Utah Artificial Intelligence Policy Act
The Utah AI Policy Act (UAIP) took effect May 1, 2024, and is incorporated into the state’s consumer protection statutes. It establishes liability for AI use that violates consumer rights and creates the Office of AI Policy which administers the AI Learning Laboratory Program.
What you need to know about the UAIP:
The UAIP applies to businesses and natural persons that do business in Utah, with increased obligations for “Regulated Occupations.”
A Regulated Occupation is an occupation that either requires a person to obtain a license to practice the occupation or provides for state certification or state registration (think, accountant, doctor, nurse, etc.).
Generative AI systems that interact with individuals.
The UAIP is limited to generative AI. Generative AI means an artificial system that:
- Is trained on data;
- Interacts with a person using text, audio, or visual communication; and
- Generates non-scripted outputs similar to outputs created by a human, with
- Limited or no human oversight.
While the UAIP does not include any entity- or data-level exemptions, it does include an opportunity for “regulatory mitigation” for organizations that join in the AI Learning Laboratory Program. A participating organization can apply for a 12-month regulatory mitigation for development and testing of an AI technology. If granted, the Office of AI Policy and other relevant agencies would enter into a regulatory mitigation agreement with the organization, during which they would have some benefits related to potential liability derived from the technology, like a cure period before enforcement, reduced civil fines, and delayed restitution payments.
A regulatory mitigation agreement must include:
- Limitations on scope of the use of the participant’s artificial intelligence technology, including:
-
- The number and types of users;
- Geographic limitations; and
- Other limitations to implementation;
- Safeguards to be implemented; and
- Any regulatory mitigation granted to the applicant.
Qualifications for obtaining regulatory mitigation include:
- Technical expertise and capability to responsibly develop and test the proposed AI technology;
- Sufficient financial resources to meet obligations during testing;
- The AI technology provides potential substantial consumer benefits that may outweigh identified risks from mitigated enforcement of regulations;
- An effective plan to monitor and minimize identified risks from testing; and
- The scale, scope, and duration of proposed testing is appropriately limited based on risk assessments.
Key Components of Utah’s AI Policy Act
The Utah AI Policy Act prohibits covered entities from attempting to avoid consumer protection/fraud liability by blaming generative AI as an intervening factor.
Regulated Occupations: Regulated Occupations must provide notice to Utah consumers any time they cause Generative AI to interact with the individual. The notice must be provided either verbally at the start of a conversation or via electronic message prior to a written exchange.
Others: Non-regulated occupations must accurately identify whether Utah consumers are interacting with Generative AI upon request.
Importantly, organizations cannot avoid violations when AI fails to accurately notify the consumer as required.
N/A
N/A
N/A
The Utah Division of Consumer Protection may administer fines of up to $2,500 per violation or bring a court action in which the court may issue an injunction, disgorgement of funds received due to the violation, order payment to harmed individuals, impose a fine up to $2,500, or any other reasonable and necessary action.
The Attorney General may also impose civil penalties of up to $5,000 per violation on entities that violate an administrative or court order for an UAIP violation.
Data Privacy is Just Good Business
Managing privacy compliance with all these new state privacy laws popping up in the U.S., might seem like a daunting task. But just because the task appears daunting doesn’t mean that it’s impossible to handle.
You don’t have to go at it alone! With the right support, you can make data privacy measures a sustainable part of your daily operations. That’s where Red Clover Advisors comes in – to deliver practical, actionable, business-friendly privacy strategies to help you achieve data privacy compliance and establish yourself as a consumer-friendly privacy champion that customers will appreciate.
