Utah Artificial Intelligence Policy Act

Summary

The Utah Artificial Intelligence Policy Act (UAIPA), enacted as SB 149 in March 2024, was the first comprehensive U.S. state generative-AI consumer-protection statute. The 2025 Utah General Assembly substantially narrowed it through SB 226 and added a separate mental-health-chatbot regime through HB 452 — both effective May 7, 2025. SB 332 also extended the UAIPA repeal date from May 1, 2025 to July 1, 2027.

What SB 149 originally required

SB 149 codified two regulatory tracks. Generative AI consumer-protection liability was placed in Utah Code § 13-2-12: a person who uses, prompts, or otherwise causes generative AI to interact with a consumer remains responsible for the AI's output as if the person made the statement directly, and consumer-protection statutes apply without a "the AI did it" defense. Disclosure originally required (i) regulated occupations to proactively disclose Gen AI use at the start of each interaction and (ii) all consumer-facing entities to disclose Gen AI on consumer request.

The Act also created the Office of Artificial Intelligence Policy (Utah Code § 13-72-201) and the AI Learning Laboratory Program (§ 13-72-301) — a regulatory sandbox where pilot deployments operate under negotiated mitigation agreements with reduced enforcement exposure.

SB 226 (2025): high-risk-only disclosure and a new safe harbor

SB 226, effective May 7, 2025, narrowed the UAIPA's general disclosure rule from "any consumer-facing Gen AI use" to high-risk AI interactions only. The amended statute defines a high-risk AI interaction as one that involves both:

• collection of sensitive personal information — financial, health, or biometric data; AND
• provision of personalized recommendations or advice "that could reasonably be relied upon to make significant personal decisions" — including financial, legal, medical, or mental health guidance.

For non-regulated entities, the disclosure trigger now activates only on a consumer's "clear and unambiguous request" to know whether they are interacting with a human or AI.

SB 226 added an enforcement safe harbor: a person is not subject to a Gen AI disclosure violation if the AI itself clearly and conspicuously discloses its non-human nature at the outset of and throughout the interaction. SB 226 also tightened the generative AI definition to systems "designed to simulate human conversation," excluding routine automated communications such as appointment reminders.

HB 452 (2025): mental health chatbot rules

HB 452, effective May 7, 2025, created a separate chapter — Utah Code Title 13, Chapter 72a (Artificial Intelligence Applications Relating to Mental Health) — covering mental health chatbots offered to any "Utah user." A mental health chatbot is AI technology designed to engage in interactive conversations "similar to the confidential communications" a person would have with a licensed mental health therapist; scripted outputs and human-therapist referral services are excluded.

Suppliers of in-scope chatbots must:

• Disclose AI status at three trigger points (Utah Code § 13-72a-203): before any chatbot features are accessed; before any interaction after a 7-day gap; and any time a user prompts the chatbot about whether AI is being used.
• Identify advertisements clearly and conspicuously, including any sponsorship, business affiliation, or third-party agreement (§ 13-72a-202); user input may not be used to target advertisements.
• Not sell or share individually identifiable health information or the user's input with any third party (§ 13-72a-201).

HB 452 establishes an affirmative defense for suppliers that maintain a written policy meeting statutory requirements, file the policy with the Utah Division of Consumer Protection, and document training data, user practices, and safety efforts. There is no private right of action.

Penalties and Division of Consumer Protection enforcement

The Division of Consumer Protection (DCP) within the Utah Department of Commerce administers both UAIPA and the new mental health chatbot regime (dcp.utah.gov).

For UAIPA disclosure and Gen AI consumer-protection violations under § 13-2-12 and Title 13 Chapter 72:

• Administrative fines: up to $2,500 per violation.
• Court-ordered penalties: up to $5,000 per violation in actions brought by DCP.
• Subsequent violations of the same kind incur additional sanctions.

For mental health chatbot violations under Chapter 72a:

• Administrative fines: up to $2,500 per violation.
• Injunctive relief and disgorgement available.
• Up to $5,000 per violation for failure to comply with a DCP administrative order.

Each Gen AI use or chatbot interaction can constitute a discrete violation, so daily compounding exposure is realistic for high-volume consumer-facing deployments. Enforcement is exclusively public — neither statute creates a private cause of action.

What Utah AI compliance actually requires now

Practical Utah AI compliance after May 7, 2025 looks like:

• Map every consumer-facing Gen AI deployment against the SB 226 high-risk definition (sensitive data + significant-decision advice). Non-high-risk deployments are no longer subject to general UAIPA disclosure.
• Implement the safe harbor wherever feasible: have the AI itself say "I am an AI" at the start of and throughout each consumer interaction. This single control removes most enforcement exposure under § 13-2-12.
• Run a separate Chapter 72a checklist if any product is a mental health chatbot — three disclosure trigger points, advertising-disclosure controls, no third-party sale of input or health info, and a filed affirmative-defense policy.
• Track the AI Learning Laboratory pathway (ai.utah.gov) for novel deployments where a mitigation-agreement-based enforcement reduction is preferable to a strict-compliance posture.
• Plan for the July 1, 2027 sunset. Compliance programs should not assume permanence; SB 332's sunset extension may or may not be renewed in the 2027 session.

Compliance programs typically pair these Utah-specific controls with the NIST AI Risk Management Framework (Map and Manage functions are most directly relevant) and ISO/IEC 42001 clause 6.1.4 risk treatment, since Utah's primary control vector — disclosure plus safe harbor — is procedural rather than substantive.