Washington leases will carry flood warnings, and smart locks will need a key alternative.

A Washington landlord’s flood disclosure duty and the state’s smart access rules begin on different dates. Chapter 234, Laws of 2026 took effect June 11, 2026, but its disclosure requirement applies only to leases entered into after December 31, 2026. Chapter 55, Laws of 2026 takes effect January 1, 2027.

The flood disclosure date is later than the act’s effective date

Substitute Senate Bill 6237, Chapter 234, amends RCW 59.18.060, which lists a landlord’s duties during a tenancy. It adds a new subsection requiring three disclosures. The Senate passed it 46 to 3 on February 11, 2026, and the House 65 to 28 on March 3. Governor Bob Ferguson approved it March 27.

The landlord must state that the property may be in a special flood hazard area or an area of potential flooding. The landlord also must state that the landlord’s insurance does not cover the tenant’s personal possessions, and that the tenant should consider renter’s insurance and flood insurance for loss from fire, flood or another risk. The disclosure must identify the county government as a source of information about hazards that may affect the property, including potential flood risk.

The duty applies only to leases entered into after December 31, 2026. A lease signed before that date falls outside the new subsection, even though the act itself took effect months earlier.

We read the enrolled session laws for both chapters in full before publishing, rather than relying only on the bill summaries. The cover page for Chapter 234 lists June 11, 2026, as the effective date. Reading that page alone would obscure the separate December 31, 2026, lease-date limit contained in the text.

The legislation does not create a separate penalty or enforcement provision. It places the disclosure among the landlord duties in RCW 59.18.060. For Washington residential lease forms and landlord-side templates, the trigger is therefore the date the lease is entered into, not the date Chapter 234 became effective.

Smart access systems cover apps, cards and biometrics

Engrossed Substitute Senate Bill 5937, Chapter 55, adds provisions to chapter 59.18 RCW concerning smart access systems. The Senate passed it 49 to 0 on January 28, 2026, and the House 93 to 1 on March 3. Governor Ferguson approved it March 16. The act defines a smart access system as an electronic or computerized system designed to gather information in order to grant entry to a building containing a dwelling unit, its elevators, its common areas or an individual unit.

The definition includes systems using a radio frequency identification card, a mobile phone application, biometric identifier information or other digital technology. A system that relies solely on a keypad or similar device requiring manual entry of a coded sequence is not a smart access system.

Biometric identifier information includes a physiological, biological or behavioral characteristic used to identify a person. The statute lists a retina or iris scan, a fingerprint, a voiceprint, and a scan or record of palm, hand or face geometry.

A smart access building is a building containing a dwelling unit that uses a smart access system. A user is a tenant of that building.

If a tenant requests an alternative key, the landlord must offer one that does not use biometric identifier information or a software application on the tenant’s mobile phone or another similar electronic device. The statute lists a key fob, key card, physical key and keypad-only entry method as examples. It also allows another form of physical access.

The provision is request-based. The text does not require a landlord to offer the alternative key without a tenant’s request.

Privacy policies must describe the system’s data practices

A landlord of a smart access building must make available any written privacy policy issued by the entity that developed the system or the entity that currently operates it.

The landlord, or an agent, also must give tenants a plain-language written policy at the initial lease signing or within five days after the system is installed. At a minimum, the policy must describe the data elements collected, including the extent to which they relate to a tenant’s guests. It must also describe data-protection protocols and safeguards, the retention schedule, and procedures for suspected or actual unauthorized access or disclosure, including notice to users.

The policy must address permanent destruction or anonymization of data, or removal of data from the system. It also must explain the process for temporarily adding a tenant who has given written consent.

The statute provides a safe harbor when the system developer supplies the required information and the landlord does not retain or sell information from the system. In that situation, providing the developer’s privacy policy, or a link to the developer’s website containing it, satisfies the landlord’s obligation.

A landlord that retains or sells system information cannot use that safe harbor. The landlord must provide its own plain-language policy covering the listed subjects.

Archivar, which publishes The Docket, builds a system for law firms that answers every call 24/7 in English and Spanish, runs intake and remembers everything the firm does. Landlord-tenant intake calls often begin with a question about a lease term or building entry, which is why the desk follows changes to duties such as these.

The statute limits the categories of data collected

A landlord or third party may collect only the minimum authentication data and reference data needed to grant access. The system may collect, generate or use only the categories listed in the act.

Those categories are the user’s name; the unit number and other doors or common areas the user may access; the user’s preferred contact method; biometric identifier information if the system uses it; and the identification card number or identifier tied to the entry hardware, such as an RFID card, Bluetooth or a similar protocol.

The list also includes passwords, passcodes, usernames and contact information used to grant entry or access online tools that manage user accounts. Lease information, including move-in and, if available, move-out dates, may be collected. The system also may collect the time and method of access, but only for security and operational purposes.

Data from video, audio or camera systems that monitor entrances but do not grant entry is excluded from the act’s definition of authentication data.

The list supplies a measure for contracts with smart access vendors. Data collection provisions can be compared with the statutory categories, including the limits tied to access, security and operational purposes.

The new sections do not create a separate penalty or enforcement provision. Questions about remedies therefore remain with the rest of the Residential Landlord-Tenant Act rather than being answered by Chapter 55 itself.

Chapter 234 adds three flood disclosures for leases entered into after December 31, 2026. Chapter 55 regulates smart access systems effective January 1, 2027. Neither act states its own separate remedy.

The flood disclosure date is the date the lease is entered into, not June 11, 2026.

A tenant’s request triggers the alternative-key requirement.

Smart access provisions take effect January 1, 2027.