Introduction
Utah has taken a pioneering step in the regulation of Generative AI (GenAI) with the enactment of S.B. 149, marking a significant milestone in U.S. legislative history.
Effective May 1, 2024, this legislation establishes Utah as the first state to introduce comprehensive laws tailored specifically for GenAI.
The inclusion of statutory damages underscores the seriousness of this initiative by the Utah legislature, indicating potential substantial ramifications for businesses operating within the state.
Key provisions of the law include:
- The extension of consumer protection regulations to encompass GenAI usage
- Mandatory disclosure requirements for private sector entities utilizing GenAI, and
- The establishment of the Office of Artificial Intelligence Policy. This office will oversee various responsibilities, including the administration of an artificial intelligence learning laboratory program, positioning Utah at the forefront of AI governance in the United States.
General Application of Consumer Protection Law
The Utah AI Policy Act builds on previous state privacy and chatbot laws, but extends its reach beyond those governing automatic decision-making based solely on personal information.
Unlike California and New Jersey’s chatbot laws, which focus on solicitations for purchasing goods or services or voting for specific candidates, Utah’s legislation encompasses a broader range of commercial communications utilizing generative AI.
Generative AI, as defined by the Utah AI Policy Act, refers to any artificial system that (i) is trained on data, (ii) interacts with individuals through text, audio, or visual communication, and (iii) produces non-scripted outputs that mimic human-generated responses with little to no human intervention.
This broad definition includes real-time automated responses to user prompts, such as those from marketing bots, appointment schedulers, and customer service systems.
By bringing generative AI under the umbrella of consumer protection, the Utah AI Policy Act mandates that these systems adhere to basic marketing and advertising regulations enforced by the Division of Consumer Protection of the Utah Department of Commerce.
The law explicitly states that companies cannot legally defend themselves by claiming that it was the AI, and not the company, that made a statement or committed an act violating consumer protection laws or regulations.
However, the Act does not address non-generative AI applications, particularly those used “behind the scenes” for tasks such as determining service eligibility or analyzing third-party data.
The Utah AI Policy Act integrates the use of generative artificial intelligence (GenAI) into the state’s existing consumer protection statutes. This integration ensures that entities using GenAI are not exempt from complying with the consumer protection laws enforced by the Utah Division of Consumer Protection under Utah Code § 13-2-1.
The Act explicitly states that it is not a valid defense to claim that GenAI:
- made the violative statement
- undertook the violative act, or
- was used in furtherance of the violation.
In essence, entities are held accountable for the actions of the generative artificial intelligence tools they deploy. The Act also amends the Utah Consumer Protection Act to state that deidentified data includes synthetic data. Synthetic data is defined as “data that has been generated by computer algorithms or statistical models and does not contain personal data.”
Disclousure of Generative Artificial Intelligence
The Utah AI Policy Act establishes specific disclosure obligations regarding the use of generative artificial intelligence (GenAI).
These obligations are divided into two categories:
- Interactions Administered and Enforced by the Utah Division of Consumer Protection: Entities falling into this category must disclose the use of GenAI in a reactive manner. They are required to “clearly and conspicuously disclose to the person with whom the generative artificial intelligence interacts, if asked or prompted by the person, that the person is interacting with generative artificial intelligence and not a human.” The bill does not specify the exact method for this disclosure, allowing flexibility in its implementation.
- Regulated Occupations: This category applies to occupations regulated by the Utah Department of Commerce, which require licensure or state certification. Individuals providing services in regulated occupations must “prominently disclose when a person is interacting with generative artificial intelligence in the provision of regulated services.” This disclosure must be made verbally at the beginning of an oral exchange and through electronic messaging before a written exchange.
These disclosure obligations are enforceable by the Utah Division of Consumer Protection, which has the authority to impose administrative fines of up to $2,500 for each violation. This enforcement mechanism ensures that both reactive and proactive disclosures are adhered to, enhancing transparency in the use of generative AI across various sectors.
Different timing of disclosures
The Utah AI Policy Act distinguishes between the timing of disclosures based on the nature of the business. In the private sector, organizations using generative AI are required to clearly and conspicuously disclose when a machine, rather than a human, is interacting with a person.
However, these disclosures are only necessary “if asked or prompted by the person.”
In contrast, individuals and entities in “regulated occupations” must disclose the use of generative AI proactively, before any oral or written communications with the end user. Regulated occupations include any profession requiring a “license or certificate” to practice, encompassing a wide range of fields such as nursing, social work, barbering, and pest control.
This distinction ensures that while general businesses maintain transparency upon request, regulated professions provide upfront clarity, safeguarding consumer interactions with AI across various licensed services.
Artificial Intelligence Policy Act
The Utah AI Policy Act establishes the Office of Artificial Intelligence Policy, which is tasked with creating and managing an artificial intelligence learning laboratory program.
This program is designed to develop and recommend future regulations for AI technologies.
Among its various activities and responsibilities, the learning laboratory will invite and receive applications from individuals and entities interested in participating. Participants using or planning to use AI technology in Utah can apply for regulatory mitigation through a framework established by the law. This initiative aims to foster innovation while ensuring responsible AI development and usage within the state.
Penalties
The Division of Consumer Protection is responsible for enforcing the Utah AI Policy Act and may impose administrative fines of $2,500 per violation.
These fines can accumulate rapidly if each customer interaction is considered a separate violation. Additionally, the Division has the authority to bring actions in state court to seek injunctions, disgorgement, fines up to $2,500 per violation, or any other relief the court deems appropriate. Violations of court orders related to the Act are subject to further fines and penalties, ensuring stringent enforcement and compliance.
New Office and AI Learning Laboratory Program
The Utah AI Act establishes the Office of Artificial Intelligence Policy (OAIP) within the Utah Department of Commerce, tasked with overseeing the creation and operation of the AI Learning Laboratory Program (Learning Lab).
The OAIP’s responsibilities include developing rules for the Learning Lab, consulting with businesses and stakeholders on upcoming regulations, and reporting Learning Lab outcomes and proposed legislation to the Utah legislature annually.
The OAIP, created under the Artificial Intelligence Policy Act (AIPA), is mandated to:
- Manage the AI Learning Laboratory Program (Learning Lab).
- Consult with Utah businesses and stakeholders regarding regulatory proposals.
- Conduct rulemaking on various aspects, including application procedures, data usage limitations, cybersecurity criteria, and consumer disclosures for Learning Lab participants.
- Annually report to the Business and Labor Interim Committee on the Learning Lab’s agenda, outcomes, findings, and recommended legislation.
The Learning Lab aims to assess AI risks, benefits, impacts, and policy implications to inform Utah’s regulatory framework. It fosters the development of AI technology within the state and evaluates the effectiveness of existing and potential AI legislation.
Participants accepted into the Learning Lab can apply for a “regulatory mitigation agreement,” lasting initially for 12 months and extendable for an additional 12 months under specific circumstances.
Benefits of entering into a regulatory mitigation agreement include:
- Ability to develop and test AI technology with reduced liability risks.
- Potential benefits such as delayed restitution payments, a cure period before penalties is imposed, and reduced civil fines during the participation term.
Overall, the OAIP and the Learning Lab represent Utah’s proactive approach to fostering innovation in AI technology while ensuring responsible development through structured regulatory oversight and mitigation agreements.
Author:
Kosha Doshi, Legal Intern Data Privacy and Digital Law at E.U. Digital Partners
Kosha is a co-author of “Facial Recognition at CrossRoads: Policy Perspectives on Disruption and Innovation” at Closing the Gap 2023 | Emerging and Disruptive Technologies: Regional Perspectives Conference in the Hague, Netherlands.
