Utah's hot technology sector is not the only one driving innovation - the Utah Legislature is too. In the last five years alone, the legislature has passed the Cybersecurity Affirmative Defense Act, the Utah Consumer Privacy Act, and the Decentralized Autonomous Organizations Act, each covering legal obligations relating to cybersecurity, data privacy, and blockchain technology. 

It's not surprising then that Utah is also an early adopter of artificial intelligence (AI) legislation. But it is surprising how the UAIP seeks to simultaneously increase consumer protections and encourage responsible AI innovation by:

• mandating transparency through consumer disclosure requirements;
• clarifying liability for AI business operations, including key terms and legal defenses; and
• enabling innovation through a regulatory sandbox for responsible AI development, regulatory mitigation agreements, and policy- and rule-making by the newly created Office of Artificial Intelligence Policy (OAIP).     

AI transparency and consumer disclosure requirements

The UAIP increases consumer protection by requiring covered businesses to 'clearly and conspicuously' disclose to consumers when they are 'interacting with a generative AI and not a human.' ¹ Under the UAIP, generative AI is 'an artificial system that is trained on data; interacts with a person using text, audio, or visual communication; and generates non-scripted outputs similar to outputs created by a human with limited or no human oversight.'²

The timing of this disclosure differs depending on the context. Regulated services, such as those that require a license or state certificate to operate (e.g., lawyers, doctors), must proactively and prominently disclose such AI usage at the beginning of the consumer interaction³. But all other businesses can opt to do so upon request (i.e., when asked or prompted by the consumer)⁴.

This means that businesses must prepare to clearly and conspicuously disclose their generative AI use proactively, on-demand, or both. Businesses using chatbots, for example, should code and train their chatbots to address this consumer query whenever it is entered in the system. Every business should ensure these AI practices are incorporated in its terms and privacy policies.

Overall, businesses will likely need to employ a multiprong approach, including privacy policy and term updates and point-in-time notices, to fully satisfy this requirement. Companies found in violation could face legal action and fines up to $2,500 per violation, which can become quite hefty if each consumer interaction constitutes a violation.

Clarifying AI liability

A recurring obstacle to AI innovation for businesses are questions around AI liability. The UAIP seeks to address this hurdle and clarify AI business liability by:

• Specifying that businesses cannot blame AI for any statutory offenses. The fact that AI 'made the violative statement, undertook the violative act, or was used in furtherance of the violation' is irrelevant and cannot be used as a legal defense⁵; or

• Refining the definition of 'personal data' so that 'synthetic data' (i.e., data that 'has been generated by computer algorithms or statistical models and does not contain personal data') is recognized as a type of 'deidentified data.'⁶

The above clarifications enable businesses to use AI while also ensuring the businesses are accountable for their practices and results. Classifying AI-generated 'synthetic data' as deidentified data that's outside the protections afforded 'personal data' reduces the regulatory obligations around the data and ensures it can be used more freely, even if it was generated using personal information.

However, the UAIP's assertion that AI cannot be used as a legal defense ensures businesses cannot avoid liability for the results generated, supported, or otherwise enabled by AI. This eliminates the likelihood that regulated industries will ever be replaced or fully conducted with AI. Businesses should instead plan on mitigating and managing their liability by implementing strong AI risk management programs that include safeguards like employee training.

Encouraging AI innovation

While the UAIP establishes clear expectations around AI liability, it also encourages innovation by establishing a Learning Lab through which businesses can partner with the new OAIP to responsibly develop and test AI solutions. Participating businesses benefit from regulatory mitigation agreements that reduce the regulatory risk and liability involved in testing innovative AI solutions.

By offering participants a cure period before reduced civil fines are incurred if the participants abide by mutually agreed-upon project parameters (e.g., safeguard requirements, limits on the number and type of users, testing/audit requirements)⁷, this 'sandbox' allows participants to develop and test AI technology while limiting potential liability that could occur during participation.

The UAIP also authorizes the OAIP to engage with community leaders in the industry, key stakeholders, and academic institutions to research the risks, benefits, impacts, and policy implications that will inform future AI legislation in Utah⁸. This cross-functional, cross-sector collaboration will enable Utah to respond to evolving consumer, business, and governance needs while enabling AI innovation.

Conclusion

By mandating certain consumer disclosures, clarifying business liability, and encouraging AI innovation, the UAIP seeks to balance consumer protection and innovation in AI. It's an incomplete solution that will rely on lessons learned from the Learning Lab and the OAIP to develop additional rules and regulations. The UAIP sets the stage for a new era of AI regulation by being the first state law to embed cross-functional learning opportunities to inform future rules and regulation.

Romaine Marshall Shareholder
[email protected]
Jennifer Bauer Counsel
[email protected]
Polsinelli PC, Salt Lake City

1. See 13-2-12 (3) at: https://le.utah.gov/~2024/bills/static/SB0149.html
2. 13-2-12 (1a).
3. 13-2-12 (1c, 4a, 5).
4. 13-2-12 (3).
5. 13-2-12 (2).
6. 13-2-12 (14b, 24b).
7. 13-70-101 (11-12), 13-70-302.
8. 13-70-201.