Section 1, Section 13-2-12 is enacted to read: 13-2-12. Generative artificial intelligence -- Impact on liability for violation of consumer protection law. (1) As used in this section: (a) "Generative artificial intelligence" means an artificial system that: (i) is trained on data; (ii) interacts with a person using text, audio, or visual communication; and (iii) generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight. (b) "License" means a state-granted authorization for a person to engage in a specified occupation: (i) based on the person meeting personal qualifications established under state law; and (ii) where state law requires the authorization before the person may lawfully engage in the occupation for compensation. (c) "Regulated occupation" means an occupation regulated by the Department of Commerce that requires a person to obtain a license or state certification to practice the occupation. (d) "State certification" means a state-granted authorization given to a person to use the term "state certified" as part of a designated title related to engaging in a specified occupation: (i) based on the person meeting personal qualifications established under state law; and (ii) where state law prohibits a noncertified person from using the term "state certified" as part of a designated title but does not otherwise prohibit a noncertified person from engaging in the occupation for compensation. (2) It is not a defense to the violation of any statute administered and enforced by the division, as described in Section 13-2-1, that generative artificial intelligence: (a) made the violative statement; (b) undertook the violative act; or (c) was used in furtherance of the violation. (3) A person who uses, prompts, or otherwise causes generative artificial intelligence to interact with a person in connection with any act administered and enforced by the division, as described in Section 13-2-1, shall clearly and conspicuously disclose to the person with whom the generative artificial intelligence interacts, if asked or prompted by the person, that the person is interacting with generative artificial intelligence and not a human. (4) (a) A person who provides the services of a regulated occupation shall prominently disclose when a person is interacting with a generative artificial intelligence in the provision of regulated services. (b) Nothing in this section permits a person to provide the services of a regulated occupation through generative artificial intelligence without meeting the requirements of the regulated occupation. (5) A disclosure described Subsection (4)(a) shall be provided: (a) verbally at the start of an oral exchange or conversation; and (b) through electronic messaging before a written exchange. (6) The division shall administer and enforce the provisions of this section in accordance with Chapter 2, Division of Consumer Protection. (7) In addition to the division's enforcement powers described by Chapter 2, Division of Consumer Protection: (a) the division director may impose an administrative fine for up to $2,500 for each violation of this section; and (b) the division may bring an action in court to enforce a provision of this section. (8) In a court action by the division to enforce a provision of this section, the court may: (a) declare that an act or practice violates a provision of this section; (b) issue an injunction for a violation of this section; (c) order disgorgement of any money received in violation of this section; (d) order payment of disgorged money to a person injured by a violation of this section; (e) impose a fine of up to $2,500 for each violation of this section; or (f) award any other relief that the court deems reasonable and necessary. (9) If a court of competent jurisdiction grants judgment or injunctive relief to the division, the court shall award the division: (a) reasonable attorney fees; (b) court costs; and (c) investigative fees. (10) (a) A person who violates an administrative or court order issued for a violation of this chapter is subject to a civil penalty of no more than $5,000 for each violation. (b) A civil penalty authorized under this section may be imposed in any civil action brought by the attorney general on behalf of the division.

Section 2, Section 13-11-4 is amended to read: 13-11-4. Deceptive act or practice by supplier. (1)A deceptive act or practice by a supplier in connection with a consumer transaction violates this chapter whether it occurs before, during, or after the transaction. (2)Without limiting the scope of Subsection (1), a supplier commits a deceptive act or practice if the supplier knowingly or intentionally: (a)indicates that the subject of a consumer transaction has sponsorship, approval, performance characteristics, accessories, uses, or benefits, if it has not; (b)indicates that the subject of a consumer transaction is of a particular standard, quality, grade, style, or model, if it is not; (c)indicates that the subject of a consumer transaction is new, or unused, if it is not, or has been used to an extent that is materially different from the fact; (d)indicates that the subject of a consumer transaction is available to the consumer for a reason that does not exist, including any of the following reasons falsely used in an advertisement: (i)"going out of business"; (ii)"bankruptcy sale"; (iii)"lost our lease"; (iv)"building coming down"; (v)"forced out of business"; (vi)"final days"; (vii)"liquidation sale"; (viii)"fire sale"; (ix)"quitting business"; or (x)an expression similar to any of the expressions in Subsections (2)(d)(i) through (ix); (e)indicates that the subject of a consumer transaction has been supplied in accordance with a previous representation, if it has not; (f)indicates that the subject of a consumer transaction will be supplied in greater quantity than the supplier intends; (g)indicates that replacement or repair is needed, if it is not; (h)indicates that a specific price advantage exists, if it does not; (i)indicates that the supplier has a sponsorship, approval, license, certification, or affiliation the supplier does not have; (j) (i)indicates that a consumer transaction involves or does not involve a warranty, a disclaimer of warranties, particular warranty terms, or other rights, remedies, or obligations, if the representation is false; or (ii)fails to honor a warranty or a particular warranty term; (k)indicates that the consumer will receive a rebate, discount, or other benefit as an inducement for entering into a consumer transaction in return for giving the supplier the names of prospective consumers or otherwise helping the supplier to enter into other consumer transactions, if receipt of the benefit is contingent on an event occurring after the consumer enters into the transaction; (l)after receipt of payment for goods or services, fails to ship the goods or furnish the services within the time advertised or otherwise represented or, if no specific time is advertised or represented, fails to ship the goods or furnish the services within 30 days, unless within the applicable time period the supplier provides the buyer with the option to: (i)cancel the sales agreement and receive a refund of all previous payments to the supplier if the refund is mailed or delivered to the buyer within 10 business days after the day on which the seller receives written notification from the buyer of the buyer's intent to cancel the sales agreement and receive the refund; or (ii)extend the shipping date to a specific date proposed by the supplier; (m)except as provided in Subsection (3)(b), fails to furnish a notice meeting the requirements of Subsection (3)(a) of the purchaser's right to cancel a direct solicitation sale within three business days of the time of purchase if: (i)the sale is made other than at the supplier's established place of business pursuant to the supplier's personal contact, whether through mail, electronic mail, facsimile transmission, telephone, or any other form of direct solicitation; and (ii)the sale price exceeds $25; (n)promotes, offers, or grants participation in a pyramid scheme as defined under Title 76, Chapter 6a, Pyramid Scheme Act; (o)represents that the funds or property conveyed in response to a charitable solicitation will be donated or used for a particular purpose or will be donated to or used by a particular organization, if the representation is false; (p)if a consumer indicates the consumer's intention of making a claim for a motor vehicle repair against the consumer's motor vehicle insurance policy: (i)commences the repair without first giving the consumer oral and written notice of: (A)the total estimated cost of the repair; and (B)the total dollar amount the consumer is responsible to pay for the repair, which dollar amount may not exceed the applicable deductible or other copay arrangement in the consumer's insurance policy; or (ii)requests or collects from a consumer an amount that exceeds the dollar amount a consumer was initially told the consumer was responsible to pay as an insurance deductible or other copay arrangement for a motor vehicle repair under Subsection (2)(p)(i), even if that amount is less than the full amount the motor vehicle insurance policy requires the insured to pay as a deductible or other copay arrangement, unless: (A)the consumer's insurance company denies that coverage exists for the repair, in which case, the full amount of the repair may be charged and collected from the consumer; or (B)the consumer misstates, before the repair is commenced, the amount of money the insurance policy requires the consumer to pay as a deductible or other copay arrangement, in which case, the supplier may charge and collect from the consumer an amount that does not exceed the amount the insurance policy requires the consumer to pay as a deductible or other copay arrangement; (q)includes in any contract, receipt, or other written documentation of a consumer transaction, or any addendum to any contract, receipt, or other written documentation of a consumer transaction, any confession of judgment or any waiver of any of the rights to which a consumer is entitled under this chapter; (r)charges a consumer for a consumer transaction or a portion of a consumer transaction that has not previously been agreed to by the consumer; (s)solicits or enters into a consumer transaction with a person who lacks the mental ability to comprehend the nature and consequences of: (i)the consumer transaction; or (ii)the person's ability to benefit from the consumer transaction; (t)solicits for the sale of a product or service by providing a consumer with an unsolicited check or negotiable instrument the presentment or negotiation of which obligates the consumer to purchase a product or service, unless the supplier is: (i)a depository institution under Section 7-1-103; (ii)an affiliate of a depository institution; or (iii)an entity regulated under Title 7, Financial Institutions Act; (u)sends an unsolicited mailing to a person that appears to be a billing, statement, or request for payment for a product or service the person has not ordered or used, or that implies that the mailing requests payment for an ongoing product or service the person has not received or requested; (v)issues a gift certificate, instrument, or other record in exchange for payment to provide the bearer, upon presentation, goods or services in a specified amount without printing in a readable manner on the gift certificate, instrument, packaging, or record any expiration date or information concerning a fee to be charged and deducted from the balance of the gift certificate, instrument, or other record; (w)misrepresents the geographical origin or location of the supplier's business; (x)fails to comply with the restrictions of Section 15-10-201 on automatic renewal provisions; (y)violates Section 13-59-201; or (z)fails to comply with the restrictions of Subsection 13-54-202(2). (3) (a)The notice required by Subsection (2)(m) shall: (i)be a conspicuous statement written in dark bold with at least 12-point type on the first page of the purchase documentation; and (ii)read as follows: "YOU, THE BUYER, MAY CANCEL THIS CONTRACT AT ANY TIME PRIOR TO MIDNIGHT OF THE THIRD BUSINESS DAY (or time period reflecting the supplier's cancellation policy but not less than three business days) AFTER THE DATE OF THE TRANSACTION OR RECEIPT OF THE PRODUCT, WHICHEVER IS LATER." (b)A supplier is exempt from the requirements of Subsection (2)(m) if the supplier's cancellation policy: (i)is communicated to the buyer; and (ii)offers greater rights to the buyer than Subsection (2)(m). (4) (a)A gift certificate, instrument, or other record that does not print an expiration date in accordance with Subsection (2)(v) does not expire. (b)A gift certificate, instrument, or other record that does not include printed information concerning a fee to be charged and deducted from the balance of the gift certificate, instrument, or other record is not subject to the charging and deduction of the fee. (c)Subsections (2)(v) and (4)(b) do not apply to a gift certificate, instrument, or other record useable at multiple, unaffiliated sellers of goods or services if an expiration date is printed on the gift certificate, instrument, or other record.

Section 3, Section 13-61-101 is amended to read: 13-61-101. Definitions. As used in this chapter: (1)"Account" means the Consumer Privacy Restricted Account established in Section 13-61-403 . (2)"Affiliate" means an entity that: (a)controls, is controlled by, or is under common control with another entity; or (b)shares common branding with another entity. (3)"Aggregated data" means information that relates to a group or category of consumers: (a)from which individual consumer identities have been removed; and (b)that is not linked or reasonably linkable to any consumer. (4)"Air carrier" means the same as that term is defined in 49 U.S.C. Sec. 40102. (5)"Authenticate" means to use reasonable means to determine that a consumer's request to exercise the rights described in Section 13-61-201 is made by the consumer who is entitled to exercise those rights. (6) (a)"Biometric data" means data generated by automatic measurements of an individual's unique biological characteristics. (b)"Biometric data" includes data described in Subsection (6)(a) that are generated by automatic measurements of an individual's fingerprint, voiceprint, eye retinas, irises, or any other unique biological pattern or characteristic that is used to identify a specific individual. (c)"Biometric data" does not include: (i)a physical or digital photograph; (ii)a video or audio recording; (iii)data generated from an item described in Subsection (6)(c)(i) or (ii); (iv)information captured from a patient in a health care setting; or (v)information collected, used, or stored for treatment, payment, or health care operations as those terms are defined in 45 C.F.R. Parts 160, 162, and 164. (7)"Business associate" means the same as that term is defined in 45 C.F.R. Sec. 160.103. (8)"Child" means an individual younger than 13 years old. (9)"Consent" means an affirmative act by a consumer that unambiguously indicates the consumer's voluntary and informed agreement to allow a person to process personal data related to the consumer. (10) (a)"Consumer" means an individual who is a resident of the state acting in an individual or household context. (b)"Consumer" does not include an individual acting in an employment or commercial context. (11)"Control" or "controlled" as used in Subsection (2) means: (a)ownership of, or the power to vote, more than 50% of the outstanding shares of any class of voting securities of an entity; (b)control in any manner over the election of a majority of the directors or of the individuals exercising similar functions; or (c)the power to exercise controlling influence of the management of an entity. (12)"Controller" means a person doing business in the state who determines the purposes for which and the means by which personal data are processed, regardless of whether the person makes the determination alone or with others. (13)"Covered entity" means the same as that term is defined in 45 C.F.R. Sec. 160.103. (14) (a) "Deidentified data" means data that: (a) (i) cannot reasonably be linked to an identified individual or an identifiable individual; and (b) (ii) are possessed by a controller who: (i) (A) takes reasonable measures to ensure that a person cannot associate the data with an individual; (ii) (B) publicly commits to maintain and use the data only in deidentified form and not attempt to reidentify the data; and (iii) (C) contractually obligates any recipients of the data to comply with the requirements described in Subsections (14)(b)(i) and (ii). (b) "Deidentified data" includes synthetic data. (15)"Director" means the director of the Division of Consumer Protection. (16)"Division" means the Division of Consumer Protection created in Section 13-2-1. (17)"Governmental entity" means the same as that term is defined in Section 63G-2-103. (18)"Health care facility" means the same as that term is defined in Section 26B-2-201. (19)"Health care provider" means the same as that term is defined in Section 78B-3-403. (20)"Identifiable individual" means an individual who can be readily identified, directly or indirectly. (21)"Institution of higher education" means a public or private institution of higher education. (22)"Local political subdivision" means the same as that term is defined in Section 11-14-102 . (23)"Nonprofit corporation" means: (a)the same as that term is defined in Section 16-6a-102; or (b)a foreign nonprofit corporation as defined in Section 16-6a-102. (24) (a)"Personal data" means information that is linked or reasonably linkable to an identified individual or an identifiable individual. (b)"Personal data" does not include deidentified data, aggregated data, or publicly available information. (25)"Process" means an operation or set of operations performed on personal data, including collection, use, storage, disclosure, analysis, deletion, or modification of personal data. (26)"Processor" means a person who processes personal data on behalf of a controller. (27)"Protected health information" means the same as that term is defined in 45 C.F.R. Sec. 160.103. (28)"Pseudonymous data" means personal data that cannot be attributed to a specific individual without the use of additional information, if the additional information is: (a)kept separate from the consumer's personal data; and (b)subject to appropriate technical and organizational measures to ensure that the personal data are not attributable to an identified individual or an identifiable individual. (29)"Publicly available information" means information that a person: (a)lawfully obtains from a record of a governmental entity; (b)reasonably believes a consumer or widely distributed media has lawfully made available to the general public; or (c)if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information. (30)"Right" means a consumer right described in Section 13-61-201. (31) (a)"Sale," "sell," or "sold" means the exchange of personal data for monetary consideration by a controller to a third party. (b)"Sale," "sell," or "sold" does not include: (i)a controller's disclosure of personal data to a processor who processes the personal data on behalf of the controller; (ii)a controller's disclosure of personal data to an affiliate of the controller; (iii)considering the context in which the consumer provided the personal data to the controller, a controller's disclosure of personal data to a third party if the purpose is consistent with a consumer's reasonable expectations; (iv)the disclosure or transfer of personal data when a consumer directs a controller to: (A)disclose the personal data; or (B)interact with one or more third parties; (v)a consumer's disclosure of personal data to a third party for the purpose of providing a product or service requested by the consumer or a parent or legal guardian of a child; (vi)the disclosure of information that the consumer: (A)intentionally makes available to the general public via a channel of mass media; and (B)does not restrict to a specific audience; or (vii)a controller's transfer of personal data to a third party as an asset that is part of a proposed or actual merger, an acquisition, or a bankruptcy in which the third party assumes control of all or part of the controller's assets. (32) (a)"Sensitive data" means: (i)personal data that reveals: (A)an individual's racial or ethnic origin; (B)an individual's religious beliefs; (C)an individual's sexual orientation; (D)an individual's citizenship or immigration status; or (E)information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional; (ii)the processing of genetic personal data or biometric data, if the processing is for the purpose of identifying a specific individual; or (iii)specific geolocation data. (b)"Sensitive data" does not include personal data that reveals an individual's: (i)racial or ethnic origin, if the personal data are processed by a video communication service; or (ii)if the personal data are processed by a person licensed to provide health care under Title 26B, Chapter 2, Part 2, Health Care Facility Licensing and Inspection, or Title 58, Occupations and Professions, information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional. (33) (a)"Specific geolocation data" means information derived from technology, including global position system level latitude and longitude coordinates, that directly identifies an individual's specific location, accurate within a radius of 1,750 feet or less. (b)"Specific geolocation data" does not include: (i)the content of a communication; or (ii)any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility. (34) "Synthetic data" means data that has been generated by computer algorithms or statistical models and does not contain personal data. (34) (35) (a)"Targeted advertising" means displaying an advertisement to a consumer where the advertisement is selected based on personal data obtained from the consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests. (b)"Targeted advertising" does not include advertising: (i)based on a consumer's activities within a controller's website or online application or any affiliated website or online application; (ii)based on the context of a consumer's current search query or visit to a website or online application; (iii)directed to a consumer in response to the consumer's request for information, product, a service, or feedback; or (iv)processing personal data solely to measure or report advertising: (A)performance; (B)reach; or (C)frequency. (35) (36) "Third party" means a person other than: (a)the consumer, controller, or processor; or (b)an affiliate or contractor of the controller or the processor. (36) (37) "Trade secret" means information, including a formula, pattern, compilation, program, device, method, technique, or process, that: (a)derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from the information's disclosure or use; and (b)is the subject of efforts that are reasonable under the circumstances to maintain the information's secrecy.

Section 4, Section 13-70-101 is enacted to read: 70. ARTIFICIAL INTELLIGENCE POLICY ACT 1. General Provisions 13-70-101. Definitions. As used in this chapter: (1) "Applicant" means a person that applies for participation in the regulatory learning laboratory. (2) "Artificial intelligence" means a machine-based system that makes predictions, recommendations, or decisions influencing real or virtual environments. (3) "Artificial intelligence technology" means a computer system, application, or other product that uses or incorporates one or more forms of artificial intelligence. (4) "Department" means the Department of Commerce. (5) "Director" means the director of the office. (6) "Executive director" means the executive director of the Department of Commerce. (7) "Learning agenda" means the areas of artificial intelligence applications, risks, and policy considerations selected by the office for focus by the learning laboratory. (8) "Learning laboratory" means the artificial intelligence analysis and research program created in Section 13-70-301. (9) "Office" means the Office of Artificial Intelligence Policy created in Section 13-70-201. (10) "Participant" means a person that is accepted to participate in the learning laboratory. (11) "Regulatory mitigation agreement" means an agreement between a participant, the office, and relevant state agencies described in Section 13-70-302. (12) "Regulatory mitigation" means: (a) when restitution to users may be required; (b) terms and conditions related to any cure period before penalties may be assessed; (c) any reduced civil fines during the participation term; and (d) other terms tailored to identified issues of the artificial intelligence technology.

Section 5, Section 13-70-201 is enacted to read: 2. Office of Artificial Intelligence Policy 13-70-201. Creation of Office of Artificial Intelligence Policy -- Director appointed -- Duties and authority. (1) There is created in the department the Office of Artificial Intelligence Policy. (2) The executive director of the department shall appoint a director to oversee the management and operations of the office. (3) The office shall: (a) create and administer an artificial intelligence learning laboratory program; (b) consult with businesses and other stakeholders in the state about potential regulatory proposals; (c) make rules in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, establishing: (i) procedures, requirements, and fees to apply to participate in the learning laboratory program; (ii) criteria for invitation, acceptance, denial, or removal of participants; (iii) data usage limitations and cybersecurity criteria for participants; (iv) required participant disclosures to consumers; (v) reporting requirements for participants to the office; (vi) criteria for limited extension of the participation period; and (vii) other requirements necessary to administer the learning laboratory; and (d) report annually, before November 30, to the Business and Labor Interim Committee regarding: (i) the proposed learning agenda for the learning laboratory; (ii) the findings, participation, and outcomes of the learning laboratory; and (iii) recommended legislation from findings from the learning laboratory.

Section 6, Section 13-70-301 is enacted to read: 3. Artificial Intelligence Learning Laboratory Program 13-70-301. Artificial Intelligence Learning Laboratory Program. (1) There is established the Artificial Intelligence Learning Laboratory Program, to be administered by the office. (2) The purpose of the learning laboratory is to: (a) analyze and research the risks, benefits, impacts, and policy implications of artificial intelligence technologies to inform the state regulatory framework; (b) encourage development of artificial intelligence technologies in the state; (c) evaluate the effectiveness and viability of current, potential, or proposed regulation on artificial intelligence technologies with artificial intelligence companies; and (d) produce findings and recommendations for legislation and regulation of artificial intelligence. (3) (a) The office shall periodically set a learning agenda for the learning laboratory that establishes the specific areas of artificial intelligence policy the office intends to study. (b) In establishing the learning agenda, the office may consult with: (i) relevant agencies; (ii) industry leaders; (iii) academic institutions in the state; and (iv) key stakeholders with relevant knowledge, experience, or expertise in the area. (4) The office may invite and receive an application from a person to participate in the learning laboratory. (5) The office shall establish the procedures and requirements for sending an invitation and receiving requests to participate in the learning laboratory in accordance with the purposes of the learning laboratory. (6) In selecting participants for the learning laboratory, the office shall consider: (a) the relevance and utility of an invitee or applicant's artificial intelligence technology to the learning agenda; (b) the invitee or applicant's expertise and knowledge specific to the learning agenda; and (c) other factors identified by the office as relevant to participation in the learning laboratory. (7) The office shall work with participants to establish benchmarks and assess outcomes of participation in the learning laboratory.

Section 7, Section 13-70-302 is enacted to read: 13-70-302. Regulatory mitigation agreements. (1) A participant who uses or wants to utilize an artificial intelligence technology in the state may apply for regulatory mitigation according to criteria and procedures outlined by the office by rule made under Section 13-70-201. (2) The office may grant, on a temporary basis, regulatory mitigation to a participant by entering into a regulatory mitigation agreement with the office and relevant agencies. (3) To receive regulatory mitigation, a participant must demonstrate that the applicant meets eligibility criteria established in Section 13-70-303. (4) A regulatory mitigation agreement between a participant and the office and relevant agencies shall specify: (a) limitations on scope of the use of the participant's artificial intelligence technology, including: (i) the number and types of users; (ii) geographic limitations; and (iii) other limitations to implementation; (b) safeguards to be implemented; and (c) any regulatory mitigation granted to the applicant. (5) The office shall consult with relevant agencies regarding appropriate terms in a regulatory mitigation agreement. (6) A participant remains subject to all legal and regulatory requirements not expressly waived or modified by the terms of the regulatory mitigation agreement. (7) (a) The office may remove a participant at any time and for any reason, and the participant does not have an expectation of a property right or license to participate in the learning laboratory. (b) A participant demonstrating an artificial intelligence technology that violates legal or regulatory requirements or the terms of the participation agreement may be immediately removed from further participation and subject to all applicable civil and criminal penalties. (8) Participation in the learning laboratory does not constitute an endorsement or approval from the state. (9) The state shall not be responsible for any claims, liabilities, damages, losses, or expenses arising out of a participant's involvement in the learning laboratory.

Section 8, Section 13-70-303 is enacted to read: 13-70-303. Regulatory mitigation eligibility requirements -- Application evaluation and admission. (1) To be eligible for regulatory mitigation, a participant shall demonstrate to the office that: (a) the participant has the technical expertise and capability to responsibly develop and test the proposed artificial intelligence technology; (b) the participant has sufficient financial resources to meet obligations during testing; (c) the artificial intelligence technology provides potential substantial consumer benefits that may outweigh identified risks from mitigated enforcement of regulations; (d) the participant has an effective plan to monitor and minimize identified risks from testing; and (e) the scale, scope, and duration of proposed testing is appropriately limited based on risk assessments. (2) To evaluate whether an applicant meets eligibility criteria to receive regulatory mitigation, the office may consult with relevant agencies and outside experts regarding the application.

Section 9, Section 13-70-304 is enacted to read: 13-70-304. Participation in Artificial Intelligence Learning Laboratory. (1) (a) The office may approve an applicant to participate in the program. (b) An approved applicant becomes a participant by entering into a participation agreement with the office and relevant state agencies. (2) A participant shall: (a) provide required information to state agencies in accordance with the terms of the participation agreement; and (b) report to the office as required in the participation agreement. (3) The office may establish additional cybersecurity auditing procedures applicable to participants demonstrating artificial intelligence technologies that the office considers higher risk. (4) A participant shall retain records as required by office rule or the participation agreement. (5) A participant shall immediately report to the office any incidents resulting in consumer harm, privacy breach, or unauthorized data usage, which may result in removal of the participant from the learning laboratory.

Section 10, Section 13-70-305 is enacted to read: 13-70-305. Program extension. (1) An initial regulatory mitigation agreement shall be in force for no longer than 12 months. (2) A participant may request a single 12-month extension for participation in the learning laboratory period no later than 30 days before the end of the initial 12-month period. (3) The office shall grant or deny an extension request before expiration of the initial demonstration period.

Section 11, Section 63I-2-213 is amended to read: 63I-2-213. Repeal dates: Title 13. (1)Section 13-1-16 is repealed on July 1, 2024. (2)Title 13, Chapter 47, Private Employer Verification Act, is repealed on the program start date, as defined in Section 63G-12-102. (3) Title 13, Chapter 70, Artificial Intelligence Act, is repealed on May 1, 2025.

Section 12, Section 76-2-107 is enacted to read: 76-2-107. Commission of offense with aid of generative artificial intelligence. (1) As used in this section, "generative artificial intelligence" means the same as that term is defined in Section 13-2-12. (2) An actor may be found guilty of an offense if: (a) the actor commits the offense with the aid of a generative artificial intelligence; or (b) the actor intentionally prompts or otherwise causes a generative artificial intelligence to commit the offense.

Section 13. Effective date. This bill takes effect on May 1, 2024.