On March 13, 2024, Utah Governor Spencer Cox signed Utah State S.B. 149, the Synthetic Intelligence Coverage Act (the AI Act) into regulation, which amends the Utah client safety and privateness legal guidelines to require disclosure, in sure circumstances, of synthetic intelligence (AI) use to shoppers, efficient Could 1, 2024. Apparently, the AI Act takes a bifurcated method to the disclosure requirement. The regulation holds companies and people at massive to at least one commonplace, and it holds regulated occupations, together with healthcare professionals, to a different commonplace. The AI Act doesn’t require people’ consent or immediately regulate how generative AI is used as soon as it’s disclosed to sufferers.

KEY TAKEAWAYS

• Whereas Utah’s AI Act requires disclosure of AI use to common shoppers provided that requested, the regulation requires regulated professionals (similar to physicians) to prominently disclose using AI upfront.
• The AI Act’s definition of “generative AI” is vaguely and broadly worded and should embody options past these sometimes thought of generative AI.
• The Workplace of Synthetic Intelligence Coverage’s AI studying laboratory program permits AI builders and deployers to learn from regulatory mitigation, together with waived civil fines, throughout pilot testing.

Alongside nascent efforts on the federal stage to contemplate regulatory approaches to the event and deployment of AI, an rising variety of state regulatory our bodies, together with legislatures {and professional} boards, are getting into the fray. Utah is the newest state to endeavor to craft a regulatory response to AI. Whereas many states have enacted legal guidelines that influence the deployment of AI instruments, together with extra sturdy knowledge privateness necessities, few have particularly addressed the deployment of AI instruments, and none have particularly centered on the deployment of generative AI instruments.

IN DEPTH

BIFURCATED AI USE DISCLOSURE REQUIREMENTS

Business Use of AI Below Utah Regulation

The AI Act requires anybody that deploys generative AI to work together with an individual in a fashion that’s regulated underneath Utah client privateness legal guidelines to reveal using AI clearly and conspicuously, however provided that requested or prompted by the buyer. The AI will have to be skilled to substantiate that it’s AI when requested, and AI deployers will in any other case want to reply to requests for info from shoppers. Moreover, AI deployers seemingly can not place the disclosure in phrases and situations as a result of the regulation requires clear and conspicuous disclosure.

Well being Skilled Use of AI Below Utah Regulation

Conversely, the AI Act requires regulated professionals, similar to physicians, to “prominently” disclose using generative AI upfront of its use. The disclosure needs to be supplied verbally at first of an oral change or dialog and thru digital messaging earlier than a written change.

The AI Act leaves the practitioner to find out what the disclosure ought to embody and the way a lot element to offer. The AI Act can be unclear on how usually disclosure is required (i.e., whether or not disclosure of using generative AI ought to come earlier than every occasion of its use, or solely earlier than the primary occasion by a selected regulated skilled or group with which the skilled is related to respect to a selected affected person or different client). Lastly, whereas the laws is evident that these disclosure obligations apply the place generative AI is used whereas offering the regulated service (e.g., the follow of medication), it’s usually unclear when skilled companies start and finish. For instance, regulated healthcare professionals might wrestle to find out whether or not they’re participating in licensed exercise (e.g., the follow of medication) in various circumstances similar to care coordination, report administration, knowledge evaluation and different broad-based actions which might be more and more widespread in value-based care environments.

Whereas the emphasis on public transparency has advantages, legal guidelines such because the AI Act current a number of challenges to professionals searching for to realize significant transparency. For instance, many sufferers of regulated healthcare professionals won’t perceive how refined AI expertise works. Accordingly, if a affected person has a query in regards to the AI resolution and the skilled doesn’t know the reply, the dynamic relationship between the skilled and affected person may very well be undermined. Additional, healthcare professionals don’t routinely disclose all expertise for use throughout a course of therapy, and the AI Act will seemingly immediate sufferers to ask questions of this expertise specifically. The rationale for treating generative AI expertise in a different way than, for instance, an MRI, isn’t clear.

Which Strategy Applies to You?

Because of the bifurcated method to governing AI disclosure necessities, AI deployers might want to consider which requirement applies to them. Technically, the regulation delineates between (a) “regulated occupations,” which embody healthcare professionals, and (b) all others who “use, immediate, or in any other case trigger generative synthetic intelligence to work together with a [consumer] ….” The definition of “regulated occupations” consists of all occupations regulated and licensed by the Utah Division of Commerce. This definition consists of licensed people like physicians, however it isn’t clear whether or not the disclosure requirement applies to nonlicensed staff or co-workers performing on behalf of the skilled. The second prong of the disclosure portion of the AI Act has broader software, which may end up in seemingly inconsistent functions. For instance, within the value-based care area, firms might use AI to assist information sufferers in making triage selections. Such a use would solely be topic to the broader requirement to reveal using AI if the buyer asks for the disclosure. Nevertheless, when a doctor makes use of AI in an identical method to work together with a affected person and assist the affected person perceive his or her signs to supply diagnostic enter, such use can be topic to the regulated occupation requirement to reveal the AI use on the outset. Whereas these instances are very comparable on their face, the AI Act treats them fairly in a different way.

DEFINITION OF GENERATIVE AI

The AI Act defines “generative AI” as “a synthetic system that: is skilled on knowledge; interacts with an individual utilizing textual content, audio, or visible communication; and generates non-scripted outputs much like outputs created by a human, with restricted or no human oversight.” Whereas the definition consists of some ambiguous phrases, it accommodates the important components of what’s generally understood to be generative AI. Nonetheless, it does contain some complicated and maybe poorly thought of facets.

For instance, the third aspect of the definition vaguely describes a pseudo-objective commonplace across the outputs by reference to outputs created by a human. When contemplating the breadth of the communication methodologies people use, this may seemingly seize each output conceivable, from a easy textual content message to graphs and charts to creative expression. Nevertheless, the opposite components are seemingly in any other case generic sufficient for the definition to seize nearly any machine learning-developed automated system. Thus, whereas the AI Act accurately and implicitly acknowledges that generative AI, versus nongenerative AI, presents extra dangers and extra potential sensitivities for shoppers, the differentiating definition could also be onerous to implement and should inadvertently seize AI instruments that don’t elevate the sorts of issues the AI Act is attempting to deal with.

ENFORCEMENT AND LIABILITY

The AI Act states that when using generative AI isn’t preceded by correct disclosure, the use violates Utah client safety legal guidelines, which may end up in civil penalties of as much as $5,000 per violation in enforcement actions introduced by the Utah Lawyer Basic. In such instances, AI deployers, as relevant, are accountable for the violation and topic to corresponding penalties. The AI Act supplies {that a} occasion violating the disclosure requirement can not keep away from legal responsibility by claiming that the generative AI “made the violative assertion; undertook the violative act; or was utilized in furtherance of the violation.” This provision undermines a generative AI instrument deployer’s potential to defend in opposition to a declare of violation by stating that the developer of the expertise is accountable, and it might additionally work to undermine the argument {that a} generative AI instrument has sufficient impartial company to be acknowledged as an impartial actor. Nevertheless, an AI deployer might search to carry a developer legal responsibility via indemnities or different contractual threat allocation provisions.

RULEMAKING AUTHORITY AND MITIGATION

Whereas different states have created sub-agencies or focus teams to check AI, underneath the AI Act, the Utah Workplace of Synthetic Intelligence Coverage will primarily be a proving floor for efficient AI coverage and applied sciences. The AI Act additionally creates a regulatory company referred to as the Workplace of Synthetic Intelligence Coverage. The Workplace of Synthetic Intelligence Coverage was created to manage the AI studying laboratory program and to have interaction with stakeholders about potential regulatory developments within the discipline. The AI studying laboratory will assess AI applied sciences to tell state regulatory frameworks, encourage AI growth within the state and help within the analysis of proposed regulatory constructions. Considerably, the AI studying laboratory will permit individuals who be a part of the laboratory to check their merchandise.

Members within the AI laboratory program might apply for regulatory mitigation throughout pilot testing, which is able to permit them to check their AI merchandise in the actual world with out compliance issues. This characteristic of the AI laboratory program is especially vital given the fast-changing nature of AI and the uncertainty round every new use case. Additional, the Workplace of Synthetic Intelligence Coverage has rulemaking authority to impose guidelines and necessities for using AI merchandise for AI laboratory program individuals. Via this rulemaking authority, the Workplace will seemingly create a extra tangible definition of regulatory mitigation within the AI context.

[View source.]