In effectSB 149 (2024); amended by SB 226, HB 452, SB 332 (2025) and HB 320 (2026)Utah
Utah Artificial Intelligence Policy Act for Healthcare
How Utah Artificial Intelligence Policy Act applies to healthcare organizations and the obligations to plan for.
Effective
May 7, 2025
Max penalty
$5K
Applies to
deployer + vendor
Why this law matters for healthcare
Healthcare providers, payers, and health-tech vendors deploying AI for clinical decision support, diagnostics, prior authorization, or patient interaction.
Licensed healthcare providers using generative AI in patient-facing high-risk medical or mental-health advice interactions must disclose AI use under Utah Chapter 77; mental-health chatbots also need Chapter 72a controls. Organizations operating in Utah should treat this law as part of the baseline regulatory obligations alongside any sector-specific federal rules.
Key obligations
disclosure→ deployerUtah Code § 13-77-103
A supplier using generative AI in a consumer transaction must disclose that the individual is interacting with generative AI and not a human when the individual makes a clear and unambiguous request about whether AI is being used; regulated-occupation providers must prominently disclose GenAI use for high-risk AI interactions, verbally at the start of verbal interactions or in writing before written interactions.
Maintain accountability for consumer-protection compliance when generative AI makes a violative statement, undertakes a violative act, or is used in furtherance of a violation; Chapter 77 states that generative AI is not a defense to statutes administered and enforced by the Division of Consumer Protection.
Deadline: ongoing
data handling→ vendorUtah Code § 13-72a-201
Mental health chatbot suppliers may not sell or share individually identifiable health information or a Utah user's chatbot input with a third party, and must keep Chapter 72a privacy controls separate from the general Chapter 77 consumer-transaction disclosure rule.
Deadline: ongoing
disclosure→ vendorUtah Code § 13-72a-203
Mental health chatbot suppliers must clearly and conspicuously disclose that the chatbot is artificial intelligence technology and not human before features are accessed, at the beginning of an interaction after a seven-day gap, and whenever a Utah user asks or prompts about whether AI is being used.
Inventory AI systems used in healthcare workflows that may fall within Utah Artificial Intelligence Policy Act's scope.
Map each system against the obligations above and identify the responsible role (developer vs deployer).
Adopt a structured framework — see NIST AI RMF and ISO/IEC 42001 — to demonstrate due care and produce audit-ready evidence.
Document obligations satisfied and gaps in a single register, refreshed at the cadence required by the law (typically annual).
Frequently asked questions
Does Utah Artificial Intelligence Policy Act apply to healthcare organizations?
Licensed healthcare providers using generative AI in patient-facing high-risk medical or mental-health advice interactions must disclose AI use under Utah Chapter 77; mental-health chatbots also need Chapter 72a controls. The law should be read with the source-derived obligations listed on this page and any sector-specific federal rules that apply to healthcare workflows.
When does Utah Artificial Intelligence Policy Act take effect for healthcare use cases?
Utah Artificial Intelligence Policy Act has been effective since May 7, 2025.
Who carries the compliance duty for Utah Artificial Intelligence Policy Act in healthcare?
Utah Artificial Intelligence Policy Act lists deployer, vendor as the role coverage for Utah. The actual duty depends on whether the organization develops, deploys, procures, or uses the covered AI system in the law's scope.
What penalty exposure should healthcare teams track?
Utah Artificial Intelligence Policy Act lists a maximum penalty of $5K in the Atlas record. Penalty exposure depends on the source section, violation type, and factual context.
We may receive referral commissions from recommended compliance tools. Recommendations are based on product fit and not on commission size. Links marked “partner link” include a tracked redirect.