Utah Enacts AI-Focused Consumer Protection Bill

On March 13, 2024, Utah Governor Spencer Cox signed into law the Utah Artificial Intelligence Policy Act (“UAIPA”), which took effect May 1, 2024. The bill imposes disclosure requirements on entities using generative artificial intelligence (“AI”) tools with their customers, limits an entity’s ability to blame generative AI for statements that violate consumer protection laws, and creates the Office of Artificial Intelligence Policy to administer a state AI program. The UAIPA’s disclosure requirements are not particularly novel, as some existing state chatbot laws require similar disclosures.¹ However, companies should be mindful of Utah’s new requirements as they develop their AI governance programs.

Definition of Generative AI

The UAIPA concerns generative AI, which the act defines as “an artificial system that (a) is trained on data; (b) interacts with a person using text, audio or visual communication; and (c) generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight.” This definition includes the use of AI to generate content, including text or voice chatbot responses.

Who Does the UAIPA Apply To?

In general, the UAIPA applies to any business or individual that uses generative AI to interact with Utah consumers. Specifically, it applies to those in “regulated occupations”—those occupations regulated by the Utah Department of Commerce that require a person to obtain a license or state certification to practice the occupation (e.g., accountants, architects, social workers, doctors and other healthcare professionals)—and to those who engage in any activity regulated by the Utah Division of Consumer Protection, such as consumer sales, telemarketing, charitable solicitations, and numerous other activities involving Utah consumers.

Disclosure Requirements

The UAIPA contains two broad disclosure requirements.

First, those in “regulated occupations” must “prominently” disclose that a consumer is interacting with generative AI in the provision of the regulated services. For audible or oral exchanges, the disclosure must occur verbally at the start of the exchange or conversation. For electronic messaging, the disclosure must be made before a written exchange.

The UAIPA does not define what a “prominent” disclosure means. In the absence of a clear definition, regulated entities or persons in regulated occupations should assume that the mere disclosure of the use of AI in a privacy policy or terms of use may not satisfy the disclosure obligation. Instead, companies should consider providing a standalone disclosure specific to the ways the AI is being used.

The second disclosure requirement applies to those engaged in activities regulated by the Utah Division of Consumer Protection (Utah Code Ann. § 13-2-1). The UAIPA requires that a person who “uses, prompts, or otherwise causes generative [AI] to interact with a person” to “clearly and conspicuously disclose” that the person is interacting with generative AI and not a human “if asked or prompted by the person.” The UAIPA does not specify how a consumer may ask this question or provide how such disclosure should occur. But again, simply directing a consumer to online terms of use that reference generative AI may not satisfy their disclosure obligations. Instead, the AI system will need to be trained to expressly state that it is AI, and not a human, when prompted.

Penalties and Fines for Violating the UAIPA

The Utah Division of Consumer Protection (UDCP) may impose a fine of up to $2,500 per violation of the UAIPA. Each deceptive act or practice by a company or individual constitutes a separate violation, so fines could add up quickly. In addition, courts may—in actions the UDCP brings to impose fines—enjoin any activity that violates the UAIPA, and order disgorgement of any money obtained in violation of the UAIPA. The Utah Attorney General may also seek a fine of $5,000 per violation of any such administrative or court order. The UAIPA does not provide a private right of action.

Use of Generative AI is No Defense to Liability

The UAIPA expressly prohibits attempting to avoid consumer protection liability by blaming generative AI itself as an intervening factor. Thus, the UAIPA says that “[i]t is not a defense” to assert that generative AI “made the violative statement; undertook the violative act; or was used in furtherance of the violation.”

Creation of the Office of Artificial Intelligence Policy

The UAIPA creates the Office of Artificial Intelligence Policy (the “Office”) within the Utah Department of Commerce. The Office will create and administer an artificial intelligence learning lab program (“AI Lab”), which is a regulatory sandbox for AI development in Utah that allows companies to apply for up to two years of “regulatory mitigation” while they develop AI systems. Such regulatory mitigation can include reduced fines for violations and cure periods before fines are imposed. The Office will also consult business and other stakeholders about regulatory proposals; make rules implementing the UAIPA; and report annually on the AI Lab and on recommended legislation from the findings of the AI Lab.

Conclusion

Any company doing business in Utah using generative AI should take a close look at this new law to determine whether it applies to their business. If it does apply, companies will need to ensure that their generative AI tool includes the required disclosures and that the AI tool specifically states that it is AI, and not human, when asked. Even companies that may not be subject to the UAIPA should consider proactively providing similar disclosures when offering generative AI and chatbot services as a best practice.

¹ See, e.g., California’s chatbot law, Cal. Bus. & Prof. Code § 17941, and New Jersey’s chatbot law, N.J. Stat. Ann. § 56:18-2.