Last week, Utah governor Spencer Cox signed into law Utah Senate Bill 149 (SB 149), also known the Artificial Intelligence Policy Act (the AI Policy Act). This is the first comprehensive state law on AI in the U.S., creating a model that other states will likely follow. The new law imposes unique restrictions on “regulated occupations,” especially those in health care.
Key Provisions:
General Application of Consumer Protection Law
The Utah AI Policy Act is the natural successor to some state privacy and chatbot laws; however, it goes further than privacy laws governing automatic decision-making directed at just personal information. The Utah law also extends beyond California and New Jersey “chatbots” laws that cover solicitations to purchase goods or services or vote for particular candidates.1 Instead, the Utah AI Policy Act covers any commercial communications using “generative” AI more broadly, the law defines generative AI as any “artificial system that: (i) is trained on data; (ii) interacts with a person using text, audio, or visual communication; and (iii) generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight.” This definition would cover any real-time automated responses to user questions or “prompts” – ranging from marketing bots to appointment schedulers and customer service responses.
Utah’s AI Policy Act places generative AI squarely under its consumer protection authority, indicating that generative AI must comply with basic marketing and advertising regulations, as overseen by the Division of Consumer Protection of the Utah Department of Commerce. The law removes any defense that “it was the machine, not me,” noting that it is no defense to argue that generative AI (not the company) made a statement, engaged in an act, or was used to violate a consumer protection law or regulation.
What the new Utah law does not cover are non-generative AI uses, especially those “behind the scenes” that may determine eligibility for different services or analyze data from third-party sources. More to come on these issues.
Different Timing of Disclosures
The Utah AI Policy Act makes a notable distinction between the timing of disclosures made to consumers, depending on the nature of one’s business. Across the private sector in general, organizations using generative AI must clearly and conspicuously disclose when a machine and not a human is interacting with a person; however, such disclosures only need to occur “if asked or prompted by the person.” In contrast, “regulated occupations” must disclose such use of generative AI before any oral or written communications with the end user. “Regulated occupations” cover any people or entities that require a “license or certificate” to practice. As in most states, these could range from nurses and social workers to barber shops to pest control agents.
Significant Impact on Health Care
Health care organizations may bear the brunt of this law because “regulated occupations” encompass a laundry list of over 30 different health care professions in Utah, ranging from physicians, surgeons, dentists, nurses, and pharmacists to midwives, dieticians, radiology techs, physical therapists, genetic counselors, and health facility managers. Under the AI Policy Act, covered health care professionals and organizations must prominently disclose computer-driven responses before they begin using generative AI for any oral or electronic messaging with an end user. This likely means disclosures about generative AI cannot reside solely in the regulated entity’s terms of use or privacy notice.
Fines and Penalties
Utah’s law goes into effect quickly, on May 1, 2024, but does not allow for any private right of action. Rather, the state’s Division of Consumer Protection may seek fines up to $2,500 per violation and ask a court to issue an injunction, grant attorney and investigative fees, order disgorgement, or provide other relief. The attorney general’s office also may seek $5,000 in civil penalties for each violation of a prior administrative or court order.
Office of Artificial Intelligence Policy
Like many states, Utah seeks to study the impact of AI further. Therefore, the new Utah law establishes a state Office of Artificial Intelligence Policy (OAIP). The OAIP will oversee a “learning lab” and assess risks and best practices related to AI. The office also will possess rule-making authority over AI issues, consult with businesses and stakeholders about proposed regulations, draft rules for participation in the learning lab program, and define criteria for organizations to follow when seeking “mitigation” of regulatory requirements or violations.
Utah hopes the OAIP will enhance innovation, adoption, and safe use of AI across the state.
Take-Aways:
- As described above, health care and other regulated professions should build disclosures into any workflow that uses generative AI to communicate with public end-users.
- Disclosures must appear prior to any use of generative AI in oral or electronic communications with end users;
- Disclosures should be prominent and not be buried in terms of use or privacy notices.
- Even companies with non-regulated professionals need to prepare disclosures, and provide them upon request by end-users.
- Utah’s AI Policy Act will likely serve as a model for other jurisdictions. Look for other U.S. states and territories to:
- Focus on generative AI as an early target of regulation;
- Apply basic consumer protection laws to AI;
- Require prompt disclosures when generative AI is in use;
- Set up more committees to study the effects of AI across both the government and private sectors.
- Watch for the passage of additional state AI laws with broader reach. We’ve only just begun…
1 Last week, the Utah governor signed a separate bill into law governing the use of AI in political advertising, SB 131.