Automate Utah AI Policy Act Compliance

The Act establishes legal liability and sets transparency obligations for generative AI deployers operating in Utah. Deployers of generative AI must clarify to end users that they are interacting with generative AI in certain cases. The law also establishes that deployers of generative AI are liable for legal offenses committed by or with the assistance of generative AI.

The Act establishes the Office of Artificial Intelligence Policy. The Office is tasked with consulting with stakeholders about potential regulatory proposals and developing and administering the Artificial Intelligence Learning Laboratory Program.

The purpose of the Learning Laboratory Program is to analyze benefits of risks of AI technologies in the state, encourage the development of AI in Utah, and analyze the effectiveness of and make recommendations on policies and regulations. The Office will establish a learning agenda for the program and accept applications from people or companies who wish to participate in the program.

The requirements of the Act apply to people and companies who use, prompt or otherwise cause a person to interact with generative AI in the state of Utah.

The Act defines “generative artificial intelligence” as an artificial system that is trained on data; interacts with people over text, audio or visual means; and generates outputs similar to outputs created by humans – but with little or no human oversight.

The Act sets transparency requirements that cover “regulated occupations.” A regulated occupation is any occupation regulated by the Utah Department of Commerce that requires a license to operate. As of 2023, this list included jobs such as social workers, psychologists, and mental health counselors.

Those using generative AI in the state of Utah are affected by two things:

Transparency requirements: Any person or company who uses or deploys generative AI to an end user must clarify that the end user is interacting with generative AI in two scenarios: if they are asked by the end user, or the generative AI is used in the provision of regulated services.

Liability established: Any person or company who commits a legal offense using generative AI or deploys generative AI that commits an offense is liable for the offense.

Each violation of the transparency requirements brings an administrative fine of up to $2,500 and the threat of court action to enforce the requirements. Those who use generative AI to commit or aid in legal offenses will be subject to the penalties for that offense.

Utah’s AI Policy Act came into force on May 1st, 2024.

We’re so glad you asked!

There are two major considerations for companies regarding this regulation:

1) Utah’s AI Policy Act (SB 149) is the first of its kind, but it will not be the last. For companies operating across state lines or internationally, this is just the beginning of a long line of regulations to track and comply with.

2) Companies will be held accountable for what their chatbots say. The looming trend shows we are moving toward holding companies accountable for what their chatbots say.

Enterprises can take proactive steps to establish AI risk management frameworks to mitigate both risks.

These frameworks are crucial not just to ensure compliance but also to minimize potential legal, reputational, and financial risks down the road. The rules and principles laid out in the Act, along with related industry standards, are likely to become the norm.

Organizations looking to stay ahead of the curve and gain a competitive edge should keep a close eye on developments related to Utah’s AI Policy Act readiness this year. Participating in voluntary commitment layouts introduced during the Act’s implementation period can also be a smart move.

What does this look like practically? We recommend the following seven steps to ensure compliance.

Seven practical steps for implementation:

1. Inventory Models and Assess Risk: Compile a detailed inventory of all AI technologies in use. Assess the risks associated with each, flag high-risk models, and establish clear accountability for AI operations and outcomes.
2. Invest in AI Governance Tools: Utilize tools that support compliance with the AI Policy Act, helping to manage AI effectively within regulatory requirements. These tools should match your company’s specific risk profile and help monitor AI applications in real-time.
3. Automate Audits and Compliance Checks: Implement automated systems to ensure consistent compliance with the Act. This will help maintain transparency and accountability, reassuring stakeholders of your commitment to responsible AI usage.
4. Consider the Use of Synthetic Data: Leverage synthetic data to fulfill objectives without compromising personal data privacy, aligning with the Act’s guidelines that consider synthetic data as non-personal.
5. Implement Mandatory Disclosures: Modify interfaces where necessary to clearly disclose when consumers are interacting with AI, as required by the Act. This includes training employees on how to communicate about your company’s use of AI.
6. Engage in Continuous Learning and Adaptation: Stay informed about legislative changes and industry standards. Participating in voluntary programs during the implementation period of the Act can offer insights and advantages.
7. Voluntary Commitment to Standards: Actively participate in frameworks and commitment layouts introduced during the Act’s implementation. This not only aids in compliance but also demonstrates leadership in AI governance.

Staying informed and engaged will be key to achieving Utah SB 149 compliance.