For this blog I want to begin addressing my take on the different AI acts popping up throughout the world. In this blog installment, I begin with one of the three acts that have passed in various U.S. states. Later blogs will address Federal agency acts and opinions, such as those promulgated by the Federal Trade Commission (FTC), as well as acts abroad such as the EU AI Act. At some point, I will begin addressing relevant litigation, but I prefer to start with the governing legislation.
Utah is the first one out of the gate, since its law not only passed in 2024, but it became effective as of May 1 of this year. Note that most existing privacy laws also touch on AI, but Utah’s is the first dedicated act on this issue. The Utah Artificial Intelligence Policy Act (S.B. 149) focuses on AI consumer protection. Here are the key points:
- Disclosure Requirements: Entities using generative AI (GenAI) tools must clearly disclose to consumers when they are interacting with AI rather than a human. This applies especially to regulated professions like healthcare and mental health services. I have seen a similar requirement in the Quebec privacy law, but in Quebec the disclosure specifically applies to employer usage of AI to vet job candidates.
- Liability: The law establishes liability for inadequate or improper disclosure of GenAI use. Businesses cannot avoid consumer protection liability by blaming the AI. The law profession has similar ethical accountability requirements, whereby the lawyer is accountable not only for her own usage of AI, but also that of her associates and support staff. In the law profession, AI tools are treated like support staff. Basically, no one should be able to blame AI for the results it generates.
- Office of Artificial Intelligence Policy: The Act creates this office within the Department of Commerce (DOC) to oversee AI-related activities, including the AI Learning Laboratory Program, which assesses AI risks, benefits, and policy implications. The creation of this Office is indicative of the seriousness ascribed to this Act, especially considering its requisite collaboration with the DOC. The FTC is also very active in creating AI guardrails (which I will discuss in future installments), so it is interesting that this legislation is specifically seeking coordination with at least one other Federal authority. I suspect Utah chose to align with the Department of Commerce, instead of the FTC, in part because Utah has gone out of its way to be as business friendly as possible when enacting privacy and now AI laws. They likely see the DOC as a business ally, as opposed to the FTC which is more of a watchdog.
- Penalties: Violations can result in administrative fines up to $2,500 per violation and civil penalties up to $5,000 per violation. The Division of Consumer Protection can also seek injunctive relief and other remedies. It will be interesting to see how these penalties play out, as they do not appear to create much of a hammer to encourage compliance, like the EU where penalties can be as high as 4% of your global gross revenue under GDPR. That said, the ability to seek injunctive relief could be devastating for a business using AI or offering AI tools, as an injunction is tantamount to a stop work order. I have personally seen successful start-ups come to a screeching halt based on the requirements of the EU AI Act (also to be discussed in later installments).
- Safe Harbor: The law provides a regulatory safe harbor for developers testing AI technologies in Utah, allowing them to mitigate potential liabilities during the testing phase. This provision illustrates the point I made under Section 3, which is how Utah is trying to be as business friendly as possible. It will be interesting to see how these Safe Harbor provisions play out, including what specific parameters the regulatory authorities will draw to fall under these protections.
On the whole, Utah’s law aims to ensure transparency and accountability in the usage of AI technologies, thereby making Utah a leader in AI consumer protection. Of all the AI laws that have passed and will soon pass, I suspect Utah will continue to be one of the most business-friendly states in this space. The cynic in me is not encouraged by this, because most of my clients do business in all states, if not the world, so one business friendly state does not create a compliance high water mark, as would a state with stricter requirements. For this reason, my next installment will discuss California’s law.
In the interim, as always, please free to contact me if you have further questions, thoughts, or comments. The more you interact with me, the better I will be able to address real world concerns. If you prefer, you can click this link to book a meeting with me if you have any pressing issues you need to get off your chest. Click: https://isazalaw.com/booking