Utah AI Regulations
Utah passed the first US AI-focused consumer protection statute in March 2024 and then cut it back a year later. SB 226 and SB 332, both effective May 7, 2025, moved the consumer duties into a new chapter of the Utah Code, narrowed the proactive disclosure obligation for licensed professionals to high-risk interactions only, added a safe harbor, and extended the sunset on the Office of AI Policy to July 1, 2027. A separate 2025 law, HB 452, regulates AI mental health chatbots in unusual operational detail and is the provision most likely to matter to a healthcare or behavioral health organization.
Last reviewed against primary sources: . AI legislation is moving quickly — statutes have been delayed, repealed and replaced mid-cycle. Verify against the linked primary sources before relying on any date here.
Where we work in Utah
TrustEdge serves organizations across Utah, including these markets.
In-Depth Analysis
Utah is the counterexample to the assumption that early legislation means strict legislation.
It went first. SB 149 took effect May 1, 2024, before any other state had an AI-specific consumer statute, and it was written broadly enough that every licensed professional in the state using a generative AI tool had to announce that fact at the start of every interaction. Thirteen months later the legislature took most of that back. SB 226 kept the on-request rule for ordinary consumer transactions, added a requirement that the customer's question be clear and unambiguous, cut the proactive duty for licensees down to high-risk interactions, and then offered a safe harbor that lets anyone opt out of the analysis entirely by labeling the assistant persistently.
That trajectory is the useful thing about Utah. "Has an AI law" tells a buyer almost nothing. Utah has had one longer than anyone and its operative disclosure requirement is now weaker than what a careful vendor would do voluntarily. Illinois moved in the opposite direction and later. Colorado enacted the most demanding framework in the country and repealed it before it took effect. Three states, three statutes, three completely different answers to the same question — which is why a compliance program built on a state count rather than on statutory text will be both over- and under-inclusive at the same time.
HB 452 is the exception to Utah's light touch, and it deserves separate attention. The disclosure and data rules bind every supplier of a mental health chatbot reaching a Utah user. The fifteen-procedure policy requirement is technically optional — it buys an affirmative defense rather than avoiding a duty — but the thing it defends against is an allegation of unlicensed mental health practice, and no serious operator will decline that protection. Read as a specification, it is one of the most concrete descriptions in US law of what a safety program for a clinical conversational system looks like: named foundation models, documented training data, pre-launch and ongoing testing against a licensed-therapist baseline, enumerated foreseeable adverse outcomes, a user harm reporting channel, real-time acute-risk protocols, and periodic objective review that may be internal or external.
SB 319 is the other item healthcare buyers should calendar. From January 1, 2027 a Utah health insurer using AI anywhere in preauthorization review must say so publicly, to the regulator, to every network provider, and to every enrollee — and the human reviewing an adverse determination must exercise independent medical judgment rather than defer to a model. If a payer cannot currently produce an inventory of where AI touches utilization review, that inventory is now a filing input, not an internal document.
One date to keep in view. The July 1, 2027 repeal reaches Title 13, Chapter 72 — the Office of AI Policy and the learning laboratory — not the disclosure duties in Chapter 75 or the chatbot rules in Chapter 72a. Utah has amended this statute in each of the last three sessions. Assume it will do so again.
Practical Implications for SMBs & Healthcare
For most organizations the honest answer is that Utah asks less of you than you probably feared. If you sell to consumers and your assistant tells the truth when someone plainly asks whether it is a bot, you meet 13-75-103(1). If you want the question to go away, take the 13-75-104 safe harbor: label the assistant clearly at the start and keep the label visible throughout. That single decision removes the need to classify interactions as high-risk and to detect whether a user question was clear and unambiguous.
The exceptions are specific and they cluster in healthcare. If any product of yours could be described as helping a user manage or treat a mental health condition — including a general wellness assistant whose marketing copy implies as much — HB 452 applies, and the compliance work is real: HIPAA-equivalent handling of user input whether or not you are a covered entity, an advertising firewall around conversation content, timed non-human disclosures, and a filed safety policy if you want the unlicensed-practice defense.
If you are a licensed clinician or your staff are, the proactive disclosure duty lands on the individual, not the institution. That is a training and scripting problem more than a systems problem, and it is the kind of obligation that fails quietly.
One pragmatic option most buyers do not know exists: the Office of AI Policy will enter a joint interpretation agreement clarifying how a specific Utah statute or rule applies to a specific AI system. If your uncertainty is regulatory rather than technical, that is a faster and cheaper answer than a legal memo that ends in "it depends."
Key Provisions
The general disclosure duty is on request only
Under Utah Code 13-75-103(1), a supplier using generative AI to interact with an individual in connection with a consumer transaction must disclose that the individual is dealing with generative AI and not a human only if that individual asks or otherwise prompts the supplier about it. The statute adds a further limit: the question must be "a clear and unambiguous request to determine whether the interaction is with a human or with artificial intelligence." There is no proactive labeling requirement for ordinary consumer-facing generative AI in Utah. A page that tells you Utah requires disclosure whenever generative AI is used is describing the pre-2025 statute.
The proactive duty applies to licensed individuals in high-risk interactions
Section 13-75-103(2) requires an individual providing services in a regulated occupation to prominently disclose generative AI use when it constitutes a high-risk AI interaction — verbally at the start of a verbal interaction, and in writing before the start of a written one. Two limits are easy to miss. A regulated occupation means one regulated by the Utah Department of Commerce that requires a license or state certification, so this reaches clinicians, therapists, accountants and similar licensees. And the duty is written on the individual providing the service, not on the corporate deployer behind the tool.
What counts as a high-risk AI interaction
Section 13-75-101(5) defines it as an interaction with generative AI involving the collection of sensitive personal information — health, financial, or biometric data — or the provision of personalized recommendations, advice, or information that could reasonably be relied upon to make significant personal decisions, expressly including financial, legal, medical, or mental health advice or services. A third limb lets the Division of Consumer Protection add applications by rule, so the definition can grow without a legislative session.
The safe harbor removes the judgment call
Section 13-75-104 provides that a person is not subject to an enforcement action under 13-75-103 if their generative AI clearly and conspicuously discloses, at the outset of the interaction and throughout it, that it is generative AI, is not human, or is an AI assistant. Persistent labeling therefore takes the entire high-risk analysis off the table. For most deployments that is cheaper than building a process to detect whether a user question was a clear and unambiguous request about AI, and to classify each interaction as high-risk or not.
You cannot blame the model
Section 13-75-102 states that it is not a defense to violating any statute the Division of Consumer Protection administers that generative AI made the violative statement, undertook the violative act, or was used in furtherance of the violation. This survived the 2025 narrowing intact and is the most consequential sentence in the chapter. Utah's existing consumer protection law applies to model output exactly as it applies to a human employee's statements.
HB 452 — what is and is not a mental health chatbot
Utah Code 13-72a-101(10) defines a mental health chatbot as AI technology that uses generative AI for interactive conversations similar to the confidential communications a person would have with a licensed mental health therapist, and that the supplier represents — or a reasonable person would believe — can provide mental health therapy or help manage or treat mental health conditions. It expressly excludes tools that only produce scripted output such as guided meditations, and tools that only analyze input to connect someone with a human therapist. The "reasonable person would believe" limb means marketing language can pull a product into scope that the engineering team never intended to be therapeutic.
HB 452 — data, advertising, and disclosure timing
A supplier may not sell or share a Utah user's individually identifiable health information or user input with any third party, with narrow exceptions for a provider or health plan at the user's request, or a contracted vendor needed for functionality — and in that last case both parties must comply with the HIPAA privacy and security rules as if the supplier were a covered entity and the vendor a business associate, whether or not either actually is. In-conversation advertising is permitted only if clearly identified as advertising with sponsorship and affiliation disclosed, and user input may never be used to decide whether to advertise, what to advertise, or how to present it, except for the chatbot itself. Non-human disclosure must be made before the user can access the chatbot's features, again at the start of any interaction after seven days of non-use, and any time the user asks.
HB 452 — the filed policy and the unlicensed-practice defense
Section 58-60-118 gives suppliers an affirmative defense against unlicensed mental health practice claims under 58-1-501(1) and (2), conditioned on filing a written policy with the Division of Consumer Protection, maintaining development documentation covering foundation models, training data, HIPAA compliance, data practices and accuracy work, and actually complying with the filed policy. The policy itself must describe fifteen specified procedures, including involvement of licensed therapists in development and review, pre-launch and ongoing testing that output poses no greater risk than therapy with a licensed therapist, identification of foreseeable adverse outcomes, a user reporting mechanism, real-time protocols for acute risk of physical harm, regular objective safety and efficacy reviews, and prioritizing user safety over engagement metrics. This is an evaluation and red-teaming program written into statute.
SB 319 — AI in health insurance preauthorization from 2027
Effective January 1, 2027, an insurer must post on its public website a notice that it uses AI in reviewing authorization requests, if applicable, and must disclose AI use to the Insurance Department, to every network provider, and to every enrollee. The definition expressly includes generative AI. Separately, the individual reviewing an adverse preauthorization determination must use independent medical judgment and may not rely solely on recommendations from any other source. The bill also sets maximum determination timeframes and expands preauthorization statistics reporting.
The Office of AI Policy, the learning lab, and the July 2027 repeal date
Title 13, Chapter 72 — the Artificial Intelligence Policy Act proper — is now essentially the Office of AI Policy and its learning laboratory. SB 332 and SB 226 both moved its repeal date from May 1, 2025 to July 1, 2027. HB 320, effective May 6, 2026, expanded the program: alongside regulatory mitigation agreements it added joint interpretation agreements, under which a participant, the Office, and the relevant agency or governmental entity agree on how a provision of state law applies to a specific AI system. Demonstration periods run 12 months with up to two 12-month extensions. Note what the sunset does and does not reach: the disclosure duties sit in Chapter 75 and the mental health chatbot rules in Chapter 72a, and neither carries a repeal date.
Bills & Statutes
Artificial Intelligence Amendments — the Utah Artificial Intelligence Policy Act
Signed March 13, 2024; effective May 1, 2024; substantially restructured by SB 226 in 2025
Read the primary source(opens in a new tab)Artificial Intelligence Consumer Protection Amendments — enacts Utah Code Title 13, Chapter 75; narrows the disclosure duty and adds a safe harbor
Effective May 7, 2025; repealed the original Section 13-2-12
Read the primary source(opens in a new tab)Artificial Intelligence Revisions — extends the repeal date of the AI Policy Act to July 1, 2027
Effective May 7, 2025
Read the primary source(opens in a new tab)Artificial Intelligence Amendments — enacts Title 13, Chapter 72a, Artificial Intelligence Applications Relating to Mental Health
Effective May 7, 2025; no sunset date
Read the primary source(opens in a new tab)Office of Artificial Intelligence Policy Amendments — adds joint interpretation agreements and extends demonstration periods
Effective May 6, 2026
Read the primary source(opens in a new tab)Health Insurance Preauthorization Amendments — AI disclosure and independent medical judgment on adverse determinations
Enacted in the 2026 general session; effective January 1, 2027
Read the primary source(opens in a new tab)Applicability & Enforcement
Who It Applies To
Chapter 75 reaches suppliers using generative AI in consumer transactions with Utah individuals, and individuals providing services in occupations licensed or state-certified by the Utah Department of Commerce. "Consumer transaction" carries its Utah Consumer Sales Practices Act meaning, so purely business-to-business use is largely outside it. Chapter 72a reaches suppliers of mental health chatbots used by anyone physically located in Utah at the time of use, regardless of where the supplier sits. SB 319 reaches health insurers subject to Utah insurance law from January 1, 2027.
Enforcement
Utah Division of Consumer Protection, within the Department of Commerce, administers and enforces both Chapter 75 and Chapter 72a; the Attorney General advises the Division and acts as its counsel. A Chapter 75 violation also constitutes a violation of Subsection 13-11-4(1) of the Utah Consumer Sales Practices Act. Neither chapter creates an express private right of action, and Section 13-75-106 states the chapter does not displace any other remedy or right under state or federal law. SB 319 is enforced through the Utah Insurance Department.
Penalties
The Division director may impose an administrative fine of up to $2,500 for each violation of either chapter. In a court action the Division may obtain an injunction, disgorgement, payment of disgorged money to injured individuals, and a fine of up to $2,500 per violation, and on a judgment or injunction the court must award the Division reasonable attorney fees, court costs, and investigative fees. Violating an administrative or court order issued under either chapter carries a civil penalty of up to $5,000 per violation. Per-violation counting is what makes these numbers real: the exposure scales with interactions, not with incidents.
Recommended Compliance Actions
Steps organizations should consider to prepare for and comply with Utah's AI regulations.
- 1
Decide whether to take the Section 13-75-104 safe harbor. Persistent, conspicuous labeling at the outset and throughout each interaction removes enforcement exposure under 13-75-103 without any need to classify high-risk interactions. For most consumer-facing deployments this is the cheapest defensible position.
- 2
If you skip the safe harbor, build and test the on-request path. Your assistant must reliably answer a clear and unambiguous question about whether it is human. Verify this against adversarial phrasings, not just the obvious one.
- 3
Identify every licensed or state-certified individual whose service delivery involves generative AI, and script the verbal-at-start and written-before-start disclosure for high-risk interactions. The duty falls on the individual practitioner; institutional policy alone does not discharge it.
- 4
Test whether any of your products meets the HB 452 mental health chatbot definition, and review marketing copy as part of that test. The statute reaches tools a reasonable person would believe can help manage or treat a mental health condition, not only tools you built for that purpose.
- 5
If HB 452 applies, close the data path first. No sale or sharing of individually identifiable health information or user input, HIPAA-equivalent contracts with any functionality vendor, and a hard separation between conversation content and any advertising decision.
- 6
Build the HB 452 policy as a safety program, not a document. Pre-launch and ongoing testing against a licensed-therapist risk baseline, an enumerated list of foreseeable adverse outcomes, real-time acute-risk protocols, and a user harm reporting channel are the operationally demanding items. File the policy with the Division of Consumer Protection to secure the affirmative defense.
- 7
Payers should start the SB 319 inventory now. By January 1, 2027 you must be able to state publicly, and to the Insurance Department, providers and enrollees, whether AI touches authorization review — and demonstrate that adverse-determination reviewers exercise independent medical judgment rather than deferring to a model recommendation.
- 8
Consider a joint interpretation agreement with the Office of AI Policy where a Utah statute's application to your system is genuinely unclear. HB 320 added this route in 2026; demonstration periods run 12 months with up to two extensions.
- 9
Re-check the statute each legislative session. Utah amended this law in 2024, 2025 and 2026, and the Division can add categories to the high-risk definition by rule without any bill at all.
Related TrustEdge Services
As of September 14, 2026. We are not lawyers and this is not legal advice. It is the responsibility of consumers of this data that they verify the applicability and current ratified statutes and legal precedence with a qualified attorney licensed in the state or country they are researching.
Need Help with AI Compliance?
Our team helps organizations build compliance-first AI systems that meet current and emerging regulatory requirements.