[co-author: Kathryn Smith*]

The Utah legislature has been busy, with another law effective May 1. This one is “privacy adjacent” but worth keeping in mind. The law, the Artificial Intelligence Policy Act, was signed into law in March. Among other things, it will require companies to respond “clearly and conspicuously” to an individual who asks if they are interacting with artificial intelligence and the communications are made in connection with laws regulated by the Utah department of commerce. (This includes the Utah Privacy Act, the state’s sales practices law, its telephone solicitation laws, and many others.)

Artificial intelligence is defined in the law as an artificial system that is trained on data, that interacts with someone through text, audio or visual means, and creates output that is “similar” to a human, without human oversight. The law’s disclosure requirement is a reactive one. The disclosure needs to happen only if “asked or prompted” by the individual.

There is one caveat to this reactive provision. Businesses who are in “regulated” occupations must make a prominent disclosure that they are using AI in the provision of those services. Regulated occupations include any licensed by the Utah Division of Professional Licensing. This includes many health care professions, as well as court reporting, athletic trainers, plumbers, electricians, and more.

The reactive nature of the law is unlike a California “chatbot” law. That law prohibits misleading people into thinking they are “interacting online” with a human if in fact they are interacting with an “artificial identity.” The law provides an affirmative defense to have a clear and conspicuous disclosure that the tool is a bot. A bot is defined as an online account where actions are not those of a person (so encompassing more than generative AI, but also automated replies). In other words, the law requires disclosing the nature of the “artificial identity” prior to someone interacting with it. It is narrower than the Utah law, however, as it relates only to when someone is interacting with the bot to “incentivize” a sale (or to get someone to vote).

*Kathryn Smith is a fellow in the firm’s Chicago office.

Putting It Into Practice: Companies who may be subject to this law (apart from any who provide services in “regulated occupations”) may want to test any GenAI tools they are using to interface with the public. How do those tools respond if someone asks “are you AI,” “is this a bot,” “are you human” and the like? For those who are in regulated occupations, remember that the disclosure obligations are affirmative to the extent that the law applies.