EveryAILaw.comDoes Utah AI Policy Act (stack — SB 149 + 2025 + 2026 amendments) require Risk Assessment?
Utah • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 5 specific requirements for Risk Assessment across 1 provision:
- Defense policy — To qualify, create, maintain and implement a written policy covering intended purposes, therapist involvement, clinical best practices, testing, risk identification, user reporting, acute-risk protocols, safety reviews, safe-use instructions, AI-awareness disclosure, engagement-over-safety prohibition, non-discrimination, HIPAA compliance
- Documentation — To qualify, maintain documentation of foundation models used, training data, HIPAA compliance, user data practices, ongoing accuracy/safety efforts
- Filing — To claim the defense, file the required policy and supplier/chatbot information with the Division of Consumer Protection in its required manner and pay the filing fee (§58-60-118(4)); the Division may impose an annual filing fee (§58-60-118(5)(b))
- Compliance condition — To qualify, comply with all requirements of the filed policy at the time of the alleged violation (§58-60-118(2)(d))
- Defense limits — The defense does not bar the Division from bringing the specified enforcement action, does not recognize a chatbot as a licensed therapist, and does not displace separate Chapter 72a consumer-protection duties (§58-60-118(6)-(7))
Mental Health Chatbot Safety Policy
The defense does not bar an enforcement action or license a chatbot as a therapist (§58-60-118(7)); separate Chapter 72a consumer-protection duties remain applicable
Requirements
| Requirement | Details |
|---|---|
| Defense policy | To qualify, create, maintain and implement a written policy covering intended purposes, therapist involvement, clinical best practices, testing, risk identification, user reporting, acute-risk protocols, safety reviews, safe-use instructions, AI-awareness disclosure, engagement-over-safety prohibition, non-discrimination, HIPAA compliance |
| Documentation | To qualify, maintain documentation of foundation models used, training data, HIPAA compliance, user data practices, ongoing accuracy/safety efforts |
| Filing | To claim the defense, file the required policy and supplier/chatbot information with the Division of Consumer Protection in its required manner and pay the filing fee (§58-60-118(4)); the Division may impose an annual filing fee (§58-60-118(5)(b)) |
| Compliance condition | To qualify, comply with all requirements of the filed policy at the time of the alleged violation (§58-60-118(2)(d)) |
| Defense limits | The defense does not bar the Division from bringing the specified enforcement action, does not recognize a chatbot as a licensed therapist, and does not displace separate Chapter 72a consumer-protection duties (§58-60-118(6)-(7)) |
Penalties
| Violation | Fine |
|---|---|
| Affirmative defense | Limited to administrative or civil actions alleging §58-1-501(1) or (2); it does not bar the Division from bringing such an action and does not extend to separate Chapter 72a consumer-protection liability (§58-60-118(6)-(7)) |
Sources: HB 452 Text raw/us-ut/HB0452.md