The Utah Artificial Intelligence Policy Act (“AIPA”) was signed into law by Governor Spencer Cox. AIPA aims to protect consumers by regulating artificial intelligence (“AI”) through Utah’s existing consumer protection laws. Below are key elements of the law. 

  • Effective Date: May 1, 2024
  • Obligations: The law creates differing obligations for two kinds of entities. Certain licensed professionals, such as mental health providers, must disclose when a person is interacting with AI technology or looking at material created by AI. Such disclosure shall be provided verbally at the start of a conversation and through electronic messaging before a written exchange. Other professions, such as telemarketing, must disclose the use of chatbots only if “asked or prompted to” by the person interacting with the technology. 

AIPA also establishes the Office of AI policy within Utah’s consumer protection division, which is tasked with overseeing the AI Learning Lab Program. The purpose of the AI Learning Lab Program is to: analyze and research the risks, benefits, impacts, and policy implications of AI, encourage the development of artificial intelligence in the state, evaluate the effectiveness and viability of current, potential, or proposed regulation on AI, and produce findings and recommendations for legislation and regulation of AI. The Lab will also act as a safe harbor for developers, allowing a developer to demonstrate they have the financial resources to create an AI product and a red-teaming plan to limit potential risks. The developer would then be given 12 months to test their product and could work with regulators on penalties if it is found to deceive consumers or develops other issues. 

  • Penalties: Violations of the law could result in an administrative fine of up to $2,500 and a civil penalty of up to $5,000. And, a person who uses a generative AI model to commit a crime could be subject to criminal charges. 
  • Takeaways: AIPA joins a list of AI laws in the works including Europe’s AI Act. While relatively smaller in scope than the AI Act, companies should nevertheless conduct internal reviews of their use of AI, including generative AI and confirm notices required under AIPA are in place.