Rep. Norm Thurston — Voting Record

Bill

Number

S.B. 149 (2024GS)

Sponsor

Sen. Cullimore, K. A.

Final action

Governor Signed 3/13/2024

Outcome

Became law — signed by Gov. Spencer J. Cox

Summary

What it does

• This bill:
• defines terms;
• establishes liability for use of artificial intelligence (AI) that violates consumer protection laws if not properly disclosed;
• creates the Office of Artificial Intelligence Policy (office) and a regulatory AI analysis program;
• enables temporary mitigation of regulatory impacts during AI pilot testing;
• establishes the Artificial Intelligence Learning Laboratory Program to assess technologies, risks, and policy;
• requires disclosure when an individual interacts with AI in a regulated occupation; and
• grants the office rulemaking authority over AI programs and regulatory exemptions.

Every vote on this bill

Bill text

This document includes Senate Committee Amendments incorporated into the bill on Thu, Feb 8, 2024 at 11:21 AM by lpoole.
ARTIFICIAL INTELLIGENCE AMENDMENTS
GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Kirk A. Cullimore
House Sponsor: 
 Jefferson Moss
LONG TITLE
General Description:
This bill creates the Artificial Intelligence Policy Act.
Highlighted Provisions:
This bill:
▸ defines terms;
▸ establishes liability for use of artificial intelligence (AI) that violates consumer
protection laws if not properly disclosed;
▸ creates the Office of Artificial Intelligence Policy (office) and a regulatory AI
analysis program;
▸ enables temporary mitigation of regulatory impacts during AI pilot testing;
▸ establishes the Artificial Intelligence Learning Laboratory Program to assess
technologies, risks, and policy;
▸ requires disclosure when an individual interacts with AI in a regulated occupation;
and
▸ grants the office rulemaking authority over AI programs and regulatory exemptions.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
AMENDS:
13-11-4
, as last amended by Laws of Utah 2021, Chapters 138, 154
13-61-101
, as last amended by Laws of Utah 2023, Chapter 327
63I-2-213
, as last amended by Laws of Utah 2023, Chapter 33
ENACTS:
13-2-12
, Utah Code Annotated 1953
13-70-101
, Utah Code Annotated 1953
13-70-201
, Utah Code Annotated 1953
13-70-301
, Utah Code Annotated 1953
13-70-302
, Utah Code Annotated 1953
13-70-303
, Utah Code Annotated 1953
13-70-304
, Utah Code Annotated 1953
13-70-305
, Utah Code Annotated 1953
76-2-107
, Utah Code Annotated 1953
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 
13-2-12
 is enacted to read:
 13-2-12.
Generative artificial intelligence -- Impact on liability for violation of
consumer protection law.
(1) As used in this section:
(a) "Generative artificial intelligence" means an artificial system that:
(i) is trained on data;
(ii) interacts with a person using text, audio, or visual communication; and
(iii) generates non-scripted outputs similar to outputs created by a human, with limited
or no human oversight.
(b) "License" means a state-granted authorization for a person to engage in a specified
occupation:
(i) based on the person meeting personal qualifications established under state law; and
(ii) where state law requires the authorization before the person may lawfully engage in
the occupation for compensation.
(c) "Regulated occupation" means an occupation regulated by the Department of
Commerce that requires a person to obtain a license or state certification to practice the
occupation.
(d) "State certification" means a state-granted authorization given to a person to use the
term "state certified" as part of a designated title related to engaging in a specified occupation:
(i) based on the person meeting personal qualifications established under state law; and
(ii) where state law prohibits a noncertified person from using the term "state certified"
as part of a designated title but does not otherwise prohibit a noncertified person from engaging
in the occupation for compensation.
(2) It is not a defense to the violation of any statute administered and enforced by the
division, as described in Section 
13-2-1
, that generative artificial intelligence:
(a) made the violative statement;
(b) undertook the violative act; or
(c) was used in furtherance of the violation.
(3) A person who uses, prompts, or otherwise causes generative artificial intelligence
to interact with a person in connection with any act administered and enforced by the division,
as described in Section 
13-2-1
, shall clearly and conspicuously disclose to the person with
whom the generative artificial intelligence interacts, if asked or prompted by the person, that
the person is interacting with generative artificial intelligence and not a human.
(4) (a) A person who provides the services of a regulated occupation shall prominently
disclose when a person is interacting with a generative artificial intelligence in the provision of
regulated services.
(b) Nothing in this section permits a person to provide the services of a regulated
occupation through generative artificial intelligence without meeting the requirements of the
regulated occupation.
(5) A disclosure described Subsection (4)(a) shall be provided:
(a) verbally at the start of an oral exchange or conversation; and
(b) through electronic messaging before a written exchange.
(6) The division shall administer and enforce the provisions of this section in
accordance with Chapter 2, Division of Consumer Protection.
(7) In addition to the division's enforcement powers described by Chapter 2, Division
of Consumer Protection:
(a) the division director may impose an administrative fine for up to $2,500 for each
violation of this section; and
(b) the division may bring an action in court to enforce a provision of this section.
(8) In a court action by the division to enforce a provision of this section, the court
may:
(a) declare that an act or practice violates a provision of this section;
(b) issue an injunction for a violation of this section;
(c) order disgorgement of any money received in violation of this section;
(d) order payment of disgorged money to a person injured by a violation of this section;
(e) impose a fine of up to $2,500 for each violation of this section; or
(f) award any other relief that the court deems reasonable and necessary.
(9) If a court of competent jurisdiction grants judgment or injunctive relief to the
division, the court shall award the division:
(a) reasonable attorney fees;
(b) court costs; and
(c) investigative fees.
(10) (a) A person who violates an administrative or court order issued for a violation of
this chapter is subject to a civil penalty of no more than $5,000 for each violation.
(b) A civil penalty authorized under this section may be imposed in any civil action
brought by the attorney general on behalf of the division.
Section 2. Section 
13-11-4
 is amended to read:
13-11-4.
Deceptive act or practice by supplier.
(1) A deceptive act or practice by a supplier in connection with a consumer transaction
violates this chapter whether it occurs before, during, or after the transaction.
(2) Without limiting the scope of Subsection (1), a supplier commits a deceptive act or
practice if the supplier knowingly or intentionally:
(a) indicates that the subject of a consumer transaction has sponsorship, approval,
performance characteristics, accessories, uses, or benefits, if it has not;
(b) indicates that the subject of a consumer transaction is of a particular standard,
quality, grade, style, or model, if it is not;
(c) indicates that the subject of a consumer transaction is new, or unused, if it is not, or
has been used to an extent that is materially different from the fact;
(d) indicates that the subject of a consumer transaction is available to the consumer for
a reason that does not exist, including any of the following reasons falsely used in an
advertisement:
(i) "going out of business";
(ii) "bankruptcy sale";
(iii) "lost our lease";
(iv) "building coming down";
(v) "forced out of business";
(vi) "final days";
(vii) "liquidation sale";
(viii) "fire sale";
(ix) "quitting business"; or
(x) an expression similar to any of the expressions in Subsections (2)(d)(i) through
(ix);
(e) indicates that the subject of a consumer transaction has been supplied in accordance
with a previous representation, if it has not;
(f) indicates that the subject of a consumer transaction will be supplied in greater
quantity than the supplier intends;
(g) indicates that replacement or repair is needed, if it is not;
(h) indicates that a specific price advantage exists, if it does not;
(i) indicates that the supplier has a sponsorship, approval, 
license, certification,
 or
affiliation the supplier does not have;
(j) (i) indicates that a consumer transaction involves or does not involve a warranty, a
disclaimer of warranties, particular warranty terms, or other rights, remedies, or obligations, if
the representation is false; or
(ii) fails to honor a warranty or a particular warranty term;
(k) indicates that the consumer will receive a rebate, discount, or other benefit as an
inducement for entering into a consumer transaction in return for giving the supplier the names
of prospective consumers or otherwise helping the supplier to enter into other consumer
transactions, if receipt of the benefit is contingent on an event occurring after the consumer
enters into the transaction;
(l) after receipt of payment for goods or services, fails to ship the goods or furnish the
services within the time advertised or otherwise represented or, if no specific time is advertised
or represented, fails to ship the goods or furnish the services within 30 days, unless within the
applicable time period the supplier provides the buyer with the option to:
(i) cancel the sales agreement and receive a refund of all previous payments to the
supplier if the refund is mailed or delivered to the buyer within 10 business days after the day
on which the seller receives written notification from the buyer of the buyer's intent to cancel
the sales agreement and receive the refund; or
(ii) extend the shipping date to a specific date proposed by the supplier;
(m) except as provided in Subsection (3)(b), fails to furnish a notice meeting the
requirements of Subsection (3)(a) of the purchaser's right to cancel a direct solicitation sale
within three business days of the time of purchase if:
(i) the sale is made other than at the supplier's established place of business pursuant to
the supplier's personal contact, whether through mail, electronic mail, facsimile transmission,
telephone, or any other form of direct solicitation; and
(ii) the sale price exceeds $25;
(n) promotes, offers, or grants participation in a pyramid scheme as defined under Title
76, Chapter 6a, Pyramid Scheme Act;
(o) represents that the funds or property conveyed in response to a charitable
solicitation will be donated or used for a particular purpose or will be donated to or used by a
particular organization, if the representation is false;
(p) if a consumer indicates the consumer's intention of making a claim for a motor
vehicle repair against the consumer's motor vehicle insurance policy:
(i) commences the repair without first giving the consumer oral and written notice of:
(A) the total estimated cost of the repair; and
(B) the total dollar amount the consumer is responsible to pay for the repair, which
dollar amount may not exceed the applicable deductible or other copay arrangement in the
consumer's insurance policy; or
(ii) requests or collects from a consumer an amount that exceeds the dollar amount a
consumer was initially told the consumer was responsible to pay as an insurance deductible or
other copay arrangement for a motor vehicle repair under Subsection (2)(p)(i), even if that
amount is less than the full amount the motor vehicle insurance policy requires the insured to
pay as a deductible or other copay arrangement, unless:
(A) the consumer's insurance company denies that coverage exists for the repair, in
which case, the full amount of the repair may be charged and collected from the consumer; or
(B) the consumer misstates, before the repair is commenced, the amount of money the
insurance policy requires the consumer to pay as a deductible or other copay arrangement, in
which case, the supplier may charge and collect from the consumer an amount that does not
exceed the amount the insurance policy requires the consumer to pay as a deductible or other
copay arrangement;
(q) includes in any contract, receipt, or other written documentation of a consumer
transaction, or any addendum to any contract, receipt, or other written documentation of a
consumer transaction, any confession of judgment or any waiver of any of the rights to which a
consumer is entitled under this chapter;
(r) charges a consumer for a consumer transaction or a portion of a consumer
transaction that has not previously been agreed to by the consumer;
(s) solicits or enters into a consumer transaction with a person who lacks the mental
ability to comprehend the nature and consequences of:
(i) the consumer transaction; or
(ii) the person's ability to benefit from the consumer transaction;
(t) solicits for the sale of a product or service by providing a consumer with an
unsolicited check or negotiable instrument the presentment or negotiation of which obligates
the consumer to purchase a product or service, unless the supplier is:
(i) a depository institution under Section 
7-1-103
;
(ii) an affiliate of a depository institution; or
(iii) an entity regulated under Title 7, Financial Institutions Act;
(u) sends an unsolicited mailing to a person that appears to be a billing, statement, or
request for payment for a product or service the person has not ordered or used, or that implies
that the mailing requests payment for an ongoing product or service the person has not received
or requested;
(v) issues a gift certificate, instrument, or other record in exchange for payment to
provide the bearer, upon presentation, goods or services in a specified amount without printing
in a readable manner on the gift certificate, instrument, packaging, or record any expiration
date or information concerning a fee to be charged and deducted from the balance of the gift
certificate, instrument, or other record;
(w) misrepresents the geographical origin or location of the supplier's business;
(x) fails to comply with the restrictions of Section 
15-10-201
 on automatic renewal
provisions;
(y) violates Section 
13-59-201
; or
(z) fails to comply with the restrictions of Subsection 
13-54-202
(2).
(3) (a) The notice required by Subsection (2)(m) shall:
(i) be a conspicuous statement written in dark bold with at least 12-point type on the
first page of the purchase documentation; and
(ii) read as follows: "YOU, THE BUYER, MAY CANCEL THIS CONTRACT AT
ANY TIME PRIOR TO MIDNIGHT OF THE THIRD BUSINESS DAY (or time period
reflecting the supplier's cancellation policy but not less than three business days) AFTER THE
DATE OF THE TRANSACTION OR RECEIPT OF THE PRODUCT, WHICHEVER IS
LATER."
(b) A supplier is exempt from the requirements of Subsection (2)(m) if the supplier's
cancellation policy:
(i) is communicated to the buyer; and
(ii) offers greater rights to the buyer than Subsection (2)(m).
(4) (a) A gift certificate, instrument, or other record that does not print an expiration
date in accordance with Subsection (2)(v) does not expire.
(b) A gift certificate, instrument, or other record that does not include printed
information concerning a fee to be charged and deducted from the balance of the gift
certificate, instrument, or other record is not subject to the charging and deduction of the fee.
(c) Subsections (2)(v) and (4)(b) do not apply to a gift certificate, instrument, or other
record useable at multiple, unaffiliated sellers of goods or services if an expiration date is
printed on the gift certificate, instrument, or other record.
Section 3. Section 
13-61-101
 is amended to read:
13-61-101.
Definitions.
As used in this chapter:
(1) "Account" means the Consumer Privacy Restricted Account established in Section
13-61-403
.
(2) "Affiliate" means an entity that:
(a) controls, is controlled by, or is under common control with another entity; or
(b) shares common branding with another entity.
(3) "Aggregated data" means information that relates to a group or category of
consumers:
(a) from which individual consumer identities have been removed; and
(b) that is not linked or reasonably linkable to any consumer.
(4) "Air carrier" means the same as that term is defined in 49 U.S.C. Sec. 40102.
(5) "Authenticate" means to use reasonable means to determine that a consumer's
request to exercise the rights described in Section 
13-61-201
 is made by the consumer who is
entitled to exercise those rights.
(6) (a) "Biometric data" means data generated by automatic measurements of an
individual's unique biological characteristics.
(b) "Biometric data" includes data described in Subsection (6)(a) that are generated by
automatic measurements of an individual's fingerprint, voiceprint, eye retinas, irises, or any
other unique biological pattern or characteristic that is used to identify a specific individual.
(c) "Biometric data" does not include:
(i) a physical or digital photograph;
(ii) a video or audio recording;
(iii) data generated from an item described in Subsection (6)(c)(i) or (ii);
(iv) information captured from a patient in a health care setting; or
(v) information collected, used, or stored for treatment, payment, or health care
operations as those terms are defined in 45 C.F.R. Parts 160, 162, and 164.
(7) "Business associate" means the same as that term is defined in 45 C.F.R. Sec.
160.103.
(8) "Child" means an individual younger than 13 years old.
(9) "Consent" means an affirmative act by a consumer that unambiguously indicates
the consumer's voluntary and informed agreement to allow a person to process personal data
related to the consumer.
(10) (a) "Consumer" means an individual who is a resident of the state acting in an
individual or household context.
(b) "Consumer" does not include an individual acting in an employment or commercial
context.
(11) "Control" or "controlled" as used in Subsection (2) means:
(a) ownership of, or the power to vote, more than 50% of the outstanding shares of any
class of voting securities of an entity;
(b) control in any manner over the election of a majority of the directors or of the
individuals exercising similar functions; or
(c) the power to exercise controlling influence of the management of an entity.
(12) "Controller" means a person doing business in the state who determines the
purposes for which and the means by which personal data are processed, regardless of whether
the person makes the determination alone or with others.
(13) "Covered entity" means the same as that term is defined in 45 C.F.R. Sec.
160.103.
(14) 
(a)
 "Deidentified data" means data that:
[
(a)
] 
(i)
 cannot reasonably be linked to an identified individual or an identifiable
individual; and
[
(b)
] 
(ii)
 are possessed by a controller who:
[
(i)
] 
(A)
 takes reasonable measures to ensure that a person cannot associate the data
with an individual;
[
(ii)
] 
(B)
 publicly commits to maintain and use the data only in deidentified form and
not attempt to reidentify the data; and
[
(iii)
] 
(C)
 contractually obligates any recipients of the data to comply with the
requirements described in Subsections (14)(b)(i) and (ii).
(b) "Deidentified data" includes synthetic data.
(15) "Director" means the director of the Division of Consumer Protection.
(16) "Division" means the Division of Consumer Protection created in Section 
13-2-1
.
(17) "Governmental entity" means the same as that term is defined in Section
63G-2-103
.
(18) "Health care facility" means the same as that term is defined in Section
26B-2-201
.
(19) "Health care provider" means the same as that term is defined in Section
78B-3-403
.
(20) "Identifiable individual" means an individual who can be readily identified,
directly or indirectly.
(21) "Institution of higher education" means a public or private institution of higher
education.
(22) "Local political subdivision" means the same as that term is defined in Section
11-14-102
.
(23) "Nonprofit corporation" means:
(a) the same as that term is defined in Section 
16-6a-102
; or
(b) a foreign nonprofit corporation as defined in Section 
16-6a-102
.
(24) (a) "Personal data" means information that is linked or reasonably linkable to an
identified individual or an identifiable individual.
(b) "Personal data" does not include deidentified data, aggregated data, or publicly
available information.
(25) "Process" means an operation or set of operations performed on personal data,
including collection, use, storage, disclosure, analysis, deletion, or modification of personal
data.
(26) "Processor" means a person who processes personal data on behalf of a controller.
(27) "Protected health information" means the same as that term is defined in 45 C.F.R.
Sec. 160.103.
(28) "Pseudonymous data" means personal data that cannot be attributed to a specific
individual without the use of additional information, if the additional information is:
(a) kept separate from the consumer's personal data; and
(b) subject to appropriate technical and organizational measures to ensure that the
personal data are not attributable to an identified individual or an identifiable individual.
(29) "Publicly available information" means information that a person:
(a) lawfully obtains from a record of a governmental entity;
(b) reasonably believes a consumer or widely distributed media has lawfully made
available to the general public; or
(c) if the consumer has not restricted the information to a specific audience, obtains
from a person to whom the consumer disclosed the information.
(30) "Right" means a consumer right described in Section 
13-61-201
.
(31) (a) "Sale," "sell," or "sold" means the exchange of personal data for monetary
consideration by a controller to a third party.
(b) "Sale," "sell," or "sold" does not include:
(i) a controller's disclosure of personal data to a processor who processes the personal
data on behalf of the controller;
(ii) a controller's disclosure of personal data to an affiliate of the controller;
(iii) considering the context in which the consumer provided the personal data to the
controller, a controller's disclosure of personal data to a third party if the purpose is consistent
with a consumer's reasonable expectations;
(iv) the disclosure or transfer of personal data when a consumer directs a controller to:
(A) disclose the personal data; or
(B) interact with one or more third parties;
(v) a consumer's disclosure of personal data to a third party for the purpose of
providing a product or service requested by the consumer or a parent or legal guardian of a
child;
(vi) the disclosure of information that the consumer:
(A) intentionally makes available to the general public via a channel of mass media;
and
(B) does not restrict to a specific audience; or
(vii) a controller's transfer of personal data to a third party as an asset that is part of a
proposed or actual merger, an acquisition, or a bankruptcy in which the third party assumes
control of all or part of the controller's assets.
(32) (a) "Sensitive data" means:
(i) personal data that reveals:
(A) an individual's racial or ethnic origin;
(B) an individual's religious beliefs;
(C) an individual's sexual orientation;
(D) an individual's citizenship or immigration status; or
(E) information regarding an individual's medical history, mental or physical health
condition, or medical treatment or diagnosis by a health care professional;
(ii) the processing of genetic personal data or biometric data, if the processing is for the
purpose of identifying a specific individual; or
(iii) specific geolocation data.
(b) "Sensitive data" does not include personal data that reveals an individual's:
(i) racial or ethnic origin, if the personal data are processed by a video communication
service; or
(ii) if the personal data are processed by a person licensed to provide health care under
Title 26B, Chapter 2, Part 2, Health Care Facility Licensing and Inspection, or Title 58,
Occupations and Professions, information regarding an individual's medical history, mental or
physical health condition, or medical treatment or diagnosis by a health care professional.
(33) (a) "Specific geolocation data" means information derived from technology,
including global position system level latitude and longitude coordinates, that directly
identifies an individual's specific location, accurate within a radius of 1,750 feet or less.
(b) "Specific geolocation data" does not include:
(i) the content of a communication; or
(ii) any data generated by or connected to advanced utility metering infrastructure
systems or equipment for use by a utility.
(34) "Synthetic data" means data that has been generated by computer algorithms or
statistical models and does not contain personal data.
[
(34)
] 
(35)
 (a) "Targeted advertising" means displaying an advertisement to a consumer
where the advertisement is selected based on personal data obtained from the consumer's
activities over time and across nonaffiliated websites or online applications to predict the
consumer's preferences or interests.
(b) "Targeted advertising" does not include advertising:
(i) based on a consumer's activities within a controller's website or online application
or any affiliated website or online application;
(ii) based on the context of a consumer's current search query or visit to a website or
online application;
(iii) directed to a consumer in response to the consumer's request for information,
product, a service, or feedback; or
(iv) processing personal data solely to measure or report advertising:
(A) performance;
(B) reach; or
(C) frequency.
[
(35)
] 
(36)
 "Third party" means a person other than:
(a) the consumer, controller, or processor; or
(b) an affiliate or contractor of the controller or the processor.
[
(36)
] 
(37)
 "Trade secret" means information, including a formula, pattern,
compilation, program, device, method, technique, or process, that:
(a) derives independent economic value, actual or potential, from not being generally
known to, and not being readily ascertainable by proper means by, other persons who can
obtain economic value from the information's disclosure or use; and
(b) is the subject of efforts that are reasonable under the circumstances to maintain the
information's secrecy.
Section 4. Section 
13-70-101
 is enacted to read:
CHAPTER 70. ARTIFICIAL INTELLIGENCE POLICY ACT
Part 1. General Provisions
 13-70-101.
Definitions.
As used in this chapter:
(1) "Applicant" means a person that applies for participation in the regulatory learning
laboratory.
(2) "Artificial intelligence" means a machine-based system that makes predictions,
recommendations, or decisions influencing real or virtual environments.
(3) "Artificial intelligence technology" means a computer system, application, or other
product that uses or incorporates one or more forms of artificial intelligence.
(4) "Department" means the Department of Commerce.
(5) "Director" means the director of the office.
(6) "Executive director" means the executive director of the Department of Commerce.
(7) "Learning agenda" means the areas of artificial intelligence applications, risks, and
policy considerations selected by the office for focus by the learning laboratory.
(8) "Learning laboratory" means the artificial intelligence analysis and research
program created in Section 
13-70-301
.
(9) "Office" means the Office of Artificial Intelligence Policy created in Section
13-70-201
.
(10) "Participant" means a person that is accepted to participate in the learning
laboratory.
(11) "Regulatory mitigation agreement" means an agreement between a participant, the
office, and relevant state agencies described in Section
Ŝ→ [
13-70-104
] 
 13-70-302
 ←Ŝ
.
(12) "Regulatory mitigation" means:
(a) when restitution to users may be required;
(b) terms and conditions related to any cure period before penalties may be assessed;
(c) any reduced civil fines during the participation term; and
(d) other terms tailored to identified issues of the artificial intelligence technology.
Section 5. Section 
13-70-201
 is enacted to read:
Part 2. Office of Artificial Intelligence Policy
 13-70-201.
Creation of Office of Artificial Intelligence Policy -- Director appointed
-- Duties and authority.
(1) There is created in the department the Office of Artificial Intelligence Policy.
(2) The executive director of the department shall appoint a director to oversee the
management and operations of the office.
(3) The office shall:
(a) create and administer an artificial intelligence learning laboratory program;
(b) consult with businesses and other stakeholders in the state about potential
regulatory proposals;
(c) make rules in accordance with Title 63G, Chapter 3, Utah Administrative
Rulemaking Act, establishing:
(i) procedures, requirements, and fees to apply to participate in the learning laboratory
program;
(ii) criteria for invitation, acceptance, denial, or removal of participants;
(iii) data usage limitations and cybersecurity criteria for participants;
(iv) required participant disclosures to consumers;
(v) reporting requirements for participants to the office;
(vi) criteria for limited extension of the participation period; and
(vii) other requirements necessary to administer the learning laboratory; and
(d) report annually, before November 30, to the Business and Labor Interim Committee
regarding:
(i) the proposed learning agenda for the learning laboratory;
(ii) the findings, participation, and outcomes of the learning laboratory; and
(iii) recommended legislation from findings from the learning laboratory.
Section 6. Section 
13-70-301
 is enacted to read:
Part 3. Artificial Intelligence Learning Laboratory Program
 13-70-301.
 Artificial Intelligence Learning Laboratory Program.
(1) There is established the Artificial Intelligence Learning Laboratory Program, to be
administered by the office.
(2) The purpose of the learning laboratory is to:
(a) analyze and research the risks, benefits, impacts, and policy implications of
artificial intelligence technologies to inform the state regulatory framework;
(b) encourage development of artificial intelligence technologies in the state;
(c) evaluate the effectiveness and viability of current, potential, or proposed regulation
on artificial intelligence technologies with artificial intelligence companies; and
(d) produce findings and recommendations for legislation and regulation of artificial
intelligence.
(3) (a) The office shall periodically set a learning agenda for the learning laboratory
that establishes the specific areas of artificial intelligence policy the office intends to study.
(b) In establishing the learning agenda, the office may consult with:
(i) relevant agencies;
(ii) industry leaders;
(iii) academic institutions in the state; and
(iv) key stakeholders with relevant knowledge, experience, or expertise in the area.
(4) The office may invite and receive an application from a person to participate in the
learning laboratory.
(5) The office shall establish the procedures and requirements for sending an invitation
and receiving requests to participate in the learning laboratory in accordance with the purposes
of the learning laboratory.
(6) In selecting participants for the learning laboratory, the office shall consider:
(a) the relevance and utility of an invitee or applicant's artificial intelligence technology
to the learning agenda;
(b) the invitee or applicant's expertise and knowledge specific to the learning agenda;
and
(c) other factors identified by the office as relevant to participation in the learning
laboratory.
(7) The office shall work with participants to establish benchmarks and assess
outcomes of participation in the learning laboratory.
Section 7. Section 
13-70-302
 is enacted to read:
 13-70-302.
Regulatory mitigation agreements.
(1) A participant who uses or wants to utilize an artificial intelligence technology in the
state may apply for regulatory mitigation according to criteria and procedures outlined by the
office by rule made under Section 
13-70-201
.
(2) The office may grant, on a temporary basis, regulatory mitigation to a participant by
entering into a regulatory mitigation agreement with the office and relevant agencies.
(3) To receive regulatory mitigation, a participant must demonstrate that the applicant
meets eligibility criteria established in Section 
13-70-303
.
(4) A regulatory mitigation agreement between a participant and the office and relevant
agencies shall specify:
(a) limitations on scope of the use of the participant's artificial intelligence technology,
including:
(i) the number and types of users;
(ii) geographic limitations; and
(iii) other limitations to implementation;
(b) safeguards to be implemented; and
(c) any regulatory mitigation granted to the applicant.
(5) The office shall consult with relevant agencies regarding appropriate terms in a
regulatory mitigation agreement.
(6) A participant remains subject to all legal and regulatory requirements not expressly
waived or modified by the terms of the regulatory mitigation agreement.
(7) (a) The office may remove a participant at any time and for any reason, and the
participant does not have an expectation of a property right or license to participate in the
learning laboratory.
(b) A participant demonstrating an artificial intelligence technology that violates legal
or regulatory requirements or the terms of the participation agreement may be immediately
removed from further participation and subject to all applicable civil and criminal penalties.
(8) Participation in the learning laboratory does not constitute an endorsement or
approval from the state.
(9) The state shall not be responsible for any claims, liabilities, damages, losses, or
expenses arising out of a participant's involvement in the learning laboratory.
Section 8. Section 
13-70-303
 is enacted to read:
 13-70-303.
Regulatory mitigation eligibility requirements -- Application
evaluation and admission.
(1) To be eligible for regulatory mitigation, a participant shall demonstrate to the office
that:
(a) the participant has the technical expertise and capability to responsibly develop and
test the proposed artificial intelligence technology;
(b) the participant has sufficient financial resources to meet obligations during testing;
(c) the artificial intelligence technology provides potential substantial consumer
benefits that may outweigh identified risks from mitigated enforcement of regulations;
(d) the participant has an effective plan to monitor and minimize identified risks from
testing; and
(e) the scale, scope, duration of proposed testing is appropriately limited based on risk
assessments.
(2) To evaluate whether an applicant meets eligibility criteria to receive regulatory
mitigation, the office may consult with relevant agencies and outside experts regarding the
application.
Section 9. Section 
13-70-304
 is enacted to read:
 13-70-304.
Participation in Artificial Intelligence Learning Laboratory.
(1) (a) The office may approve an applicant to participate in the program.
(b) An approved applicant becomes a participant by entering into a participation
agreement with the office and relevant state agencies.
(2) A participant shall:
(a) provide required information to state agencies in accordance with the terms of the
participation agreement; and
(b) report to the office as required in the participation agreement.
(3) The office may establish additional cybersecurity auditing procedures applicable to
participants demonstrating artificial intelligence technologies that the office considers higher
risk.
(4) A participant shall retain records as required by office rule or the participation
agreement.
(5) A participant shall immediately report to the office any incidents resulting in
consumer harm, privacy breach, or unauthorized data usage, which may result in removal of the
participant from the learning laboratory.
Section 10. Section 
13-70-305
 is enacted to read:
 13-70-305.
Program extension.
(1) An initial regulatory mitigation agreement shall be in force for no longer than 12
months.
(2) A participant may request a single 12-month extension for participation in the
learning laboratory period no later than 30 days before the end of the initial 12-month period.
(3) The office shall grant or deny an extension request before expiration of the initial
demonstration period.
Section 11. Section 
63I-2-213
 is amended to read:
63I-2-213.
Repeal dates: Title 13.
(1) Section 
13-1-16
 is repealed on July 1, 2024.
(2) Title 13, Chapter 47, Private Employer Verification Act, is repealed on the program
start date, as defined in Section 
63G-12-102
.
(3) Title 13, Chapter 70, Artificial Intelligence Act, is repealed on May 1, 2025.
Section 12. Section 
76-2-107
 is enacted to read:
 76-2-107.
Commission of offense with aid of generative artificial intelligence.
(1) As used in this section, "generative artificial intelligence" means the same as that
term is defined in Section 
13-2-12
.
(2) An actor may be found guilty of an offense if:
(a) the actor commits the offense with the aid of a generative artificial intelligence; or
(b) the actor intentionally prompts or otherwise causes a generative artificial
intelligence to commit the offense.
Section 13. 
Effective date.
This bill takes effect on May 1, 2024.