Keypoint: While not as far-reaching as bills under consideration in other states, the Utah bill creates some obligations for private sector companies deploying generative artificial intelligence, including disclosing its use.

In early March, the Utah legislature unanimously passed SB 149. The bill is now with Utah Governor Spencer Cox for signature. In general, the bill: (1) specifies that Utah’s consumer protection laws apply equally to an entity’s use of generative artificial intelligence as they do to the entity’s other activities, (2) requires private sector entities to take steps to disclose and/or respond to inquiries about their use of generative artificial intelligence, and (3) creates the Office of Artificial Intelligence Policy which is charged with, among other things, administering an artificial intelligence learning laboratory program. Once signed by the Governor, the law will go into effect on May 1, 2024.

In the below article, we provide a brief analysis of the bill’s provisions.

Generative AI and Utah’s Consumer Protection Law

As a starting point, the bill grafts an entity’s use of generative artificial intelligence onto Utah’s existing consumer protection statutes, making it clear that an entity’s use of generative artificial intelligence does not absolve it from complying with the consumer protection laws enforced by the Utah Division of Consumer Protection under Utah Code § 13-2-1. Specifically, the bill provides that it is “not a defense to the violation of any statute administered and enforced by the [Utah Division of Consumer Protection], as described in Section 13-2-1, that generative artificial intelligence: (a) made the violative statement; (b) undertook the violative act; or (c) was used in furtherance of the violation.” Stated differently, an entity is bound by the actions of the generative artificial intelligence tool it chooses to deploy.

The bill defines “generative artificial intelligence” as “an artificial system that: (i) is trained on data; (ii) interacts with a person using text, audio, or visual communication; and (iii) generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight.”

Disclosure of Generative Artificial Intelligence

The bill next creates disclosure obligations around the use of generative artificial intelligence, dividing those obligations into two categories: (1) a “person who uses, prompts, or otherwise causes generative artificial intelligence to interact with a person in connection with any act administered and enforced by the” Utah Division of Consumer Protection; and (2) a person who provides services of a “regulated occupation.”

Entities that fall into the first category are placed into a reactive stance and must “clearly and conspicuously disclose to the person with whom the generative artificial intelligence interacts, if asked or prompted by the person, that the person is interacting with generative artificial intelligence and not a human.” The bill does not otherwise state how the disclosure should take place.

The second category applies to “regulated occupations,” which are occupations regulated by the Utah Department of Commerce that require a person to obtain a license or state certification to practice the occupation. The Utah Department of Commerce provides a list of licenses on its website.

Under this category, persons who provide services of a “regulated occupation” have an affirmative obligation to “prominently disclose when a person is interacting with a [sic] generative artificial intelligence in the provision of regulated services.” The bill requires the disclosure to be made verbally at the start of an oral exchange or conversation and through electronic messaging before a written exchange.

The above disclosure obligations are enforceable through the Utah Division of Consumer Protection’s enforcement powers. Among other measures of relief, the Division may impose an administrative fine for up to $2,500 for each violation.

Artificial Intelligence Policy Act

The bill also creates the Office of Artificial Intelligence Policy, which is charged with creating and administering an artificial intelligence learning laboratory program, through which future regulation of artificial intelligence technologies will be developed and recommended. Among other activities and responsibilities, the artificial intelligence learning laboratory will invite and receive applications from persons to participate in the learning laboratory.A participant who uses or wants to utilize artificial intelligence technology in Utah can apply for regulatory mitigation with the office through a structure created by the law.

Utah Consumer Protection Act Amendment

The bill also amends the Utah Consumer Protection Act to state that deidentified data includes synthetic data. Synthetic data is defined as “data that has been generated by computer algorithms or statistical models and does not contain personal data.”