Required only for "high-risk AI interactions" (§13-75-101(5)): sensitive data (health/financial/biometric) or personalized advice in finance/legal/medicine/mental health
Verbal at start
Required at start of oral exchange
Written before start
Required in electronic messaging before written exchange
Penalties
Violation
Fine
Same as general disclosure
$2,500 admin / $2,500 court / $5,000 order violation
Mental health chatbot suppliers seeking the affirmative defense to administrative or civil liability alleged under §58-1-501(1) or (2); policy/documentation/filing duties here are conditions of that defense (§58-60-118(2),(6)), not a universal supplier mandate
The defense does not bar an enforcement action or license a chatbot as a therapist (§58-60-118(7)); separate Chapter 72a consumer-protection duties remain applicable
Requirements
Requirement
Details
Defense policy
To qualify, create, maintain and implement a written policy covering intended purposes, therapist involvement, clinical best practices, testing, risk identification, user reporting, acute-risk protocols, safety reviews, safe-use instructions, AI-awareness disclosure, engagement-over-safety prohibition, non-discrimination, HIPAA compliance
Documentation
To qualify, maintain documentation of foundation models used, training data, HIPAA compliance, user data practices, ongoing accuracy/safety efforts
Filing
To claim the defense, file the required policy and supplier/chatbot information with the Division of Consumer Protection in its required manner and pay the filing fee (§58-60-118(4)); the Division may impose an annual filing fee (§58-60-118(5)(b))
Compliance condition
To qualify, comply with all requirements of the filed policy at the time of the alleged violation (§58-60-118(2)(d))
Defense limits
The defense does not bar the Division from bringing the specified enforcement action, does not recognize a chatbot as a licensed therapist, and does not displace separate Chapter 72a consumer-protection duties (§58-60-118(6)-(7))
Penalties
Violation
Fine
Affirmative defense
Limited to administrative or civil actions alleging §58-1-501(1) or (2); it does not bar the Division from bringing such an action and does not extend to separate Chapter 72a consumer-protection liability (§58-60-118(6)-(7))
OAIP + relevant state agency or governmental entity (judiciary, higher-ed, political subdivisions per HB 320)
Term
Initial 12 months + up to 2 × 12-month extensions (36 months total per §13-72-403)
Mandatory audits
OAIP "shall perform regular audits" while agreement is active (§13-72-401(6), HB 320)
Agreement types
Regulatory mitigation (waives specified law) or joint interpretation (clarifies statute application to AI)
Annual report
Annually before November 30 to Business & Labor Interim Committee: learning agenda, findings/participation/outcomes, executed agreements, and recommended legislation from Lab findings (§13-72-201(3)(d)); the provision does not mandate replacement enactment
EveryAILaw.com