EveryAILaw.com

Requirements at a glance

This regulation imposes 14 specific requirements for Record-Keeping & Documentation across 3 provisions:

• Defense policy — To qualify, create, maintain and implement a written policy covering intended purposes, therapist involvement, clinical best practices, testing, risk identification, user reporting, acute-risk protocols, safety reviews, safe-use instructions, AI-awareness disclosure, engagement-over-safety prohibition, non-discrimination, HIPAA compliance
• Documentation — To qualify, maintain documentation of foundation models used, training data, HIPAA compliance, user data practices, ongoing accuracy/safety efforts
• Filing — To claim the defense, file the required policy and supplier/chatbot information with the Division of Consumer Protection in its required manner and pay the filing fee (§58-60-118(4)); the Division may impose an annual filing fee (§58-60-118(5)(b))
• Compliance condition — To qualify, comply with all requirements of the filed policy at the time of the alleged violation (§58-60-118(2)(d))
• Defense limits — The defense does not bar the Division from bringing the specified enforcement action, does not recognize a chatbot as a licensed therapist, and does not displace separate Chapter 72a consumer-protection duties (§58-60-118(6)-(7))
• Participant eligibility — Five prongs per §13-72-402: technical capability, financial resources, substantial consumer benefits outweighing risks, risk-monitoring plan, appropriately-limited scope
• Agreement contents — Scope limits, safeguards, mitigation granted, required consumer disclosures, reporting requirements (§13-72-401(4))
• Counterparties — OAIP + relevant state agency or governmental entity (judiciary, higher-ed, political subdivisions per HB 320)
• Term — Initial 12 months + up to 2 × 12-month extensions (36 months total per §13-72-403)
• Mandatory audits — OAIP "shall perform regular audits" while agreement is active (§13-72-401(6), HB 320)
• Agreement types — Regulatory mitigation (waives specified law) or joint interpretation (clarifies statute application to AI)
• Annual report — Annually before November 30 to Business & Labor Interim Committee: learning agenda, findings/participation/outcomes, executed agreements, and recommended legislation from Lab findings (§13-72-201(3)(d)); the provision does not mandate replacement enactment
• Civil (§13-75-102) — "Not a defense" that GenAI made the violative statement, undertook the violative act, or was used in furtherance
• Criminal (§76-2-107) — Principal may be found guilty if they commit offense "with the aid of" or "intentionally prompt" GenAI to commit offense