Utah Artificial Intelligence Policy Act

Summary

The Utah Artificial Intelligence Policy Act (UAIPA), enacted as SB 149 in March 2024, now anchors three operative Utah AI compliance layers: Chapter 77 for generative-AI consumer disclosures and enforcement, Chapter 72 for the Office of Artificial Intelligence Policy and AI Learning Laboratory, and Chapter 72a for mental-health chatbot protections. The current private-sector disclosure duties took effect May 7, 2025 after SB 226 and HB 452. Source: Utah Code Chapter 77, retrieved 2026-07-27.

What changed after SB 149

SB 149 originally placed generative-AI liability and disclosure in Utah Code § 13-2-12. SB 226 repealed that old section and enacted the current disclosure framework, which Utah now publishes as Utah Code Title 13, Chapter 77 — Generative Artificial Intelligence — Consumer Disclosures and Enforcement. Compliance records should cite Chapter 77 rather than the repealed § 13-2-12 section for the current GenAI disclosure rule.

The Act also created the Office of Artificial Intelligence Policy (Utah Code § 13-72-201) and the AI Learning Laboratory Program (§ 13-72-301). HB 320 updated Chapter 72 effective May 6, 2026: the laboratory now supports both regulatory mitigation agreements and joint interpretation agreements, and the current eligibility test addresses technical capability, financial resources, expected consumer benefit, risk monitoring, and a limited testing scale, scope, and duration. Sources: HB 320 enrolled text and Utah Code § 13-72-402, retrieved 2026-07-27.

Utah AI disclosure rules in 2026

Chapter 77 uses two disclosure triggers:

• Consumer transactions: a supplier using generative AI to interact with an individual in connection with a consumer transaction must disclose that the individual is interacting with generative AI and not a human if the individual clearly and unambiguously asks or prompts about whether AI is being used. Source: Utah Code § 13-77-103, retrieved 2026-07-27.
• Regulated occupations: an individual providing services in a regulated occupation must prominently disclose generative-AI use when the service interaction is a high-risk artificial intelligence interaction, and must provide the disclosure verbally at the start of a verbal interaction or in writing before a written interaction.

A high-risk AI interaction includes generative-AI interactions involving sensitive personal information — health, financial, or biometric data — and personalized recommendations, advice, or information that could reasonably be relied upon for significant personal decisions, including financial, legal, medical, or mental-health advice. Source: Utah Code Chapter 77, retrieved 2026-07-27.

Safe harbor and enforcement

Chapter 77 creates a practical safe harbor: a person is not subject to an enforcement action for violating § 13-77-103 if the generative AI clearly and conspicuously discloses at the outset and throughout the interaction that it is generative AI, is not human, or is an artificial intelligence assistant. Source: Utah Code § 13-77-104, retrieved 2026-07-27.

The Division of Consumer Protection administers Chapter 77. The statute authorizes administrative fines up to $2,500 for each violation and civil penalties up to $5,000 for each violation of an administrative or court order. Chapter 77 also states that generative AI is not a defense to a consumer-protection violation if the AI made the violative statement, undertook the violative act, or was used in furtherance of the violation.

Mental health chatbot rules under Chapter 72a

HB 452, effective May 7, 2025, created Utah Code Title 13, Chapter 72a (Artificial Intelligence Applications Relating to Mental Health) for mental health chatbots offered to any "Utah user." A mental health chatbot is AI technology designed to engage in interactive conversations similar to confidential communications with a licensed mental health therapist; scripted outputs and human-therapist referral services are excluded.

Suppliers of in-scope chatbots must:

• Disclose AI status at three trigger points (Utah Code § 13-72a-203): before any chatbot features are accessed; at the beginning of any interaction after a seven-day gap; and any time a user prompts the chatbot about whether AI is being used.
• Identify advertisements clearly and conspicuously, including any sponsorship, business affiliation, or third-party agreement (§ 13-72a-202); user input may not be used to target advertisements.
• Not sell or share individually identifiable health information or the user's input with any third party (§ 13-72a-201).

HB 452 establishes an affirmative defense for suppliers that maintain a written policy meeting statutory requirements, file the policy with the Utah Division of Consumer Protection, and document training data, user practices, and safety efforts. There is no private right of action. Source: Utah Code Chapter 72a, retrieved 2026-07-27.

2027 future-effective AI chapters

HB 276 enacted two additional, future-effective chapters: Chapter 72b, the Digital Voyeurism Prevention Act, and Chapter 72c, the Digital Content Provenance Standards Act. The current Utah Code index marks both chapters effective January 1, 2027, so they are implementation watch items rather than duties in force on July 27, 2026. Sources: HB 276 enrolled text and the Utah Code Title 13 index, retrieved 2026-07-27.

2026 companion chatbot watch item

Utah considered a broader HB 438 Artificial Intelligence Amendments bill in the 2026 General Session that would have created an AI companion chatbot safety act. The official Utah Legislature bill listing shows HB 438 ended as House/filed rather than Governor-signed, so it remains a proposal rather than a current compliance duty. Source: Utah Legislature 2026 bill listing, retrieved 2026-07-27.

What Utah AI compliance actually requires now

Practical Utah AI compliance after May 7, 2025 looks like:

• Map every consumer-facing GenAI deployment against Chapter 77: consumer-transaction chatbot, regulated-occupation service, high-risk interaction, or out of scope.
• Implement the safe harbor wherever feasible: have the AI itself disclose at the outset and throughout the interaction that it is AI and not human.
• Run a separate Chapter 72a checklist if any product is a mental health chatbot — three disclosure trigger points, advertising-disclosure controls, no third-party sale or sharing of input or health information, and a filed affirmative-defense policy.
• Track the AI Learning Laboratory pathway (Utah Office of Artificial Intelligence Policy) for novel deployments where a mitigation agreement or joint interpretation agreement may fit the deployment.
• Keep future-effective and pending controls separate from current duties: HB 276's Chapters 72b and 72c start January 1, 2027, while HB 438 did not pass in the 2026 General Session.
• Plan for the July 1, 2027 sunset. Compliance programs should not assume permanence; SB 332's sunset extension may or may not be renewed in the 2027 session.

Compliance programs typically pair these Utah-specific controls with the NIST AI Risk Management Framework (Map and Manage functions are most directly relevant) and ISO/IEC 42001 clause 6.1.4 risk treatment, since Utah's primary control vector — disclosure plus safe harbor — is procedural rather than substantive.