Deploys a mental-health chatbot, in Utah

Utah Code 13-44-201 · Read the law's page

• This binds any person who conducts business in Utah and maintains personal information collected or maintained in the regular course of business.
• Implement and maintain reasonable procedures to prevent the unlawful use or disclosure of that personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy, or arrange for the destruction of, records containing personal information that are not to be retained, by the method the section specifies.
• There is no private right of action for a violation of this section; only the Utah Attorney General may enforce this chapter.

Utah Code 78B-4-701 to 78B-4-704 · Read the law's page

• This is a defense available to any person sued in Utah on a claim arising from a breach of system security; it creates no independent duty to adopt a cybersecurity program, and under section 78B-4-704 may not be construed to create a private cause of action, including a class action, for failing to comply with it.
• To claim the defense against a claim of failing to implement reasonable information security controls, failing to appropriately respond to a breach, or failing to appropriately notify an affected individual, have in place at the time of the breach a written cybersecurity program designed to protect the type of personal information at issue and scaled to your size, complexity, activities, and the sensitivity of the information you hold.
• Build the program as a reasonable security program, a designated coordinator, procedures to detect, prevent and respond to a breach, employee training, and periodic risk assessments of network and software design, information handling, and data storage and disposal, adjusted as circumstances change, or have it reasonably conform to a current named framework: NIST SP 800-171; NIST SP 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the CIS Critical Security Controls; the ISO/IEC 27000 family; the HIPAA Security Rule or Gramm-Leach-Bliley Title V regulations for information those regimes cover; or the PCI Data Security Standard for payment card information.
• Update the program to a revised framework within one year of the revision's publication, and to an amended regulation within a reasonable time weighed against the risk to personal information and the cost and effort of compliance.
• The defense is unavailable if you had actual notice of a threat or hazard to the information's security and did not act in a reasonable amount of time to take known remedial efforts before it resulted in the breach; a risk assessment to improve security is not itself actual notice.

Utah Code 13-72a-203 · Read the law's page

• Have the chatbot clearly and conspicuously disclose that it is artificial intelligence and not human, if it simulates the kind of confidential conversation a licensed mental health therapist would have
• Disclose before the user can access the chatbot's features
• Disclose again at the start of any interaction following seven days of non-use
• Disclose again any time the user asks whether AI is being used

Utah Code 13-77-103 to 13-77-104 · Read the law's page

• Disclose that the individual is interacting with generative AI when they ask clearly and unambiguously, if you use generative AI to interact with someone in a consumer transaction
• Disclose proactively and prominently, verbally or in writing as applicable, if you work in a state-regulated occupation and the interaction is high risk
• High risk here means collecting sensitive health, financial, or biometric information, or giving advice relied on for significant decisions
• A safe harbor applies where the generative AI clearly and conspicuously discloses its non-human nature throughout the interaction