AI governance in Salt Lake City

Under Utah Code 13-75-103(1), a supplier using generative AI to interact with an individual in connection with a consumer transaction must disclose that the individual is dealing with generative AI and not a human only if that individual asks or otherwise prompts the supplier about it. The statute adds a further limit. The question must be a clear and unambiguous request to determine whether the interaction is with a human or with artificial intelligence. There is no proactive labeling requirement for ordinary consumer-facing generative AI in Utah. A page that says Utah requires disclosure whenever generative AI is used is describing the pre-2025 statute.

Chapter 75 uses the Utah Consumer Sales Practices Act meaning of a consumer transaction, so purely business-to-business use is largely outside it. The on-request rule is the rule for those consumer transactions. It is not a duty this page will paste onto every deployment in the city. A supplier that wants the question to go away can take the safe harbor in section 13-75-104: the generative AI clearly and conspicuously discloses, at the outset of the interaction and throughout it, that it is generative AI, is not human, or is an AI assistant. That person is then not subject to an enforcement action under 13-75-103. Persistent labeling takes the high-risk analysis off the table for that section. It does not take HB 452 off the table. The safe harbor is written for 13-75-103; it does not reach Chapter 72a.

Section 13-75-102 states that it is not a defense to violating any statute the Division of Consumer Protection administers that generative AI made the violative statement, undertook the violative act, or was used in furtherance of the violation. The limit is the statutes that division administers. It is not a sentence about every law in the state. It survived the 2025 narrowing. Our Utah regulation page calls it the most consequential sentence in the chapter, because existing consumer protection law applies to model output as it applies to a human employee’s statements.

Utah Code 13-72a-101(10) defines a mental health chatbot as AI technology that uses generative AI for interactive conversations similar to the confidential communications a person would have with a licensed mental health therapist, and that the supplier represents, or a reasonable person would believe, can provide mental health therapy or help manage or treat mental health conditions. The definition expressly excludes tools that only produce scripted output, such as guided meditations, and tools that only analyze input to connect someone with a human therapist. The reasonable-person limb means marketing language can pull a product into scope that was not built as a therapy product. Chapter 72a reaches suppliers of mental health chatbots used by anyone physically located in Utah at the time of use, regardless of where the supplier sits.

A supplier may not sell or share a Utah user’s individually identifiable health information or user input with any third party. The exceptions are narrow: a provider or health plan, at the user’s request, or a contracted vendor needed for functionality. In that vendor case both parties must comply with the HIPAA privacy and security rules as if the supplier were a covered entity and the vendor a business associate, whether or not either actually is. In-conversation advertising is permitted only if it is clearly identified as advertising, with sponsorship and affiliation disclosed. User input may not be used to decide whether to advertise, what to advertise, or how to present an advertisement, except for the chatbot itself. Non-human disclosure must be made before the user can access the chatbot’s features, again at the start of any interaction after seven days of non-use, and any time the user asks.

Section 58-60-118 gives suppliers an affirmative defense against unlicensed mental health practice claims under 58-1-501(1) and (2). The defense is conditioned on filing a written policy with the Division of Consumer Protection, on maintaining development documentation covering foundation models, training data, HIPAA compliance, data practices, and accuracy work, and on actually complying with the filed policy. The policy has to describe fifteen specified procedures. Our Utah regulation page lists, among them, involvement of licensed therapists in development and review, pre-launch and ongoing testing that output poses no greater risk than therapy with a licensed therapist, identification of foreseeable adverse outcomes, a user reporting mechanism, real-time protocols for acute risk of physical harm, regular objective safety and efficacy reviews, and prioritizing user safety over engagement metrics. Our Utah regulation page calls that an evaluation and red-teaming program written into statute. The filing buys the defense. It is not, by itself, a free-standing order to file, and filing it is not a certification. TrustEdge does not issue one. The Division of Consumer Protection administers Chapter 72a as well as Chapter 75.

TrustEdge serves organizations in Salt Lake City and across Utah. The inventory is taken on-site with the teams that run the consumer-facing tools. The engagement is an inventory of where generative AI meets a consumer, a licensed person, a product that might meet the mental-health chatbot definition, or an authorization review, and a reading of which of these Utah rules reach that use. An administrative fine runs up to $2,500 for each violation of Chapter 75 or Chapter 72a. In a court action the Division may obtain an injunction, disgorgement, and a fine of up to $2,500 per violation, and on a judgment or injunction the court must award the Division reasonable attorney fees, court costs, and investigative fees. Violating an administrative or court order issued under either chapter carries a civil penalty of up to $5,000 per violation. Per-violation counting is why the figures scale with interactions rather than with incidents. Neither chapter creates an express private right of action. Section 13-75-106 states that the chapter does not displace any other remedy or right under state or federal law.

The AI Academy readiness assessment is a free, short diagnostic and a scorecard. It is not this inventory. The governance readiness assessment is the fixed-scope review described on its service page: an inventory of the systems in use, a note on what already sits inside a certification boundary, a reading of the contracts, and a gap list against ISO/IEC 42001 and the NIST AI Risk Management Framework. See the AI Governance and AI Academy pages for how each offer is scoped. The titles below are taken from our Utah regulation page, and the blurbs under them are that page’s wording. Nothing in this body adds a penalty, a date, or a definition that page does not already give. TrustEdge is a HITRUST Authorized External Assessor. That credential qualifies assessment work. It is not a HITRUST certification, and it is not a claim of any other certification or authorization.