With the passage of S.B. 149 (AI Law), Utah became the first U.S. state to pass legislation specific to Generative AI (GenAI). The statutory damages attached to the law suggest that this is no mere gesture on the part of the Utah legislature; noncompliance could significantly impact an array of businesses with Utah touchpoints. The law came into effect on May 1, 2024.
The applicability of the AI Law will be a key issue for businesses utilizing GenAI in Utah or targeting Utah residents. Any entity subject to other Utah laws enforced by the Division of Consumer Protection in the Department of Commerce is subject to the AI Law in the context of those covered activities. The list of laws in scope includes the Utah Consumer Privacy Act and the Utah Social Media Regulation Act.
The key to compliance with the AI Law will be notice, and the law sets out different notice requirements in different contexts. For instance:
- If a covered entity provides services of “regulated occupations,” such as healthcare, where the business must obtain a license or state certification to provide its services, the use of GenAI must be proactively notified prior to interactions with a clear and conspicuous disclosure that the individual is interacting with GenAI and not a human. The disclosure must be verbal at the start of a verbal exchange and electronic before a written exchange.
- If a covered entity is not engaged in a regulated occupation, notice must still be provided, but only upon request by impacted individuals, and the method of delivery (verbal vs. electronic) is not expressly stated in the statute.
The Division of Consumer Protection is tasked with enforcement and may impose administrative fines of $2,500 per violation, which could stack up quickly if each customer interaction is viewed as a violation. The Division may also bring an action in state court to seek injunctions, disgorgement, fines up to $2,500 per violation, or any other relief the court deems appropriate. Violations of court orders are subject to additional fines and penalties.
The AI Act also establishes a new Office of Artificial Intelligence Policy (OAIP) within the Utah Department of Commerce to oversee the establishment, operation, and rulemaking associated with a new AI Learning Laboratory Program (Learning Lab). The OAIP will consult with businesses and stakeholders regarding forthcoming regulations and handle reporting to the Utah legislature regarding Learning Lab outcomes, findings, and proposed legislation. Businesses granted entry to the Learning Lab may apply for a 12–24-month regulatory mitigation agreement, which would allow businesses to develop and test AI with reduced liability risk, such as delayed restitution payments, a cure period before penalties are assessed, and reduced fines.
If you have questions about the AI Act’s potential impact on your business or would like to discuss compliance strategies, please contact a member of the MMM AI team.
