Utah’s recent passage of updates to its consumer protection law and the Artificial Intelligence Policy Act (Utah AI Policy Act), which comes into effect on May 1, 2024, could mark an important moment in AI regulation. Notably, the updates to state consumer protection law emphasize holding companies that use generative AI (GenAI)—rather than developers—accountable if they knowingly or intentionally use generative AI in connection with a deceptive act or practice.  In other words, a company may not have a defense that:  “The AI generated the output that was deceptive, so we are not responsible.” For a violation, a court may issue an injunction for violations, order disgorgement of money received in violation of the section, as well as impose a fine of up to $2,500, along with any other relief that the court deems reasonable and necessary.

Laws that hold generative AI users, rather than developers, responsible for the accuracy of AI outputs are sure to increase discussion on AI governance teams about employees’ proper use of generative AI and the ongoing quality of AI outputs to reduce the risk from inaccurate or deceptive outputs. 

There are other noteworthy aspects of the recent updates to Utah law.

• User Notice Requirements Upon Request: The updated consumer protection law requires a company making a GenAI feature available to users to make a clear and conspicuous disclosure to a user upon request that explains the person is interacting with GenAI and not a human.
• Disclosure Requirements for Regulated Occupations: When a company is performing regulated occupations (i.e., those that require a state license or certification), the updated state law requires that the company prominently disclose when the company is using GenAI as part of that service. The disclosure is to be provided “verbally at the start of an oral exchange or conversation; and through electronic messaging before a written exchange.”

• Additional Provisions: The Utah AI Policy Act establishes the Office of Artificial Intelligence Policy to potentially regulate AI and foster responsible AI innovation.  It also creates the Artificial Intelligence Learning Laboratory Program aimed at analyzing AI’s risks and benefits to inform regulatory activity and encourage development of AI technology in Utah. Additionally, the law permits companies to apply for temporary waivers of certain regulatory requirements during AI pilot testing to facilitate innovation while ensuring regulatory oversight.

Utah’s updates to its consumer protection laws highlight some of the issues companies may face as they adopt GenAI. To reduce risk, companies will want to ensure their AI governance program includes ongoing monitoring of employee use of GenAI and the quality of the outputs from GenAI. While it may not be surprising that companies are responsible for how they use GenAI outputs, the constant innovation in AI technology and the difficulty in ensuring GenAI outputs are appropriate will be a compliance challenge.