1. (1) As used in this section:

   1. (a) "Mental health chatbot" means the same as that term is defined in Section 13-72a-101.
   2. (b) "Supplier" means the same as that term is defined in Section 13-11-3.

2. (2) It is an affirmative defense to liability in an action brought under Subsection 58-1-501(1) or Subsection 58-1-501(2) if the supplier demonstrates that the supplier:

   1. (a) created, maintained, and implemented a policy that meets the requirements of Subsection (3);

   2. (b) maintains documentation regarding the development and implementation of the mental health chatbot that describes:

      1. (i) foundation models used in development;
      2. (ii) training data used;
      3. (iii) compliance with federal health privacy regulations;
      4. (iv) user data collection and sharing practices; and
      5. (v) ongoing efforts to ensure accuracy, reliability, fairness, and safety;
   3. (c) filed the policy with the division as described in Subsection (4); and
   4. (d) complied with all requirements of the filed policy at the time of the alleged violation.

3. (3) A policy described in Subsection (2)(a) must:

   1. (a) be in writing;

   2. (b) clearly state:

      1. (i) the intended purposes of the mental health chatbot; and
      2. (ii) the abilities and limitations of the mental health chatbot; and

   3. (c) describe the procedures by which the supplier:

      1. (i) ensures that licensed mental health therapists are involved in the development and review process;
      2. (ii) ensures the mental health chatbot is developed and monitored in a manner consistent with clinical best practices;
      3. (iii) conducts testing, prior to making the mental health chatbot publicly available and regularly thereafter, to ensure that the output of the mental health chatbot poses no greater risk to a user than that posed to an individual in therapy with a licensed mental health therapist;
      4. (iv) identifies reasonably foreseeable adverse outcomes to, and potentially harmful interactions with, users that could result from using the mental health chatbot;
      5. (v) provides a mechanism for a user to report any potentially harmful interactions from use of the mental health chatbot;
      6. (vi) implements protocols to assess and respond to risk of harm to users or other individuals;
      7. (vii) details actions taken to prevent or mitigate any such adverse outcomes or potentially harmful interactions;
      8. (viii) implements protocols to respond in real time to acute risk of physical harm;
      9. (ix) reasonably ensures regular, objective reviews of safety, accuracy, and efficacy, which may include internal or external audits;
      10. (x) provides users any necessary instructions on the safe use of the mental health chatbot;
      11. (xi) ensures users understand they are interacting with artificial intelligence;
      12. (xii) ensures users understand the intended purpose, capabilities, and limitations of the mental health chatbot;
      13. (xiii) prioritizes user mental health and safety over engagement metrics or profit;
      14. (xiv) implements measures to prevent discriminatory treatment of users; and
      15. (xv) ensures compliance with the security and privacy provisions of 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A, C, and E, as if the supplier were a covered entity, and applicable consumer protection requirements, including Sections 13-72a-201, 13-72a-202, and 13-72a-203.

4. (4) To file a policy with the division under this section, a supplier of a mental health chatbot:

   1. (a) shall provide to the division:

      1. (i) the name and address of the supplier;
      2. (ii) the name of the mental health chatbot supplied by the supplier;
      3. (iii) the written policy described in Subsection (3); and
      4. (iv) a fee set in accordance with Section 63J-1-504;
   2. (b) shall file in a manner established by the division; and

   3. (c) may provide to the division:

      1. (i) any revisions to a policy filed under this section; or
      2. (ii) any other documentation the supplier elects to provide.

5. (5) The division:

   1. (a) shall provide a means for a supplier of a mental health chatbot to file under this section; and
   2. (b) may impose an annual filing fee set in accordance with Section 63J-1-504.

6. (6) The affirmative defense described in this section applies only in an administrative or civil action alleging a violation of:

   1. (a) Subsection 58-1-501(1); or
   2. (b) Subsection 58-1-501(2).

7. (7) Nothing in this section shall be construed to:

   1. (a) bar the division from bringing an action under Subsection 58-1-501(1) or Subsection 58-1-501(2) against the supplier of a mental health chatbot; or
   2. (b) recognize a mental health chatbot as a licensed mental health therapist.

Enacted by Chapter 269, 2025 General Session