Utah Enacts Consumer Disclosure Requirements for Businesses Using Bots and Generative AI

On March 13, 2024, Utah enacted the Artificial Intelligence Policy Act ("AIPA"), which creates two types of disclosure requirements for a business or person that "uses, prompts, or otherwise causes" generative AI applications to "interact" with customers. Utah joins California in enacting disclosure requirements for generative AI, although California's "bot disclosure" law has more limited application. Because Utah's new law will go into effect May 1, 2024, businesses that use GAI applications, such as bots, to interact with consumers should quickly assess their ability to comply with the new law. Utah's Division of Consumer Protection may impose administrative fines of up to $2,500 per violation, and the Utah Attorney General may bring an action for declaratory and injunctive relief and seek disgorgement of any money received in violation of the AIPA.

The AIPA defines generative artificial intelligence ("GAI") very broadly to mean any "artificial system" that is (a) trained on data, (b) interacts with a person using text, audio, or visual communication, and (c) generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight. Utah's Senate Business & Labor Committee issued collateral materials which noted that under the AIPA, "certain AI tools (chatbots, voice, text messages) must disclose that they are non-human if asked directly by a consumer." Thus, the intent is to ensure disclosures are made directly to consumers by those entities deploying AI-enabled applications, such as bots and automated messages. Non-generative AI applications, such as those used for algorithmic recommendations, would be outside the GAI definition and not subject to the AIPA.

The AIPA creates two types of notice and disclosure obligations for consumer interactions with GAI. First, a "Requested Disclosure," which applies broadly to certain entities deploying GAI and which must be provided in response to a consumer's request; and second, a "Proactive Disclosure," which must be provided by entities that deploy GAI in specifically defined regulated industries in Utah, such as accounting and healthcare professions.

Requested Disclosure Requirement

The Requested Disclosure requires a business that "uses, prompts, or otherwise causes generative artificial intelligence to interact with a person" to disclose that the interaction is taking place with a GAI when:

1. The person interacting with the GAI asks or prompts the GAI to disclose its nature; and
2. The GAI is interacting with a person in connection with any act administered and enforced by Division of Consumer Protection within the Utah Department of Commerce, which are enumerated in Utah Code Sec. 13-2-1.

The Division of Consumer Protection is responsible for enforcing laws that have very broad applicability, including, among other things, the Utah Consumer Sales Practices Act, which governs consumer sales, and the Utah Consumer Privacy Act, which governs the collection and use of personal information. Businesses that operate in Utah and use GAI in a commercial context to interact with consumers, i.e., to offer consumers goods or services, are likely to be subject to the Requested Disclosure requirement.

Proactive Disclosure Requirement

The Proactive Disclosure requirement is triggered if the business deploying the GAI is engaged in a "regulated occupation," i.e., those requiring a license from the Utah Department of Commerce. These occupations include accounting, engineering, and numerous healthcare professions (such as genetic counseling, nursing, pharmacy, etc.). A full list of occupations requiring a license from the Utah Department of Commerce can be found here. If a regulated business uses GAI "in the provision of regulated services," then it must proactively disclose when a person is interacting with GAI. For oral exchanges, the disclosure must be made verbally at the start of the exchange and must be made through electronic message prior to a written exchange.

Using GAI Is No Defense

The AIPA establishes that if a business or person makes a statement or takes an action that violates one of the acts administered by the Division of Consumer Protection through a GAI application, it is not a defense that the statement or act was undertaken by such GAI application. In addition, the AIPA also makes it clear that a business or person may be found guilty of an offense (including criminal offenses) under Utah law if the actor uses, or "intentionally prompts or otherwise causes," GAI to commit the offense.

AI Learning Laboratory

The AIPA also creates an Office of Artificial Intelligence that will establish an AI Learning Laboratory that will:

• analyze and research the risks, benefits, impacts, and policy implications of artificial intelligence technologies;
• encourage development of artificial intelligence technologies in Utah;
• evaluate current and proposed regulation on artificial intelligence technologies; and
• produce findings and recommendations for legislation and regulation of artificial intelligence.

Takeaways

The AIPA is part of a growing effort by state legislatures to consider guardrails around the use and deployment of AI applications. Connecticut and Colorado have recently introduced bills that would create a comprehensive regulatory framework for the development and deployment of AI and many states are considering bills that would regulate the outputs of generative AI. DWT's AI team is closely monitoring these regulatory developments and regularly advises clients on how these new rules may impact their operations.