Utah Adopts New AI Disclosure Law that Goes Into Effect on May 1, 2024

On March 13, 2024, the Utah governor signed the Artificial Intelligence Policy Act (the Utah AI Act) into law. This new law—which will directly regulate the private sector’s use of generative AI by imposing disclosure requirements on certain activities and entities—goes into effect on May 1, 2024, less than two months after it became law. With this development, Utah puts itself at the forefront of state legislative efforts to regulate AI, even as the federal government moves forward on AI and the European Union has passed its own landmark AI Act. 

Given the short compliance runway, organizations that are subject to the Utah AI Act’s requirements need to quickly understand and implement the new required disclosures. A high-level overview of the Utah AI Act’s key provisions is provided below along with next steps for businesses subject to its requirements.

Scope

The Utah AI Act focuses its disclosure requirements on the use of “generative artificial intelligence,” defined as an artificial system that (i) is trained on data; (ii) interacts with a person using text, audio, or visual communication; and (iii) generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight.[1]

As for the organizations it covers, the Utah AI Act applies to activities or entities that are already governed either by (i) Utah’s Consumer Protection Division under a wide range of existing consumer protection laws—including activity governed under Utah’s existing Consumer Privacy Act and existing Social Media Regulation Act, or (ii) Utah’s Department of Commerce with respect to services that “require[] a person to obtain a license or state certification to practice [an] occupation,” including but not limited to healthcare workers and accountants.

Generative AI Disclosure Requirements

The Utah AI Act’s disclosure requirements will move AI disclosure to the forefront of consumers’ interactions with companies using generative AI. The Utah AI Act establishes two different disclosure requirements, with two different standards and two different thresholds. Which one may apply will depend on what type of activity or entity is at issue:

• First, for entities or activities governed by one of the covered consumer protection laws, a clear and conspicuous disclosure is required if the entity “uses, prompts, or otherwise causes generative artificial intelligence to interact with a person” and the person “ask[s] or otherwise prompt[s]” the generative AI to tell them if they are interacting with generative AI and not a human.
• Second, where generative artificial intelligence is used to provide “the services of a regulated occupation,” those regulated occupations must “prominently disclose when a person is interacting with a generative artificial intelligence in the provision of regulated services.” If the interaction is verbal, the disclosure must be made at the start of the oral exchange or conversation; for electronic messages, the disclosure must be made at the beginning of the chat before any other written exchanges can be made.

Enforcement of Violations

The new law gives enforcement authority to the Utah Division of Consumer Protection. In addition to their existing enforcement authorities, the law specifies that the Division also has the authority to impose an administrative fine of up to $2,500 for each violation of the disclosure requirements or to bring an action in court to enforce a provision of the AI Act with a variety of remedies, including:

• Issuing an injunction for the violation;
• Ordering a disgorgement of any money received as a result of the violation;
• Ordering payment of disgorged money to users injured by the violation;
• Imposing a fine of up to $2,500 for each violation; or
• Awarding any other relief that the court deems reasonable and necessary, to include awarding the state reasonable attorneys fees, court costs, and investigative fees.

The new law also explains that “A person who violates an administrative or court order issued for a violation of his chapter is subject to a civil penalty of no more than $5,000 for each violation.”

Given the “per violation” structure of both administrative and court enforcement, violations could have a significant financial impact on companies. 

Updates to the Criminal Code

Additionally, the Utah AI Act amends the state’s criminal code by introducing new culpability standards. In addition to the general requirements of criminal conduct and responsibility prescribed under 76-2-101, the bill establishes new Section 76-2-107, which provides that an actor may be found guilty of an offense if:

• The actor commits the offense with the aid of a generative AI; or
• The actor intentionally prompts or otherwise causes a generative AI to commit the offense.

In practice, this section will preclude bad actors from attempting to shift blame to generative AI, and actors utilizing generative AI will be held responsible for the technology’s actions. These standards largely resemble the culpability standards defined under 76-2-106 for another emerging technology – unmanned aircraft systems.

Office of Artificial Intelligence Policy

In addition to the disclosure and liability provisions above, the Utah AI Act creates the Office of Artificial Intelligence Policy, to be situated within the Department of Commerce. The Office will have the following responsibilities:

• Administer the AI Learning Laboratory Program (discussed below);
• Consult with stakeholders about potential regulatory proposals pertaining to AI;
• Report annually to the Business and Labor Interim Committee regarding the AI Learning Laboratory Program’s agenda and outcomes; and
• Establish rules and procedures for the AI Learning Laboratory Program.

Artificial Intelligence Learning Laboratory Program

The AI Act also creates the AI Learning Laboratory Program, which will be administered by the Office of Artificial Intelligence Policy. The Program’s purpose is to:

• Research the risks, benefits, and impacts of AI technologies to further inform the state’s regulatory framework;
• Encourage the development of AI technologies within the state;
• Evaluate the effectiveness of current and potential regulation on AI technologies; and
• Make findings and recommendations for AI regulations.

Companies can apply with their AI product to participate in the program and, in some cases, can sign a "Regulatory Mitigation Agreement” to provide limited relief from certain state regulatory requirements during its participation in the program.  In this respect, depending on how it is implemented, the program may function somewhat like a “regulatory sandbox” program that allows for companies to deploy and test innovative technologies under certain defined conditions.

Takeaways for Companies

The Utah AI Act introduces several new AI-related provisions into Utah’s state code, and the generative AI disclosure requirements are most immediately impactful for U.S. businesses operating in Utah that provide generative AI content. Before the law goes into effect in less than a month, companies should take steps to ensure that any public-facing generative AI systems subject to one of the covered Utah consumer protection laws are programmed to respond affirmatively if asked about whether it is an AI system. Additionally, companies that provide professional services that require Utah licenses or certifications need to ensure all generative AI interactions with consumers are prominently disclosed, consistent with the new law. 

***

Wiley’s Artificial Intelligence practice counsel clients on AI compliance, risk management, and regulatory and policy approaches, and we engage with key government stakeholders in this quickly moving area. Please reach out to a member of our team with any questions.

[1] The Utah AI Act defines “artificial intelligence,” simply, as “a machine-based system that makes predictions, recommendations, or decisions influencing real or virtual environments.” It further defines “generative artificial intelligence” to include any “artificial system that: (i) is trained on data; (ii) interacts with consumers using text, audio, or visual communication; and (iii) generates non-scripted outputs for those interactions similar to outputs created by humans, with limited or no human oversight.”