Utah is poised to enforce the Utah Artificial Intelligence Policy Act (“UAIP;” S.B. 0149) a first-of-kind legislation that is going into effect on May 1, 2024. Starting next week, this act will introduce stringent requirements for the use of generative AI in business operations, emphasizing transparency and accountability in customer interactions. With these regulations, Utah is the first state to establish a legal framework for the evolving use of artificial intelligence.
Scope and Definition
The UAIP specifically addresses generative AI systems—those that learn from data and interact through text, audio, or visuals to produce responses with minimal human oversight. This distinction clarifies that non-generative AI applications, such as those used for algorithm-based product recommendations, are not subject to these new rules.
Disclosure Requirements
For entities that are “regulated occupations” which require one to “obtain a license or state certification to practice,” the law mandates clear disclosures at the start of any generative AI interaction or materials created by generative AI. This disclosure must be made verbally for oral communications or written during electronic messaging. This ensures that all communications with AI are transparent from the outset.
Businesses that are not “regulated occupations” are still under the purview of Utah’s consumer protection laws. The difference is non-regulated occupations must provide “clear and conspicuous” disclosures when “asked or prompted by a person” if they are interacting with a generative AI “and not a human.” While the law does not specify how a consumer could pose such a question, nor what constitutes a “clear and conspicuous” disclosure, business should assume this requirement is designed to prevent the burying of such information in densely written areas of a website like a companies’ privacy policy.
Liability and Enforcement
The new regulations establish clear accountability for users of generative AI, detailing their responsibilities. Furthermore, while the UAIP does not provide a private right of action, the bill does state the Utah Division of Consumer Protection (UDCP) has the authority to levy administrative fines up to $2,500 for each infraction. Additionally, in legal actions initiated by the UDCP, courts have the power to impose these fines, halt illegal activities, and order the return of any funds received through violations of the UAIP. Moreover, the Utah Attorney General can pursue penalties of $5,000 per violation against anyone who breaches an existing administrative or judicial order.
Incentives for Compliance and Innovation
Besides ensuring compliance, the UAIP encourages innovation by establishing an Office of Artificial Intelligence Policy and introducing an AI Learning Laboratory Program. This program is meant to promote state participation with companies developing or deploying generative AI systems. Companies that are accepted into the program company the potential to enter into a regulatory mitigation agreement with the state that could lessen the regulatory burden relating to the company’s development and testing of AI in the state for a period of 12 months – with a potential “discretionary” 12-month extension. The mitigation can also include reduced fines for violations and cure periods before fines are assessed.
Next Steps for Businesses
Organizations affected by the UAIP should be implementing practices compliant with the new requirements. Such practices should include the integration of explicit disclosures in AI communications and training for employees on how to handle AI-related consumer inquiries.
The enforcement of this law requires business to also take the following proactive steps:
- Synthetic Data Usage: Businesses should evaluate how using synthetic data can achieve objectives without infringing on U.S. privacy laws.
- AI Inventory: Companies should document their AI technologies, detailing each tool’s purpose, whether it is generative, consumer-facing, and if human oversight is involved.
- Disclosure Implementation: Adjustments may be needed in consumer interfaces to clearly indicate when generative AI is in use or when election-related content is AI-generated.
- Regulatory Monitoring: Continued vigilance is recommended as further ongoing legislative interest in this area is not only ongoing, but bills regarding generative AI have been proposed – e.g., Rep. Adam Schiff’s “Generative AI Copyright Disclosure Bill.”
Takeaways
Utah’s AI legislation is a pioneering effort in the regulatory treatment of artificial intelligence, setting a precedent that may influence the broader governance of AI technology in the United States. As these new regulations take effect, they represent a significant shift towards greater accountability and transparency in the use of AI technologies in commercial settings.
The enactment of the UAIP may inspire other states to consider enacting similar legislation, potentially creating a varied regulatory landscape—like what we are currently experiencing with regard to data privacy. Ultimately, comprehensive federal legislation should be enacted to align regulation. Until then, businesses will need to adapt to a potential changing environment, which may lead to increased operational costs and the necessity for comprehensive compliance strategies.
****
For assistance in understanding the immediate impact of UAIP, please contact John Rondini, co-chair of Brook Kushman’s Cybersecurity and Data Privacy Group, at 248.226.2913 or at jrondini@brookskushman.com.
