Utah AI Policy Act Guide: Generative AI Disclosure Duties

Utah was the first US state to write generative AI disclosure duties into consumer protection law, and it has rewritten them twice since, so guidance based on the 2024 text is now out of date. The Artificial Intelligence Policy Act began as Senate Bill 149 of the 2024 General Session. In 2025, SB 226 moved and narrowed the disclosure duties, SB 332 extended the Act's repeal date to 1 July 2027 and HB 452 added specific rules for mental health chatbots. In 2026, HB 320 reworked the Office of Artificial Intelligence Policy and its regulatory mitigation agreements. This guide explains the current position as at 24 October 2026, read from the enrolled bills, and what it means for teams that run chatbots and AI agents talking to Utah residents.

Key takeaways

AI is no excuse. It is not a defence to a Utah consumer protection violation that generative AI made the statement or took the action (Utah Code § 13-75-102).
General disclosure is on request. Suppliers must disclose generative AI use only when a person makes a clear and unambiguous request to know whether they are talking to a human (§ 13-75-103(1)).
Licensed professions disclose up front in high-risk interactions. Regulated occupations must prominently disclose generative AI in high-risk interactions involving sensitive data or personalised financial, legal, medical or mental health advice.
A safe harbour rewards always-on disclosure. A supplier whose AI clearly and conspicuously says it is AI at the outset and throughout the interaction is protected from disclosure enforcement (§ 13-75-104).
The Act has a sunset. SB 332 moved the repeal date for the AI Policy Act chapter to 1 July 2027; watch the 2027 session.

Scope: who and what is covered

The current disclosure rules sit in Utah Code Title 13, Chapter 75, enacted by SB 226 with effect from 7 May 2025, which also repealed the original disclosure section (§ 13-2-12) that SB 149 had created. The Office of Artificial Intelligence Policy and its learning laboratory sit in Chapter 72, and mental health chatbots in Chapter 72a.

Term	Section	Meaning (summarised from the enrolled text)	Why it matters
Generative artificial intelligence	§ 13-75-101	An AI system trained on data that interacts with a person through text, audio or visual communication and generates unscripted outputs similar to a human's, with limited or no human oversight	Scripted bots and decision trees are outside; LLM chatbots, voice agents and AI agents that converse are inside
Supplier	§ 13-75-101	A person who engages in or enforces consumer transactions, whether or not dealing directly with consumers	Includes businesses using third-party AI customer service tools
High-risk AI interaction	§ 13-75-101(5)	An interaction that collects sensitive personal information (health, financial or biometric) or provides personalised advice that could be relied on for significant decisions in financial, legal, medical or mental health matters	Triggers up-front disclosure for regulated occupations
Regulated occupation	§ 13-75-101	An occupation regulated by the Department of Commerce that requires a state licence	Check whether your practitioners' licences are issued under Department of Commerce oversight; if so, the high-risk duty applies
Mental health chatbot	§ 13-72a-101	A generative AI tool that holds conversations similar to those with a licensed therapist and is represented, or reasonably perceived, as providing mental health help; scripted tools and pure referral tools are excluded	Separate, stricter regime under HB 452

The Act covers interactions with Utah consumers regardless of where the supplier is based. For how Utah compares with other states, see the Global AI Regulation Map.

Key obligations

Disclosure duties by situation

Situation	Duty	Timing and form	Section
Supplier using generative AI in a consumer transaction	Disclose that the person is interacting with generative AI and not a human	Only if the person makes a clear and unambiguous request to know	§ 13-75-103(1)
Regulated occupation, high-risk AI interaction	Prominently disclose generative AI use	Verbally at the start of a verbal interaction; in writing before a written interaction begins	§ 13-75-103(2)-(3)
Any supplier wanting certainty	Safe harbour if the AI clearly and conspicuously discloses it is AI, not a human, or is an AI assistant	At the outset of and throughout the interaction	§ 13-75-104
Mental health chatbot	Clearly state the chatbot is AI and not a human	Before access; at the start of an interaction if not used in the previous 7 days; whenever the user asks	§ 13-72a-203

The Division of Consumer Protection, in consultation with the Office of Artificial Intelligence Policy, may make rules on the form and method of disclosures (§ 13-75-104). We found no such rule while preparing this guide; check the Division's rules before final design.

Liability for AI conduct

Section 13-75-102 is the provision with the widest practical effect. A business cannot defend a deceptive statement, an unfair practice or any other violation of a statute the Division administers by saying that its generative AI produced it. This mirrors how tribunals have treated chatbot errors elsewhere; in the Air Canada chatbot ruling, the airline was held to the refund policy its bot invented.

Mental health chatbots (HB 452)

Data: suppliers may not sell or share a Utah user's individually identifiable health information or user input with third parties, subject to narrow exceptions such as disclosures a health care provider requests with consent and sharing needed for the chatbot to work under a contract with HIPAA-style safeguards (§ 13-72a-201).
Advertising: in-conversation adverts must be labelled, sponsorships disclosed, and user input may not be used to decide whether or what to advertise, except for the chatbot itself (§ 13-72a-202).
Affirmative defence: a supplier that adopts and follows a written policy (purpose and limits, licensed therapist involvement, pre-release and ongoing testing, crisis protocols, user reporting, discrimination and privacy safeguards), keeps documentation on foundation models and training data, and files the policy with the Division gains a defence to certain professional licensing actions (§ 58-60-118). It does not bar Division enforcement.

Office of Artificial Intelligence Policy and regulatory mitigation

The Office sits in the Department of Commerce. HB 320 (2026, effective 6 May 2026) changed the learning laboratory's purpose from encouraging AI "development" to encouraging "responsible deployment", added joint interpretation agreements alongside regulatory mitigation agreements, let the Office terminate an agreement at any time, required agreements to specify consumer disclosures and reporting for Office audits, and confirmed that participants remain bound by every requirement not expressly waived. The initial demonstration period is 12 months, with up to two 12-month extensions (§ 13-72-403), and the Office reports to the Business and Labor Interim Committee before 30 November each year.

Timeline and current status

Date	Change	Instrument
13 March 2024	Governor signs SB 149, Artificial Intelligence Amendments (the AI Policy Act)	SB 149 (2024)
7 May 2025	Disclosure rules move to Chapter 13-75 and narrow to on-request and high-risk duties; § 13-2-12 repealed	SB 226 (2025)
7 May 2025	Mental health chatbot chapter 13-72a takes effect	HB 452 (2025)
2025	Repeal date of Chapter 72 moved from 1 May 2025 to 1 July 2027 (§ 63I-2-213)	SB 332 (2025)
6 May 2026	Office of AI Policy, learning lab and agreement rules revised	HB 320 (2026)
1 July 2027	Scheduled repeal of the AI Policy Act chapter unless extended	§ 63I-2-213

Status as at 24 October 2026: the disclosure, liability and mental health chatbot rules are in force, and the Office of Artificial Intelligence Policy is operating; its site reports agreements with independent third-party evaluators to audit healthcare AI sandbox pilots. We could not confirm from the enrolled texts whether Chapter 75 shares the 1 July 2027 repeal date with Chapter 72, so treat the 2027 session as a decision point for both. The federal executive order of 11 December 2025 directs challenges to some state AI laws but, according to the White House fact sheet, does not itself preempt them.

Enforcement and penalties

Mechanism	Amount or remedy	Section
Violation treated as	A violation of § 13-11-4(1) (Consumer Sales Practices Act)	§ 13-75-105
Administrative fine (Division director)	Up to $2,500 per violation	§ 13-75-105; § 13-72a-204
Court action by the Division	Declaratory relief, injunction, disgorgement to injured persons, fine up to $2,500 per violation	§ 13-75-105; § 13-72a-204
Costs	Reasonable attorney fees, court costs and investigative fees where the Division succeeds	§ 13-75-105
Breach of an administrative or court order	Civil penalty up to $5,000 per violation	§ 13-75-105; § 13-72a-204
Counsel	The Attorney General advises and represents the Division	§ 13-75-105
Other law	Other state and federal remedies are preserved	§ 13-75-106

Fines are per violation, and every conversation with a consumer is a potential violation, so a disclosure defect in a high-volume chatbot scales quickly even at $2,500 each.

What it means for AI agents and non-human identities

Agents speak for the business: § 13-75-102 makes the supplier answerable for what its agent says or does. Every customer-facing agent needs a named owner, approved knowledge sources and a change process. See the Identity Governance for AI Agents Guide.
Agents acting for a licensed professional: an agent that collects health, financial or biometric data or gives personalised advice for a regulated practitioner is a high-risk AI interaction and must disclose up front.
Detecting the request: the on-request duty means the agent must reliably recognise "am I talking to a human?" in any phrasing and answer truthfully. A system prompt telling the bot to pose as a person creates exactly the violation the Act targets.
Agent-to-agent channels: where your agent negotiates with another business's agent on behalf of a consumer, the consumer transaction is still covered; keep disclosures in the consumer-facing layer.
Credentials and data flows: mental health chatbots may not share user input with third parties, so API keys and integrations that pass conversation content to analytics or advertising services must be reviewed and scoped. See the AI Agent Tool and Plugin Security Guide.

Compliance steps

Inventory conversational AI: list every chatbot, voice agent and AI agent that talks to Utah residents, including vendor-hosted widgets, with owner and purpose. Use the AI Register and AI Inventory Template.
Classify each interaction: general consumer transaction, regulated occupation high-risk interaction, or mental health chatbot.
Choose the disclosure model: on-request handling for general bots, or always-on disclosure to use the § 13-75-104 safe harbour. Most organisations choose always-on: it is simpler to test and covers future rule changes.
Implement and test: add an opening AI statement and a persistent label; build test prompts for the human-or-AI question in varied phrasing; run them in a staging environment before release and in regression tests after every prompt or model change.
Govern content: restrict agents to approved sources and tools, log conversations, and route uncertain answers to humans, because the AI cannot be used as a defence.
Handle mental health tools separately: remove third-party data sharing and ad targeting from conversation data, implement the 7-day re-disclosure rule, and write and file the § 58-60-118 policy if you want the affirmative defence.
Consider the learning laboratory: if a product sits awkwardly with licensing rules, assess whether a regulatory mitigation or joint interpretation agreement with the Office fits.
Calendar the sunset: track the 2027 session and be ready to keep disclosures even if the statute lapses, since other states require them.

Rollback: keep the disclosure banner as a configuration item separate from the model, so a model rollback never removes it, and keep a kill switch that hands the conversation to a human channel.

Framework mapping and measurement

Utah duty	NIST CSF 2.0	NIST SP 800-53 Rev. 5	OWASP LLM Top 10 2025
Legal tracking and sunset monitoring	GV.OC-03	PM-28 Risk Framing	n/a
Conversational AI inventory	ID.AM-07	CM-8 System Component Inventory	n/a
AI disclosure	GV.PO-01	PT-5 Privacy Notice	LLM09 Misinformation
Liability for AI statements	DE.CM-09	AU-2 Event Logging	LLM09 Misinformation; LLM01 Prompt Injection
Mental health data sharing	ID.AM-07	PT-2 Authority to Process PII	LLM02 Sensitive Information Disclosure
Agent tool and data access	GV.PO-01	AC-6 Least Privilege; IA-9 Service Identification and Authentication	LLM06 Excessive Agency

Metrics:

Percentage of Utah-facing conversational AI with always-on disclosure.
Pass rate of the human-or-AI test prompt suite per release (target 100 per cent).
Percentage of high-risk interactions for regulated occupations with up-front disclosure, sampled monthly.
Number of third-party data flows from mental health chatbot conversations (target zero outside the exceptions).
Percentage of customer-facing agents with a named owner and logged conversations.

Common failure patterns

Working from the 2024 text: compliance programmes built on § 13-2-12 cite a repealed section and miss the high-risk definition.
Persona prompts: brand personas with human names and instructions to "never reveal you are a bot" collide directly with the on-request duty.
Disclosure lost on model change: the disclosure lives in a system prompt that a new model version or vendor update overwrites.
Vendor widgets with no owner: a marketing-installed chat widget answers consumers with nobody accountable for its answers.
Analytics on sensitive chats: conversation transcripts from health-related bots flow to third-party analytics through broad API keys.

Practitioner checklist

Inventory every conversational AI that interacts with Utah residents.
Classify interactions as general, high-risk regulated occupation, or mental health chatbot.
Deploy clear, conspicuous AI disclosure at the outset and throughout to use the safe harbour.
Test the human-or-AI question in every release.
Remove persona instructions that deny being AI.
Assign an owner, approved sources and logging to every customer-facing agent.
Review mental health chatbot data sharing, advertising and the 7-day re-disclosure rule.
Track the 1 July 2027 repeal date and any 2027 amendments.

Standards and references

This guide summarises Utah's Artificial Intelligence Policy Act and its 2025 and 2026 amendments as at 24 October 2026, and is not legal advice. Related NHI Mgmt Group resources: Global AI Regulation Map · AI Governance Guide · Texas Responsible AI Governance Act (TRAIGA) Guide · California AI Laws Guide · Deepfake and AI Impersonation Guide