As of May 1, Utah has joined the expanding patchwork of states with laws specifically targeting artificial intelligence (AI) systems. The Utah Artificial Intelligence Policy Act (UAIPA), signed into law in March of this year, will, among other things, require certain disclosures regarding the use of generative AI tools.

Broad Definition of Generative Artificial Intelligence

UAIPA defines generative AI as any system that:

1. is trained on data,
2. interacts with a person using text, audio, or visual communication, and
3. generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight.

This is a relatively broad definition, encompassing a wide range of AI-powered tools, including many commonly used chatbots.

Applicability and Disclosure Requirements

UAIPA applies to two groups of entities and imposes distinct disclosure obligations on each. The first are businesses subject to any law or rule enforced by the Utah Department of Commerce, which includes the state’s comprehensive data privacy law – the Utah Consumer Privacy Act. UAIPA requires these businesses to configure any public-facing generative AI to “clearly and conspicuously disclose to [a] person with whom the [AI system] interacts if asked or prompted by the person (emphasis added), that the person is interacting with generative artificial intelligence and not a human.” This is a reactive requirement in that the disclosure must be made only when prompted by a user.

The second group to which UAIPA applies are individuals working in regulated occupations – those for which the Department “requires a person to obtain a license or state certification to practice” – when using a public-facing generative AI tool in connection with licensed services. Regulated occupations include accounting, various medical professions, court reporting, and interior design. Unlike the reactive obligation described above, the use of an AI tool to interact with a person during the provision of services while performing a regulated occupation must be prominently disclosed at the onset of any interaction without the need for prompting by the user.

Enforcement

The Department’s Division of Consumer Protection has sole enforcement authority for UAIPA. The Division may impose an administrative fine of up to $2,500 per violation and may file suit seeking a variety of remedies, including injunctive relief, disgorgement, and declaratory judgments. UAIPA does not create a private right of action.

Additional Provisions of the UAIPA

UAIPA includes several provisions in addition to those implementing the disclosure requirements detailed above, including creating the Utah Office of Artificial Intelligence Policy. The Office of AI is empowered to study AI in order to assist in the development of future regulatory efforts in the state targeted at AI. Additionally, UAIPA directs the Office of AI to implement an AI Learning Laboratory Program. This program is designed to help foster participation from private actors, including businesses, in the efforts undertaken by the Office of AI.

Finally, UAIPA defines synthetic data – “data that has been generated by computer algorithms or statistical models and does not contain personal data” – and explicitly states that synthetic data is included in the definition of deidentified data. While this may seem like a relatively small addition, it may have an outsized importance. More and more AI companies are beginning to run up against limitations with organic data due to its limited quantity and potential legal concerns related to its use.

Disclosures in Political Communications

A separate Utah law, also effective May 1, requires disclosures about AI use in political communications containing AI-generated content. Any audio or visual communication intended to influence voting in an election, paid for by a candidate campaign committee, political action committee, political issues committee, political party, or a person using a contribution, and containing media generated by an AI system must include a conspicuous disclosure.

Takeaways

Businesses subject to any law administered by the Department should act quickly to ensure that any public-facing tool that meets UAIPA’s definition of generative AI provides the necessary disclosures upon being prompted by a user. Additionally, any individual in a regulated occupation using such a tool should ensure that it offers the disclosures required before any interactions with members of the public. Companies located in Utah or who do extensive business in the state may wish to consider working with the Office of AI, including as part of the AI Learning Laboratory Program, to help shape the future of AI regulation in Utah.