EveryAILaw.comDoes Utah AI Policy Act (stack — SB 149 + 2025 + 2026 amendments) require Risk Assessment?
Utah • enforcing
Yes — 1 provision
Requirements at a glance
This regulation imposes 4 specific requirements for Risk Assessment across 1 provision:
- 15-element policy — Written policy covering intended purposes, therapist involvement, clinical best practices, testing, risk identification, user reporting, acute-risk protocols, safety reviews, safe-use instructions, AI-awareness disclosure, engagement-over-safety prohibition, non-discrimination, HIPAA compliance
- Documentation — Foundation models used, training data, HIPAA compliance, user data practices, ongoing accuracy/safety efforts
- Filing — Must file with Division of Consumer Protection + annual fee
- Compliance requirement — Must comply with filed policy at time of alleged violation
Mental Health Chatbot Safety Policy #
Requirements
| Requirement | Details |
|---|---|
| 15-element policy | Written policy covering intended purposes, therapist involvement, clinical best practices, testing, risk identification, user reporting, acute-risk protocols, safety reviews, safe-use instructions, AI-awareness disclosure, engagement-over-safety prohibition, non-discrimination, HIPAA compliance |
| Documentation | Foundation models used, training data, HIPAA compliance, user data practices, ongoing accuracy/safety efforts |
| Filing | Must file with Division of Consumer Protection + annual fee |
| Compliance requirement | Must comply with filed policy at time of alleged violation |
Penalties
| Violation | Fine |
|---|---|
| Affirmative defense | Available only against §58-1-501(1) and (2) unauthorized-practice actions; not against DCP enforcement |