualifies as a covered provider?
A covered provider is a person or entity that creates, codes, or otherwise produces a generative AI system with more than 1,000,000 monthly users that is publicly accessible within Washington to consumers for personal use. State, local, and tribal governments do not fall within this definition.
Does Washington’s AI content law apply to text?
Chapter 19.435 defines generative artificial intelligence for this law in terms of technology that generates images, audio, or video. The private-sector provenance requirement does not establish a general requirement for AI-generated text.
What is provenance data?
The law defines provenance data as data embedded into digital content or included in its metadata for the purpose of verifying the content’s authenticity, origin, or history of modification.
Does Washington require AI watermarks?
Washington does not mandate one specific watermarking technology. Covered providers must use commercially and technically reasonable methods to make required provenance data difficult to remove or tamper with. The law states that a commonly supported watermarking or metadata standard, such as C2PA, satisfies that requirement.
What counts as materially altered AI content?
A material alteration is a significant change that substantially alters the data in content. The statute excludes several minor modifications when they do not significantly change perceived content or meaning, including resizing, cropping, format conversions, brightness changes, denoising, and similar processing.
Does the Washington law apply to B2B generative AI?
Chapter 19.435 states that it does not apply to business-to-business uses, sales, licensing, or distribution of generative AI systems.
Who enforces Washington’s AI content transparency law?
The Washington Attorney General may enforce Chapter 19.435. The statute connects violations with Washington’s Consumer Protection Act for Attorney General enforcement.
Does the law require a provenance detection tool or optional visible disclosure?
The final enacted Chapter 19.435 does not contain the broader detection-tool and manifest-disclosure requirements that appeared in some earlier versions of HB 1170. Organizations should use the final RCW when planning for 2027 requirements.
How can BigID help with Washington AI transparency readiness?
BigID helps organizations discover and inventory AI systems, connect AI with ownership and data context, identify sensitive data exposure, conduct risk assessments, govern AI access, and maintain governance evidence. BigID complements but does not replace the content provenance technologies needed to implement Washington’s media-level requirements.
AI Governance
Know the AI Behind the Content.
Govern the Data Behind the AI.
Discover AI systems, connect models with enterprise data and ownership, assess risk, govern access, and maintain the evidence behind responsible AI.
Sources and Further Reading
- Washington State Legislature: Chapter 19.435 RCW, Artificial Intelligence: Disclosures
- Washington State Legislature: RCW 19.435.020, Provenance Data Requirement
- Washington State Legislature: HB 1170 Bill History
- Washington State Legislature: Chapter 42.64 RCW, Government AI Disclosure
- BigID AI Governance
- BigID AI Access Governance
- BigID Global AI Regulation Tracker
This article provides general educational information and does not constitute legal advice. Organizations should consult qualified counsel regarding the applicability of Washington law, covered-provider definitions, technical provenance requirements, exclusions, and implementation obligations.
Author
