EveryAILaw.comUtah AI Policy Act (stack — SB 149 + 2025 + 2026 amendments)
Obligations Covered
Transparency & Disclosure Data Governance Record-Keeping & Documentation Risk Assessment Human Oversight
Timeline
| Milestone | Date | Notes |
|---|---|---|
| SB 149 signed | Mar 13, 2024 | Gov. Cox signed |
| SB 149 effective | May 1, 2024 | Office + disclosure + criminal mirror |
| Boyd appointed | Apr 30, 2024 | Director, Office of AI Policy |
| Office formally launched | 2024-07 (month only) | Per GovTech, May 2025 |
| SB 226, SB 271, SB 332, HB 452 effective | May 7, 2025 | Four-bill single-day package |
| 2025 annual report deadline | Before 2025-11-30 | Annual duty to Business & Labor Interim Committee; this row does not identify the first report |
| HB 320 effective | May 6, 2026 | Learning Lab restructure |
| 2026 annual report deadline | Before 2026-11-30 | Include recommended legislation from Learning Lab findings (§13-72-201(3)(d)); no guaranteed replacement enactment |
| Chapter 72 sunset | Jul 1, 2027 | Office + Lab + agreements expire; other chapters survive |
Related Regulations and Standards
Related instruments are selected from shared compliance obligations and jurisdiction coverage.
General GenAI Disclosure
Requirements
| Requirement | Details |
|---|---|
| On-request disclosure | A supplier using GenAI to interact with an individual in connection with a consumer transaction must disclose that the individual is interacting with generative artificial intelligence and not a human when the individual asks or otherwise prompts about AI use through a clear and unambiguous request to determine whether the interaction is with a human or artificial intelligence (§13-75-103(1)) |
| Safe harbor | The safe harbor protects a person from enforcement for violating Section 13-75-103 only, if the person's GenAI clearly and conspicuously discloses at the outset of an interaction in connection with a consumer transaction or regulated services, and throughout the interaction, that it is generative artificial intelligence, not human, or an artificial intelligence assistant (§13-75-104(1)); these are alternative safe-harbor disclosure forms, not substitutes for the conjunctive on-request content in §13-75-103(1) |
Penalties
| Violation | Fine |
|---|---|
| Admin enforcement | Up to $2,500 per violation |
| Court enforcement | Up to $2,500 per violation; disgorgement; attorney fees; investigative fees |
| Order violation | Up to $5,000 per violation |
Sources: SB 226 Text raw/us-ut/SB0226.md
High-Risk GenAI Disclosure in Regulated Occupations
Requirements
| Requirement | Details |
|---|---|
| Proactive disclosure | An individual providing services in a regulated occupation must prominently disclose when an individual receiving services is interacting with GenAI in those services if the use is a high-risk artificial intelligence interaction (§13-75-103(2)(a)). The definition covers collection of sensitive personal information, including health, financial, or biometric data; personalized recommendations, advice, or information that could reasonably be relied upon to make significant personal decisions, including financial, legal, medical, or mental health advice or services; or other applications as defined by division rule (§13-75-101(5)) |
| Other regulated-occupation requirements | The individual must comply with all requirements of the regulated occupation when providing services through GenAI (§13-75-103(2)(b)) |
| Verbal at start | The disclosure must be provided verbally at the start of a verbal interaction (§13-75-103(3)(a)) |
| Written before start | The disclosure must be provided in writing before the start of a written interaction, not limited to electronic messaging (§13-75-103(3)(b)) |
Penalties
| Violation | Fine |
|---|---|
| Same as general disclosure | $2,500 admin / $2,500 court / $5,000 order violation |
Sources: SB 226 Text raw/us-ut/SB0226.md
Mental Health Chatbot Disclosure
Requirements
| Requirement | Details |
|---|---|
| Disclosure content | A supplier of a mental health chatbot must cause the chatbot to clearly and conspicuously disclose to a Utah user that it is an artificial intelligence technology and not a human (§13-72a-203(1)) |
| Pre-access disclosure | The disclosure must be made before the Utah user may access the features of the mental health chatbot (§13-72a-203(2)(a)) |
| Access-based repeat disclosure | The disclosure must be made at the beginning of any interaction with the Utah user if the Utah user has not accessed the mental health chatbot within the previous seven days (§13-72a-203(2)(b)) |
| On-prompt disclosure | The disclosure must be made any time a Utah user asks or otherwise prompts the mental health chatbot about whether artificial intelligence is being used (§13-72a-203(2)(c)) |
| GenAI definition | Generative artificial intelligence is an AI technology system trained on data, designed to simulate human conversation with a consumer through text, audio, or visual communication, and generating non-scripted outputs similar to human outputs with limited or no human oversight (§13-72a-101(6)) |
| Mental health chatbot definition | AI technology that uses GenAI to engage in interactive conversations with a user similar to the confidential communications that an individual would have with a licensed mental health therapist, and that a supplier represents, or a reasonable person would believe, can or will provide mental health therapy or help a user manage or treat mental health conditions (§13-72a-101(10)(a)) |
| Narrow carve-outs | Excludes AI technology that only provides scripted output, such as guided meditations or mindfulness exercises, or only analyzes an individual's input for the purpose of connecting the individual with a human mental health therapist (§13-72a-101(10)(b)); providing referrals alongside therapeutic GenAI does not itself establish the exclusion |
| Utah-user scope | A Utah user is an individual located in Utah at the time the individual accesses or uses a mental health chatbot (§13-72a-101(15)); residence alone is not the stated trigger |
Penalties
| Violation | Fine |
|---|---|
| Admin | Up to $2,500 per violation |
| Court | Up to $2,500 per violation; disgorgement; attorney fees |
| Order violation | Up to $5,000 per violation |
Sources: HB 452 Text raw/us-ut/HB0452.md
Mental Health Chatbot Data Protection
Requirements
| Requirement | Details |
|---|---|
| No sale/sharing | A mental health chatbot supplier may not sell to or share with any third party any individually identifiable health information of a Utah user or user input of a Utah user (§13-72a-201(1)) |
| Protected objects | Individually identifiable health information means any information, oral or recorded in any form or medium, relating to the physical or mental health or condition of an individual (§13-72a-101(9)). User input means content provided to a mental health chatbot by a Utah user (§13-72a-101(16)), regardless of whether it is health information; a Utah user is located in Utah at access or use (§13-72a-101(15)) |
| Exception object limit | The exceptions in §13-72a-201(2) apply only to individually identifiable health information, not to user input as a separate protected object; there is no general user-consent exception for all inputs |
| Health care provider request | Individually identifiable health information requested by a health care provider with the consent of the Utah user is excepted (§13-72a-201(2)(a)) |
| Health plan user request | Individually identifiable health information provided to a health plan of the Utah user upon request of the Utah user is excepted (§13-72a-201(2)(b)) |
| Contracted functionality sharing | A supplier may share individually identifiable health information necessary to ensure the effective functionality of the mental health chatbot with another party with which the supplier has a contract related to such functionality (§13-72a-201(2)(c),(3)(a)) |
| Both-party HIPAA-equivalent controls | Both the supplier and the other entity must comply with all applicable privacy and security provisions of 45 C.F.R. Part 160 and 45 C.F.R. Part 164, Subparts A and E, as if the supplier were a covered entity and the other entity were a business associate, as defined in 45 C.F.R. 160.103 (§13-72a-201(3)(b)) |
| Permission limits | The functionality route is a conditional sharing permission, not a general permission to sell, and not a blanket vendor or analytics exception. Retained §13-72a-201 does not establish categorical permission for all aggregate or de-identified analytics; object classification and any claimed transformation require separate authority and review |
Penalties
| Violation | Fine |
|---|---|
| Same as chatbot disclosure | Up to $2,500 per violation administratively or in court; up to $5,000 per violation of an administrative or court order (§13-72a-204(3)-(6)) |
Sources: HB 452 Text raw/us-ut/HB0452.md
Mental Health Chatbot Safety Policy
The defense does not bar an enforcement action or license a chatbot as a therapist (§58-60-118(7)); separate Chapter 72a consumer-protection duties remain applicable
Requirements
| Requirement | Details |
|---|---|
| Defense policy | To qualify, create, maintain and implement a written policy covering intended purposes, therapist involvement, clinical best practices, testing, risk identification, user reporting, acute-risk protocols, safety reviews, safe-use instructions, AI-awareness disclosure, engagement-over-safety prohibition, non-discrimination, HIPAA compliance |
| Documentation | To qualify, maintain documentation of foundation models used, training data, HIPAA compliance, user data practices, ongoing accuracy/safety efforts |
| Filing | To claim the defense, file the required policy and supplier/chatbot information with the Division of Consumer Protection in its required manner and pay the filing fee (§58-60-118(4)); the Division may impose an annual filing fee (§58-60-118(5)(b)) |
| Compliance condition | To qualify, comply with all requirements of the filed policy at the time of the alleged violation (§58-60-118(2)(d)) |
| Defense limits | The defense does not bar the Division from bringing the specified enforcement action, does not recognize a chatbot as a licensed therapist, and does not displace separate Chapter 72a consumer-protection duties (§58-60-118(6)-(7)) |
Penalties
| Violation | Fine |
|---|---|
| Affirmative defense | Limited to administrative or civil actions alleging §58-1-501(1) or (2); it does not bar the Division from bringing such an action and does not extend to separate Chapter 72a consumer-protection liability (§58-60-118(6)-(7)) |
Sources: HB 452 Text raw/us-ut/HB0452.md
AI-Generated Personal Identity Abuse
Requirements
| Requirement | Details |
|---|---|
| Expanded scope | Personal identity now covers name, title, picture, portrait, video likeness, voice, audiovisual appearance — including AI simulation/reproduction |
| Voice definition | Any computer-generated sound "readily identifiable and attributable" to an individual |
| Tool distribution liability | Knowingly distributing tools whose "intended primary purpose" is unauthorized personal-identity content creation for commercial purposes = abuse |
| Exemptions | News, public affairs, sports, art, parody, political speech; §230 interactive-computer-service safe harbor |
Penalties
| Violation | Fine |
|---|---|
| Civil action | |
| Criminal |
Sources: SB 271 Text raw/us-ut/SB0271.md
Regulatory Mitigation and Joint Interpretation Agreements
Requirements
| Requirement | Details |
|---|---|
| Participant eligibility | Five prongs per §13-72-402: technical capability, financial resources, substantial consumer benefits outweighing risks, risk-monitoring plan, appropriately-limited scope |
| Agreement contents | Scope limits, safeguards, mitigation granted, required consumer disclosures, reporting requirements (§13-72-401(4)) |
| Counterparties | OAIP + relevant state agency or governmental entity (judiciary, higher-ed, political subdivisions per HB 320) |
| Term | Initial 12 months + up to 2 × 12-month extensions (36 months total per §13-72-403) |
| Mandatory audits | OAIP "shall perform regular audits" while agreement is active (§13-72-401(6), HB 320) |
| Agreement types | Regulatory mitigation (waives specified law) or joint interpretation (clarifies statute application to AI) |
| Annual report | Annually before November 30 to Business & Labor Interim Committee: learning agenda, findings/participation/outcomes, executed agreements, and recommended legislation from Lab findings (§13-72-201(3)(d)); the provision does not mandate replacement enactment |
Penalties
| Violation | Fine |
|---|---|
| Agreement violation |
Liability for AI-Assisted Violations
Requirements
| Requirement | Details |
|---|---|
| Civil (§13-75-102) | "Not a defense" that GenAI made the violative statement, undertook the violative act, or was used in furtherance |
| Criminal (§76-2-107) | Principal may be found guilty if they commit offense "with the aid of" or "intentionally prompt" GenAI to commit offense |
Penalties
| Violation | Fine |
|---|---|
| Civil | Per underlying consumer-protection statute |
| Criminal | Per underlying offense — no separate penalty |
Cite this regulation
Permalink: https://everyailaw.com/regulation/utah-sb149/
JSON: https://everyailaw.com/api/v1/regulations.json
Attribution: EveryAILaw, PAICE.work PBC. “Utah AI Policy Act (stack — SB 149 + 2025 + 2026 amendments)”, EveryAILaw.com, Jun 4, 2026. https://everyailaw.com/regulation/utah-sb149/
Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.