Utah Enacts First AI Law: Potential Blueprint for Other States, Significant Impact on Health Care | JD Supra

Last week, Utah Governor Spencer Cox signed into law Utah Senate Bill 149 (SB 149), also known as the Artificial Intelligence Policy Act (the AI ​​Policy Act) . This is the first comprehensive state law on AI in the US, creating a model that other states will likely follow. The new law imposes unique restrictions on “regulated occupations,” especially healthcare.

Key Provisions:

General Application of the Consumer Protection Law

The Utah AI Policy Act is the natural successor to some state chatbot and privacy laws; however, it goes beyond privacy laws that govern automated decision-making directed only at personal information. Utah’s law also extends beyond California and New Jersey’s “chatbot” laws that cover requests to buy goods or services or vote for certain candidates.1 Instead, the Utah AI Policy Act covers any commercial communication that uses “generative” AI more broadly, the law defines generative AI as any “artificial system that: (i) is trained on data; ( ii) interacts with a person through text, audio, or visual communication; and (iii) generates unscripted output similar to human-created output, with limited or no human supervision.” This definition would cover any real-time automated response to user questions or “prompts,” ranging from marketing bots to appointment schedulers and customer service responses.

The Utah AI Policy Act places generative AI under its consumer protection authority, which states that generative AI must comply with basic marketing and advertising regulations, as overseen by the Division of Consumer Protection Utah Department of Commerce Consumer. The law eliminates any defense that “it was the machine, not me,” noting that it is no defense to argue that the generative AI (not the company) made a statement, engaged in an act, or was used to violate a law of consumer protection. or regulation.

What the new Utah law does no Covered are non-generative uses of AI, especially those “behind the scenes” that may determine eligibility for different services or analyze data from third-party sources. More on these issues later.

Different moments of disclosure

The Utah AI Policy Act makes a notable distinction between the timing of disclosures made to consumers, depending on the nature of the business. Across the private sector generally, organizations using generative AI must clearly and conspicuously disclose when a machine and not a human is interacting with a person; however, such disclosures must occur only “if requested or requested by the individual.” Instead, “regulated occupations” must disclose such use of generative AI prior to any oral or written communication with the end user. “Regulated occupations” include all persons or entities that require a “license or certificate” to practice. As in most states, these could range from nurses and social workers to barbers and pest control officers.

Significant impact on healthcare

Healthcare organizations may bear the brunt of this law because “regulated occupations” include a list of more than 30 different healthcare professions in Utah, ranging from physicians, surgeons, dentists, nurses and pharmacists to midwives, dietitians, technicians of radiology, therapists, genetic counselors and health facility managers. Under the AI ​​Policy Act, covered healthcare professionals and organizations must prominently disclose computer-driven responses before they begin using generative AI for any oral or electronic messaging with an end user. This likely means that disclosures about generative AI cannot reside solely in the regulated entity’s terms of use or privacy notice.

Fines and penalties

The Utah law goes into effect quickly, on May 1, 2024, but does not allow for any private right of action. Rather, the state’s Division of Consumer Protection can seek fines of up to $2,500 per violation and ask a court to issue an injunction, award attorney’s and investigative fees, order the deliver or provide other relief. The attorney general’s office can also seek $5,000 in civil penalties for each violation of a prior administrative or court order.

Office of Artificial Intelligence Policy

Like many states, Utah is looking to further study the impact of AI. So, Utah’s new law establishes a statewide Office of Artificial Intelligence Policy (OAIP). OAIP will oversee a “learning lab” and assess risks and best practices related to AI. The office will also have rulemaking authority on AI matters, consult with businesses and stakeholders on proposed regulations, draft rules for participation in the Learning Lab program, and define criteria that organizations must follow when seeking to “mitigate” regulatory requirements or violations.

Utah hopes the OAIP will improve the innovation, adoption and safe use of AI across the state.

Takeaway food:

  • As described above, healthcare and other regulated professions should incorporate disclosures into any workflow that uses generative AI to communicate with public end users.
    • Disclosures must appear before any use of generative AI in oral or electronic communications with end users;
    • Disclosures should be prominent and not buried in terms of use or privacy notices.
  • Even companies with unregulated professionals must prepare disclosures and provide them upon request by end users.
  • Utah’s AI Policy Act will likely serve as a model for other jurisdictions. Search other US states and territories for:
    • Focus on generative AI as an early target of regulation;
    • Apply basic consumer protection laws to AI;
    • Require prompt disclosures when using generative AI;
    • Create more committees to study the effects of AI in both the public and private sectors.
  • Stay tuned for the passage of additional state AI laws with broader scope. We’ve only just begun…

1 Last week, Utah’s governor signed a separate bill regulating the use of AI in political advertising, SB 131.

#Utah #Enacts #Law #Potential #Blueprint #States #Significant #Impact #Health #Care #Supra
Image Source : www.jdsupra.com

Leave a Comment