HB 438 — Artificial Intelligence Amendments

- 7 - HB0438S01 compared with HB0438S05 [(15)] (16) "Director" means the director of the Division of Consumer Protection.

- 8 - HB0438 compared with HB0438S05 [(22)] (23) "Local political subdivision" means the same as that term is defined in Section 11-14-102.

or - 8 - HB0438S01 compared with HB0438S05 (c) if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information.

- 9 - HB0438 compared with HB0438S05 (i) a controller's disclosure of personal data to a processor who processes the personal data on behalf of the controller;

or - 9 - HB0438S01 compared with HB0438S05 (E) information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional;

or - 10 - HB0438 compared with HB0438S05 (ii) if the personal data are processed by a person licensed to provide health care under Title 26B, Chapter 2, Part 2, Health Care Facility Licensing and Inspection, or Title 58, Occupations and Professions, information regarding an individual's medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional.

or - 10 - HB0438S01 compared with HB0438S05 (iv) processing personal data solely to measure or report advertising:

- 11 - HB0438 compared with HB0438S05 [(37)] (38) "Trade secret" means information, including a formula, pattern, compilation, program, device, method, technique, or process, that:

{(EffectiveApplicability. 05/06/26)}(Effective 08/01/26)Applicability.

- 11 - HB0438S01 compared with HB0438S05 (c) an institution of higher education;

- 12 - HB0438 compared with HB0438S05 (ii) patient identifying information for purposes of 42 C.F.R.

- 12 - HB0438S01 compared with HB0438S05 (i) information used only for public health activities and purposes as described in 45 C.F.R.

- 13 - HB0438 compared with HB0438S05 (ii) subject to regulation under the federal Fair Credit Reporting Act, 15 U.S.C.

- 13 - HB0438S01 compared with HB0438S05 (ii) as the emergency contact information of an individual described in Subsection (2)(o)(i) and used for emergency contact purposes;

(3) A controller is in compliance with any obligation to obtain parental consent under this chapter if the controller complies with the verifiable parental consent mechanisms under the Children's Online - 14 - HB0438 compared with HB0438S05 Privacy Protection Act, 15 U.S.C.

{AI } Companion Chatbot Safety Act 1.

(1){(2)}(2) (a)(1){(a)} "Affirmative consent" means a clearclearact act signifying a user's freely given, {voluntary} specific, informed, and unambiguous {agreement by a Utah user } authorization for an act or practice in response to {receive communications from a supplier.} a specific request from an operator, provided:

(i){(2) the} request{(a) is{"AI {providedcompanion tochatbot" themeans user in a }chatbot clearthat:} {and } ,{(i) conspicuous{simulates {standalonehuman-like disclosure}conversation , and writteninteraction; in easy-to-understand language;

{(ii)and} {the} request{(ii) includes{is acapable description,of writtenfacilitating inemotionally easy-to-understandintimate language,engagement ofwith thea actuser orby:} practice} for{(A) which{engaging thein user'srole-play consentscenarios isin sought;}which }the {(iii)chatbot {theassumes requestor is madeassigned inthe arole mannerof reasonablya accessiblefriend, tosignificant andother, usableor bycompanion athat userinteracts with a disability;}user;} } -(i) 14 - HB0438S01 compared with HB0438S05 (iv){(ii)} the optionrequest to refuse to give consent is atclear, leastconspicuous, as prominent as the option to give consent, and thewritten optionin toeasy-to-understand refuselanguage; to give consent takes the same number of steps or fewer as the option to give consent;

and(ii) (v){(iii)}the affirmativeoption consent to anrefuse actto orgive practiceconsent is notat inferredleast fromas prominent as the inactionoption ofto thegive userconsent, orand the user'soption continuedto userefuse to give consent takes the same number of asteps {chatbotor providedfewer byas the }option companionto chatbotgive {provider}consent; .

(b)and "Affirmative(B){(iii)} consent"{responding does} affirmative consent to an act or practice is not include:inferred from the inaction of the user {input with information that purports to be human-like personal details or stories about } or the user's continued use of a companion chatbot{;

(i) acceptance of a general or broad terms of use or similar document;

(ii) hovering over, muting, pausing, or closing a given piece of content;or (iii) an agreement obtained through the use of a false, fraudulent, or materially misleading statement or representation{;

{(iv)- {an15 agreement- obtainedHB0438 throughcompared thewith useHB0438S05 of{(C) a{explicitly darkreferring pattern.}to }a (3)chatbot's "Applicationpurported programmingemotions interface"in means a setmanner of protocols, tools, or specifications that allowsimplies softwarethe systemschatbot tohas communicateemotions.} with} one(b) another{"AI andcompanion throughchatbot} which"Affirmative aconsent" thirddoes partynot mayinclude access,{a integrate,chatbot} or: build upon an artificial intelligence system's underlying capabilities.

(2){(4)}{(i) "Artificial{used intelligence"by meansa business solely for:} } {(A) {customer service or to provide users with information about available commercial services or products provided by the samebusiness, ascustomer thatservice termaccount isinformation, definedor inother Sectioninformation 13-72-101.related to customer service;

(5)or} (3){(a)}} "Companion{(B) chatbot"{internal meanspurposes anor artificialemployee intelligenceproductivity;} system} that{(ii) uses{integrated into a naturalvideo languagegame, interfaceif:} that:} {(A) {the AI agent's interactions with the user are functionally integral to the gameplay, narrative, or fictional universe of the video game;

(a){(i)}and} {uses } {(B) {the AI agent is not designed to usefunction personalas dataa retained,primary stored,source orof retrievedemotional fromsupport aor priorpersonal interactioncompanionship andfor {generatesthe }user generateindependent anof outputthe that:video game's content;

(i){(A)}or} simulates} {a{(iii) {that is primarily designed and marketed for use by developers or researchers.} } an(i) ongoingacceptance relationshipof witha thegeneral user;or broad terms of use or similar document;

or(ii) (ii){(B)}hovering indicatesover, themuting, companionpausing, chatbotor hasclosing emotions,a feelings,given memories,piece orof personalcontent; opinions;

{and}or (b){(ii)}(iii) {generatesan }agreement isobtained designedthrough tothe generateuse anof outputa containingfalse, anfraudulent, affective or socialmaterially inquirymisleading that:statement or representation.

(i){(A)}(3) is"Application notprogramming logicallyinterface" requiredmeans a set of protocols, tools, or specifications that allows software systems to resolvecommunicate with one another and through which a userthird promptparty may access, integrate, or task-basedbuild command;upon an artificial intelligence system's underlying capabilities.

or(3){(4)} (ii){(B)}"Artificial prioritizesintelligence" extensionmeans of the interactionsame overas taskthat resolution{.}term ;is defined in Section 13-72-101.

and(5) (iii)(4){(a)} holds{"Chatbot} itself"Companion outchatbot" asmeans primarilyan usefulartificial forintelligence providing{technology companionship} orsystem anthat ongoing{engages socialin orinteractive emotionalconversations relationship with } uses a {user of the user.chatbot.} natural language interface that:

(i) is designed to use personal data retained, stored, or retrieved from a prior interaction and generate an output that:

(A) simulates an ongoing relationship with the user;

or (B) indicates the companion chatbot has emotions, feelings, memories, or personal opinions;

(ii) is designed to generate an output containing an affective or social inquiry that:

- 16 - HB0438 compared with HB0438S05 (A) is not logically required to resolve a user prompt or task-based command;

or (5){(B)} {"Chatbot } prioritizes extension of the interaction{" means a user input } over task resolution;

and {a chatbot response.} (iii) holds itself out as primarily useful for providing companionship or an ongoing social or emotional relationship with the user.

or - 15 - HB0438S01 compared with HB0438S05 (ii) is marketed or offered exclusively to businesses, employers, or institutions or through an application programming interface.

(4){(6)}(6) "Core functioning" means features and services for which the collection or processing of the user's personal data is reasonably necessary to provide the companion chatbot service to the user.

{(5) {"Dark pattern" means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, and includes any practice the Federal Trade Commission refers to as a "dark pattern."} } (6){(7)} "Division" means the Division of Consumer Protection created in Section 13-2-1.

(7){(8)}{(7) "Interaction"{"Highly meanssensitive ainformation" usermeans:} input} and{(a) {information about a subsequentUtah responseuser's personal finances;} } {(b) {information provided by a companionUtah chatbot.user relating to any legal matter involving the Utah user;

(8){(9)}or} "Material} harmful{(c) to{individually minors"identifiable health information.} } (8) {"Human-chatbot conversation} "Interaction" means a {sequence of chatbot interactions whether through } user input and a {single user engagement with the samechatbot asor that} termsubsequent isresponse definedby ina Section{series 76-5c-101.of user engagements with the } companion chatbot.

(9){(10)}{(9) "Minor"{"Individually identifiable health information" means any information that relates to the physical or mental health or condition of an individualindividual.} under} 18(10){(9)} years"Material oldharmful {that}to who:minors" means the same as that term is defined in Section 76-5c-101.

(11){(10)} "Minor" means an individual under 18 years old{.} who:

(10){(11)}(12){(11)} "Office" means the Office of Artificial Intelligence Policy created in Section 13-72-201.

(11){(i)}(i) {"Operator" means a person who } makes a companion chatbot available to a user in the state{.}state; ;

- 17 - HB0438 compared with HB0438S05 (b) "Operator" does not include a person who merely provides:

(12){(13)}(13) "Personal data" means the same as that term is defined in Section 13-61-101.

(13){(14)}{(14) "Sensitive{"Safety-critical data"situation" means thea sameuser asinteraction or pattern of user interactions that termwould lead a reasonable person to conclude that:} } {(a) {a Utah user is definedexpressing inthoughts, Sectionplans, 13-61-101.or intent related to:} } {(i) {self-harm or suicide;} } {(ii) {violence or criminal behavior;

(14){(15)}or} "Targeted} advertising"{(iii) means{abuse of alcohol or illicit substances;} } {(b) {a Utah user is exhibiting a pattern of communicative behavior indicative of:} } {(i) {progressive social withdrawal, including a stated intent to reduce contact with family or friends in favor of the samechatbot;} as} {(ii) {psychological dependency, where the user expresses that termthe chatbot is defineda inprimary Sectionsource 13-61-101.of emotional support;} } {(iii) {acute or progressively worsening mental health symptoms, including expressions of severe depression, anxiety, paranoia, delusion, or diminished decision-making capacity;

(15){(16)}or} "User"} means{(iv) an{disordered individualeating who:behaviors;

(a)and} interacts} with{(c) {the context of the human-chatbot conversation indicates that a companionresponsive chatbot;output affirming, encouraging, or normalizing the user's behavior would pose a reasonably foreseeable risk of harm.} } (15){(14)} {"Supplier} "Sensitive data" means the same as that term is defined in Section {13-11-3} 13-61-101.

and{(16) (b){"Third isparty" means a person other than:} } {(a) {the supplier;} } {(b) {the Utah resident.user;

or} } {(c) {a service provider acting on behalf of the supplier to provide services directly related to the operation of the AI companion chatbot.} } (15) "Targeted advertising" means the same as that term is defined in Section 13-61-101.

(17){(16)} "User" means an individual who {interacts with a chatbot.} :

- 18 - HB0438 compared with HB0438S05 (18){(a)} {"User input" means a prompt or response of } interacts with a {user to an AI } companion chatbot{.} ;

and (19){(b)} {"Utah user" means a user who } is a Utah resident.

- 16 - HB0438S01 compared with HB0438S05 13-72b-201.

{(Effective 05/06/26)}(Effective 08/01/26)Safety08/01/26){Design and safety protocols} Safety requirements for users.

{Design, } Safety {Protocols, Monitoring, and Reporting} Requirements (1){(1) An{A operatorsupplier shall complyimplement withand themaintain requirementscommercially reasonable safety protocols, informed by expert guidance and state-of-the-art of Chaptertechnology, 61,designed to identify and mitigate safety-critical situations.} } {(2) {The safety protocols described in Subsection (1) shall include:} } {(a) {technical measures to analyze a Utah Consumeruser's Privacyinput Act,throughout including:a human-chatbot conversation to identify patterns of behavioral or mental health deterioration, including those indicative of safety- critical situations, rather than solely analyzing isolated user inputs, to the extent that the user's interaction history with the AI companion chatbot is accessible to the AI companion chatbot at the time of the interaction;

(a)and} allowing} a{(b) user{the tomethodology obtainby awhich copy of the {user'ssupplier interactionsidentifies:} with } prompts{(i) provided{safety-critical tosituations; a companion chatbot that are retained by the operator in a format that is portable and readily usable in accordance with Section 13-61-201;

andand} (b) {obtaining } complying{(ii) with{responses thethat requirementsdo ofnot Sectionaggravate 13-61-302 with respect to the processingsafety-critical ofsituation.} a} user's(1) {affirmativeAn consentoperator beforeshall processingcomply with the user'srequirements }of sensitiveChapter data61, {inUtah accordanceConsumer withPrivacy SectionAct, 13-61-302}including: .

(2)(3){(a)} An{A operatorsupplier shallcomplies preventwith } allowing a user to obtain a copy of the {requirement } prompts provided to {mitigate } a {safety-critical situation described in Subsection (1) if the supplier's AI } companion chatbotchatbot{:} fromthat engagingare withretained by the operator in a userformat unless:that is portable and readily usable in accordance with Section 13-61-201;

and {(a) {declines to generate content that encourages or affirms any behavior that would aggravate the safety-critical situation;

or} } {(b) {provides a response that is effectively neutral or that avoids aggravating the safety-critical situation.} } {(4) {A supplier's failure to identify or mitigate a specific instance of a safety-critical situation does not constitute a violation of this section if the supplier demonstrates that:} } - 19 - HB0438 compared with HB0438S05 {(a) {the supplier implemented the protocols required by Subsection (2) in good faith;} } {(b) {the protocols indicate a concerted effort on the part of the supplier to employ effective safety measures considering the evolving nature of artificial intelligence technology;

and} } (b) complying with the requirements of Section 13-61-302 with respect to the processing of a user's sensitive data.

(c){(2)} {the supplier consistently applies the protocols in the supplier's operation of } An operator shall prevent the {AI } companion chatbot{.} from engaging with a user unless:

(2){(3)}(3) An operator may not {advertise a specific product or service to the } display an advertisement to a user, unless the operator clearly and conspicuously{,conspicuously in the companion chatbot's interaction with the user:} identifies the advertisement as an advertisement.

{(a)Section {identifies6. the advertisement as an advertisement;

and} } {(b) {discloses to the user any sponsorship, business affiliation, or agreement that the operator has with a person to promote, advertise, or recommend the advertised product or service.} } Section 6.

{(Effective 05/06/26)}(Effective 08/01/26)Additional08/01/26){Monitoring safety} requirementsAdditional forsafety requirementsfor minor users.

(a) provide a clear and conspicuous notice to the user at least once every {hour } three hours during a continuing chatbot interaction that:

(i) reminds the user to take a break{;}break from interacting with the companion chatbot;

and - 17 - HB0438S01 compared with HB0438S05 (ii) {discloses } states that the user is {not } interacting with an artificial intelligence system, not a human;

and {(iii)(b) {statesopt thatout, usingby adefault, companion chatbot may not be suitable for a minor;} } {(b) {prevent the companionuser chatbot from engagingtargeted withadvertising. the user unless:} } {(i) {the operator prevents production of suicidal ideation, suicide, or self-harm content to the user;

and} } {(ii) {if the user expresses suicidal ideation, suicide, or self-harm, the companion chatbot provides to the user:} } {(A) {resources including a referral to crisis service providers;

and} } {(B) {a suicide hotline or crisis text line;

and} } (c){(b)} opt out, by default, the user from targeted advertising.

{(a)(a) {produce or provide material harmful to minors;} } (b){(a)} produce, provide, or direct a user to material harmful to minors;

{(c) {encourage the user to:} } {(i) {use illegal substances;} } {(ii) {consume alcohol;} } (b) collect data from the user that is not required for core functioning of the companion chatbot;

or - 20 - HB0438 compared with HB0438S05 (e) otherwise convey a user's personal data unless a parent or legal guardian of the user has provided affirmative consent, except as required for core functioning of the companion chatbot.

(iii){(a)}(a) use illegal substances, alcohol, or a tobacco or nicotine product;

(iv){(b)}(b) engage in sexual conduct;

(v){(c)}(c) engage in self-harm;

{or}(d) (vi){(d)} engage in illegal conduct;

or - 18 - HB0438S01 compared with HB0438S05 (f) engage in activities that are lawful for adults but pose a material risk of serious harm to a minor, including age-restricted challenges, stunts, or risky behaviors.

(d){(a)}(a) {direct targeted advertising to the user unless } offer a parent or legal guardian of the user {has provided affirmative consent;} accessible tools to:

(e){(ii)}(ii) {collect data from } control whether the {user that } user's personal data is {not required for core functioning of } used to train the companion chatbot;

and (f){(iv)}(1){(iv)} {sell{A asupplier of an AI } disable the user's {personal data} access to the companion chatbot;chatbot {shall:} ;

{or}{(a) (b){assess, takeusing reasonable stepsmethods and to ensurethe thatextent atechnically parentfeasible, orthe legalefficacy guardian of the usersafety isprotocols awarein ofdetecting theand toolsmitigating describedsafety-critical insituations;} Subsection} (4)(a),{(b) including{generate throughaggregated directestimates communicationsof reasonablyuser engagement, calculated toseparately reachfor users who are minors and users who are adults, using a parentstatistically orvalid legalmethodology guardian;disclosed in accordance with Section 13-72b-203, sufficient to identify for each group:} } {(i) {the median hours of use and number of chatbot interactions;

and} } {(ii) {the 90th percentile of hours of use and (g){(c)}number {otherwiseof conveychatbot interactions, or a user'ssimilar personalquantification dataof unlesstypical usage of the most engaged users;} } provide(b) timelytake noticereasonable steps to ensure that a parent or legal guardian of the user {hasis providedaware affirmativeof consent}the iftools thedescribed userin modifiesSubsection or(4)(a), disablesincluding athrough settingdirect previouslycommunications configuredreasonably bycalculated theto reach a parent or legal guardianguardian; under Subsection (4)(a).

(3){(5)}and The(c) requirementsprovide of{a thismechanism sectionfor area inUtah addition} timely notice to a parent or legal guardian of the requirementsuser {to report to } if the {supplier any safety-critical situation } user modifies or {concerning chatbot response - 21 - HB0438 compared with HB0438S05 from } disables a setting previously configured by the {Utah user's use of Sectionthe 13-72b-201.AI companion chatbot;

and} parent or legal guardian under Subsection (4)(a).

{(d) {beginning May 1, 2027, facilitate independent evaluation of the safety protocols by:} } {(i) {commissioning an independent assessment by a qualified third party that:} } {(A) {applies generally accepted industry standards for AI safety and risk management, at least as rigorous as the Artificial Intelligence Risk Management Framework established by the National Institute of Standards and Technology in January 2023, or any successor standard;} } {(B) {has not provided consulting, product design, or engineering services to the supplier within the 12 months preceding the assessment;

and} } {(C) {certifies that the qualified third party has no financial interest in the outcome of the assessment;

or} } {(ii) { providing reasonable accommodations to allow independent research evaluations.} } {(2) {With respect to the independent research evaluations described in Subsection (1)(d)(ii), a supplier may:} } {(a) {restrict access to qualified researchers who are affiliated with an accredited institution of higher education or a nonprofit research organization;} } {(b) {require researchers to agree to reasonable confidentiality and data security agreements;

and} } {(c) {limit access to a secure data environment or physical location controlled by the supplier to prevent the unauthorized export of personal data.} } {(3) {In preparing the aggregated estimates of user engagement as required by Subsection (1)(b), a supplier may rely on:} } {(a) {a user account if the user has an account;} } {(b) {the internet protocol address of a device used to access an AI companion chatbot, if there is no user account;

or} } {(c) {another method that the supplier reasonably ascertains to be at least as effective as the methods described in Subsections (3)(a) and (b).} } {(4) {A supplier may satisfy the requirement in Subsection (1)(b) by using data derived from the supplier's entire user base or a relevant geographic subset that includes Utah users.} } (5) The requirements of this section are in addition to the requirements of Section 13-72b-201.

Section 6.

Section 6 is enacted to read:

13-72b-203.

Public disclosure requirements.

- 22 - HB0438 compared with HB0438S05 (1) A supplier of an AI companion chatbot shall make publicly available on the supplier's website clear and conspicuous disclosures, not less than quarterly, on:

(a) the safety protocols implemented by the supplier under Section 13-72b-201 and an assessment of the efficacy of the safety protocols in ensuring appropriate responses to safety-critical situations that are consistent with how a reasonable person would respond;

(b) any protocols in place to detect safety-critical situations and an assessment of their efficacy, including a detailed description of how the assessment was made;

(c) a report of the findings of any assessments conducted under Subsection 13-72b-202(1)(d);

(d) the estimates generated under Subsection 13-72b-202(1)(b) and a description of the methodology used;

and (e) the number and type of safety-critical situations or inappropriate chatbot responses reported by Utah users through the mechanism provided in accordance with Subsection 13-72b-202(1)(c).

(2) The disclosures required by Subsection (1) may not include any personal data of a Utah user.

(3) The Office of Artificial Intelligence Policy may, in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, make rules establishing the form and content of the disclosures required by this section.

(4) The office may monitor, audit, and verify the accuracy and completeness of a public disclosure described in this section.

{(Effective 05/06/26)}(Effective 08/01/26)Division08/01/26){Supplier requirements and prohibitions} Division rulemaking.

3.{3.

RulemakingConsumer andProtections Reportingfor InUsers accordanceof withAI TitleCompanion 63G,Chatbots} Chapter{(1) 3,{A Utahsupplier Administrativeof Rulemakingan Act,AI thecompanion divisionchatbot may makenot:} rules} establishing{(a) reasonable{introduce agematerial assuranceharmful standardsto thatminors aninto operatora maychatbot meetinteraction of a Utah user who is a minor;} } {(b) {permit a Utah user who is a minor to qualifyaccess formaterial harmful to minors;} } {(c) {send to a Utah user any text, email, or push notification to encourage further engagement of the safeUtah harboruser describedwith inthe SectionAI 13-72b-402,companion includingchatbot, standardswithout for:the affirmative consent of the Utah user;} } {(d) {sell to any third party any highly sensitive information of a Utah user;} } {(e) {sell to any third party any personal data or highly sensitive information of a Utah user who is a minor;

(1)or} third-party} age- assurance23 services;- HB0438 compared with HB0438S05 {(f) {introduce paid commercial content or sponsored product placements into a human-chatbot conversation with a Utah user who is a minor, unless the content is generated in direct response to a specific user input requesting information or advice that is directly related to the commercial content that the supplier introduces into the human-chatbot conversation.} } {(2) {A supplier shall provide a Utah user with readily accessible and easy-to-use options to delete:} } {(a) {the user's account, if applicable;

(2)and} protecting} user{(b) privacy{any andpersonal data security;or highly sensitive information associated with the account or otherwise reasonably retrievable by the supplier.} } {(3) {A supplier shall make publicly available on the supplier's website clear and conspicuous disclosures that include:} } 3.

(3)Rulemaking verifyingand Reporting In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the reliabilitydivision andmay accuracymake ofrules establishing reasonable age assurance methods;standards that an operator may (a) {a description of } meet to qualify for the {known risks associated with use of the AI companion chatbot} safe harbor described in Section 13-72b-402, includingstandards for:

{(i) {potential for social isolation;} } {(ii) {potential impacts on mental health;} } {(iii) {limitations of the AI companion chatbot's capabilities;

and} } {(iv) {circumstances under which users should seek assistance from human professionals;} } {(b) {a description of the types of data collected from Utah users;} } {(c) {a description of how user data is used, stored, and protected;} } {(d) {the supplier's policies regarding data sharing with third parties;} } {(e) {information about how Utah users may:} } {(i) {access their data;} } (1) third-party age assurance services;

(ii){(2)} {request deletion of their } protecting user privacy and datasecurity;

{and} {(iii) {withdraw consent for data processing;

and} } {(f) {contact information for submitting complaints or concerns about the AI companion chatbot.} } {(4) {The disclosures required under Subsection (3) shall:} } {(a) {be written in plain, easily understandable language;

and} } {(b) {be readily accessible from the main page of the supplier's website.} } - 24 - HB0438 compared with HB0438S05 (3) verifying the reliability and accuracy of age assurance methods;

{(Effective 05/06/26)}(Effective 08/01/26)Office08/01/26){Disclosure rulemakingandof artificial intelligence and statement of limitations} Office rulemaking and reporting.

-(1) 19 - HB0438S01 compared with HB0438S05 In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the office may make rules establishing the form of the report required in Section 13-72b-303.

{office(2) mayThe makeoffice rules:}shall {(1)study {establishingand report to the formBusiness ofand Labor Interim Committee at the reportNovember requiredinterim inmeeting Sectionon 13-72b-303;standards relating to:

and}(1){(a)} }{A {(2)supplier {establishingshall standardsclearly anand operatorconspicuously maydisclose meet to qualifya forUtah theuser safethat harborthe describedAI in} Sectiondesign 13-72b-402,features including:}that }prevent (2)a Thecompanion officechatbot shall{is studyan andartificial reportintelligence totechnology theand Businessnot and} Laborfrom Interimengaging Committeein ator thereciprocating Novemberuser interimattempts meetingto onestablish standardsa relating{human.} to:relationship;

(a){(2) design{The featuresdisclosure thatdescribed preventin aSubsection companion(1) shall be made:} } {(a) {in a chatbot frominteraction engagingwith inthe orUtah reciprocatinguser;} } (b) {the first time a Utah user attemptsinteracts with an AI } measures or methods to establishlimit a relationship;user's emotional and social attachment to a companion chatbot;and {(c) {at the beginning of any interaction with the Utah user if the Utah user has not accessed the AI companion chatbot within the previous seven days;

(a){(b)}and} {methods} that{(d) }{any measurestime a Utah user asks or methodsotherwise prompts the AI companion chatbot about whether artificial intelligence is being used.} } {(3) { A supplier is not subject to limitan aenforcement user'saction emotionalfor violating Section 13-72b-301 if the supplier's AI companion chatbot clearly and socialconspicuously attachmentdiscloses tothroughout a companionhuman-chatbot chatbot;andconversation (b){(c)}that measuresit is artificial intelligence and processesnot {thathuman.} an} operator(c) maymeasures implementand }processes to reduce mental and physical risk to a user{;user.

and}Section .9.

{(c) {disclosure, transparency, and reporting requirements relevant to Subsections (2)(a) and (b).} } Section 9.

{(Effective 05/06/26)}(Effective 08/01/26)Reporting08/01/26){Safe harbor for non-companion applications} Reporting requirements.

(1){(1) An{A operatorsupplier shallof annuallya reportchatbot tois not liable under this chapter if the office:supplier demonstrates that the chatbot:} } - 25 - HB0438 compared with HB0438S05 {(a) {is not marketed, promoted, or deliberately designed to function as a friend, romantic partner, or source of psychological companionship;

(a)and} the} number{(b) of{incorporates timesactive theboundary operatorreinforcement hasprotocols issuedthat aare crisisreasonably servicedesigned providerto:} referral} notification{(i) {refuse to engage in accordanceor withreciprocate Sectionuser {13-72b-202attempts to establish a sustained, personal social relationship or exclusive emotional bond;} } 13-72b-201{(ii) in{maintain thea precedingconversational calendartone year;that is primarily service-oriented, functional, or creative, rather than personally intimate;

(b)and} methods} the(1) An operator hasshall implementedannually toreport detect, remove, and respond to expressionsthe ofoffice: suicidal ideation, suicide, or self-harm by users;

and(a) (c)the methodsnumber of times the operator has implementedissued to prevent a companioncrisis chatbotservice {responseprovider aboutreferral }notification fromin generatingaccordance responseswith thatSection encourage13-72b-201 suicidalin ideation , suicide, or {actions with the user}preceding self-harm.calendar year;

(iii){(b)} {ensure } methods the {chatbot does not unilaterally initiate unprompted } operator has implemented to detect, remove, and respond to expressions of {personal affection} suicidal ideation, {emotional need} suicide, or {longing toward the user.} self-harm by users;

and {(2) {A supplier that satisfies the conditions described in Subsection (1) is not liable under this chapter solely because the chatbot is designed to:} } {(a) {use polite, empathetic, or conversational language to facilitate user interaction;

or} } {(b) {engage in temporary role-play scenarios at the explicit direction of the user for creative or entertainment purposes, provided the chatbot reverts to a non-companion persona upon the conclusion of the specific task.} } (c) methods the operator has implemented to prevent a companion chatbot from generating responses that encourage suicidal ideation, suicide, or self-harm.

{(Effective 05/06/26)}(Effective 08/01/26)Enforcement.08/01/26){Division enforcement powers} Enforcement.

{Division } Enforcement {Powers} and Safe Harbor (1) The division shall administer and enforce the provisions of this chapter in accordance with Chapter 2, Division of Consumer Protection.

-(2){(3)} 20 - HB0438S01 compared with HB0438S05 (3) In addition to the division's enforcement powers under Chapter 2, Division of Consumer Protection:

- 26 - HB0438 compared with HB0438S05 (a) the division director may impose an administrative fine of up to $2,500 for each violation of this chapter;chapter;and {(b) {for a violation of Section 13-72b-203, the division director may impose an administrative fine of up to $2,500 for each element required to be disclosed under Section 13-72b-203 that the supplier fails to disclose, for each day that the element is not disclosed;} } {(c) {for a violation of Subsection 13-72b-301(3), the division director may impose an administrative fine of up to $2,500 for each element required to be disclosed under Subsection 13-72b-301(3) that the supplier fails to disclose, for each day that the element is not disclosed;

andand} (b)} (d){(b)} the division may bring an action in a court of competent jurisdiction to enforce a provision of this chapter.

(4)(3){(4)} In a court action by the division to enforce a provision of this chapter, the court may:

(5)(4){(5)} If a court awards judgment or injunctive relief to the division, the court shall award the division:

(6)(5){(6)} A court may impose a civil penalty of no more than $50,000 for each violation of an administrative or court order issued for a violation of this chapter.

(7)(6){(7)} A civil penalty authorized under this section may be imposed in a civil action.

(8)(7){(8)} The division shall deposit all fines and civil penalties collected under this section into the Consumer Protection Education and Training Fund created in Section 13-2-8.

(9)(8){(9)} Nothing in this chapter {shall displace } displaces any other available {remedies } remedy or {rights } right authorized under the laws of this state or the United States.

{(EffectiveSafe 05/06/26)}(Effective 08/01/26)Safe harbor.

- 27 - HB0438 compared with HB0438S05 (1) An operator bears the burden of demonstrating by clear and convincing evidence that the operator qualifies for {a } the safe harbor described in this section.

- 21 - HB0438S01 compared with HB0438S05 {(3) {An operator is not liable for a violation of this chapter if the operator meets the standards established by office rule made in accordance with Subsection 13-72b-302(2).} } Section 12.

{Section 12.

Section 63I-2-213 is amended to read:

} 63I-2-213.

Repeal dates:

Title 13.

(1) Title 13, Chapter 47, Private Employer Verification Act, is repealed on the program start date, as defined in Section 63G-12-102.

(2) Title 13, Chapter 72, Artificial Intelligence Policy Act, is repealed July 1, 2027.

(3) Title 13, Chapter 72b, Part 2, Design, Safety Protocols, Monitoring, and Reporting, is repealed May 6, 2029.

{(2) {The actions affecting Section 13-2-1 (Effective 07/01/26) take effect on July 1, 2026.} } 3-5-26 6:52 PM - 2228 -