Utah AI Laws and Regulation (2026)

Utah regulates artificial intelligence primarily through the AI Policy Act (SB 149), the first AI-focused consumer protection law in the United States. Signed March 13, 2024, the law requires disclosure of AI use in high-risk consumer interactions and created the Office of Artificial Intelligence Policy to oversee a regulatory sandbox program.

Overview of Utah AI Laws

Utah has been at the forefront of state-level artificial intelligence regulation, becoming the first state in the nation to enact AI-focused consumer protection legislation in 2024. The state's approach emphasizes collaboration between government and industry through an innovative regulatory sandbox model rather than punitive enforcement.

Governor Spencer Cox signed the original Artificial Intelligence Policy Act (SB 149) on March 13, 2024, establishing the framework that other states have since studied and, in some cases, replicated. Utah followed this with five additional AI bills in 2025 that refined disclosure requirements, regulated mental health chatbots, expanded deepfake protections, and restructured where the Act's provisions sit in the Utah Code. In 2026, HB 276 added two further AI chapters.

The creation of the Office of Artificial Intelligence Policy (OAIP) and its Learning Lab program represent Utah's unique contribution to AI governance. Rather than waiting for problems to emerge and then writing laws to address them, Utah has created a mechanism for testing AI systems under government supervision, generating real-world data to inform regulatory decisions.

This article covers all enacted and pending Utah AI legislation, the AI Learning Lab program, and the state's relationship with federal AI policy. This information is current as of March 2026, but you should consult a licensed Utah attorney for advice specific to your situation.

The AI Policy Act: SB 149 (2024)

The Artificial Intelligence Policy Act, enacted as SB 149 during the 2024 General Session, established Utah as a national leader in AI consumer protection. The law took effect on May 1, 2024.

Original Disclosure Requirements

SB 149 created transparency obligations for entities deploying generative AI in consumer-facing contexts. The original law required persons using generative AI in interactions with consumers to disclose the use of AI. Certain licensed professions, particularly mental health providers, were required to disclose upfront when a person was interacting with AI technology or looking at material created by generative AI.

Consumer Protection Framework

The Act amended the Utah Consumer Sales Practices Act (UCSPA) to clarify that using AI is not a defense to violations. If an AI system makes a deceptive statement or engages in unfair conduct, the entity deploying the AI bears the same liability as if a human had performed the act. This principle ensures that companies cannot use AI as a shield against consumer protection enforcement.

Enforcement Structure

The Utah Division of Consumer Protection enforces the AI Policy Act. The Division may impose administrative fines of up to $2,500 per violation, seek court-ordered injunctive relief, obtain disgorgement of profits, and recover attorney and investigative fees. The Attorney General's office may seek $5,000 in civil penalties for each violation of a prior administrative or court order.

2025 Amendments: Refining the Framework

The 2025 General Session produced five AI bills that significantly amended and expanded Utah's AI regulatory framework. All five took effect on May 7, 2025.

SB 226: Consumer Protection Amendments

Senate Bill 226 made the most significant changes to the AI Policy Act's disclosure requirements. The amendments narrowed the scope of when disclosure is required, responding to feedback from businesses that the original requirements were too broad.

Under SB 226, businesses must disclose the use of generative AI only if a consumer makes a "clear and unambiguous request" to determine whether the interaction is with a human or with AI. This replaced the original requirement for proactive disclosure in all consumer interactions.

However, the amendments created a higher standard for "high-risk AI interactions." Entities in regulated occupations must provide prominent disclosure at the outset of an interaction when:

• The interaction involves the collection of sensitive personal information (financial, health, or biometric data)
• The AI provides personalized recommendations or advice that could reasonably be relied upon to make significant personal decisions

Safe Harbor for AI Self-Disclosure

SB 226 added an important safe harbor provision. A business is not subject to enforcement for disclosure violations if the generative AI itself clearly and conspicuously discloses that it is nonhuman (or identifies as an AI assistant or generative AI) at the outset of and throughout the interaction in connection with a consumer transaction or provision of regulated services.

This safe harbor gives companies a practical compliance path: if the AI system is programmed to consistently identify itself as AI, the company receives protection from disclosure violation claims.

SB 332: Sunset Extension

Senate Bill 332 extended the AI Policy Act's repeal date to July 1, 2027. The extension gives legislators and the Office of AI Policy additional time to gather data through the Learning Lab program before deciding whether to make that framework permanent or modify it further.

It is important to be precise about what that date actually reaches. Utah's repeal-dates provision, Utah Code 63I-2-213, lists only two Title 13 chapters: Chapter 47 and "Title 13, Chapter 72, Artificial Intelligence Policy Act," which "is repealed July 1, 2027." Chapter 72 is where the Office of Artificial Intelligence Policy, the AI Learning Laboratory Program, and the regulatory mitigation agreement authority live.

SB 226 recodified the operative consumer duties into a separate chapter, Title 13, Chapter 77, including the disclosure requirement at Utah Code 13-77-103, the rule that AI is not a defense, the safe harbor, and enforcement. Chapter 77 does not appear in Section 63I-2-213 and carries no repeal date. A Utah supplier's generative AI disclosure obligation therefore does not lapse in July 2027.

SB 271: Identity Protection and Deepfakes

Senate Bill 271 expanded Utah's identity protection laws to address AI-generated deepfakes. The bill broadened the definition of "personal identity" to include any simulation, reproduction, or artificial recreation of an individual's picture, portrait, video likeness, voice, or audiovisual appearance created through generative AI, computer animation, digital manipulation, or other technological means.

SB 271 also expanded the scope of prohibited uses beyond advertising to include fundraising, solicitation of donations, and the purchase of products, merchandise, goods, and services. The law requires that consent for use of a person's identity must be given by the individual before deepfakes are generated, and consent can be revoked at any time.

Victims of unauthorized AI-generated identity use can file civil lawsuits to reclaim money made using their image or identity.

Mental Health Chatbot Regulation: HB 452

House Bill 452, signed by Governor Cox on March 25, 2025, and effective May 7, 2025, represents Utah's targeted response to the growing use of AI chatbots for mental health support.

What Qualifies as a Mental Health Chatbot

The law defines "mental health chatbots" as AI technology that uses generative AI to engage in conversations similar to communications one would have with a licensed therapist, and that a supplier represents, or a reasonable person would believe, can provide mental health therapy or help manage or treat mental health conditions.

Mandatory Disclosures

Mental health chatbots must clearly and conspicuously disclose that they are not human in three situations:

• Prior to any interaction with a user
• At the beginning of any interaction if the user has not accessed the chatbot within the last seven days
• Any time the user asks whether artificial intelligence is being used

Advertising Restrictions

The law prohibits mental health chatbots from advertising products or services during user interactions, unless the chatbot clearly identifies and discloses the advertisement. Additionally, chatbot operators must not use user inputs to determine whether to present advertisements to consumers. This provision prevents chatbots from exploiting sensitive mental health disclosures for advertising purposes.

Health Data Privacy

HB 452 prohibits providers from selling or sharing any individually identifiable personal health information or user inputs with third parties. Two narrow exceptions exist:

• Contractually bound suppliers necessary to ensure the chatbot's functionality
• Healthcare providers or health plans, but only with the user's consent

Affirmative Defense

The law provides an affirmative defense for operators who create, maintain, and implement a comprehensive policy for the mental health chatbot that meets specific requirements outlined in the statute. This policy must be filed with the Utah Division of Consumer Protection.

Penalties

Violations may result in administrative fines of up to $2,500 per violation and court action by the Division of Consumer Protection.

Office of Artificial Intelligence Policy

The Office of Artificial Intelligence Policy (OAIP), established by SB 149 and housed within the Utah Department of Commerce, is a first-in-the-nation government office dedicated to AI policy, regulation, and innovation.

Mission and Functions

The OAIP strengthens trust in AI activities in Utah through data-driven policy, timely regulatory adjustments, and innovation-enabling regulatory relief. The office consults with businesses, academic institutions, and other stakeholders to facilitate dialogue on regulatory proposals.

The office has authority to craft regulatory mitigation agreements that enable companies to deploy AI systems in novel ways while maintaining consumer protections. These agreements represent a flexible alternative to traditional regulation, allowing the state to respond quickly to AI developments without waiting for legislative action.

PIONR Framework

The OAIP developed the PIONR Framework for evaluating AI applications. The acronym stands for Prosperity, Integrity and Innovation, Openness, Natural Resource Stewardship, and Respect for Culture and Values. This framework provides a structured, transparent method for the OAIP to assess applicants for the AI Learning Lab program.

AI Learning Lab Program

The AI Learning Lab is Utah's regulatory sandbox for artificial intelligence, representing one of the most innovative approaches to AI governance in the country.

How the Learning Lab Works

The program allows businesses to test AI systems in a controlled environment under government supervision. Companies must apply to participate and enter into a participation agreement with the state. Approved participants may enter into regulatory mitigation agreements that reduce certain regulatory obligations for a limited time while the AI system is tested.

The Learning Lab's purpose is to research the risks, benefits, and impacts of AI technologies to inform the state's regulatory framework, encourage AI development within Utah, evaluate the effectiveness of current and potential regulation, and make findings and recommendations for future AI rules.

Healthcare AI Focus

The Learning Lab's first focus area is AI in healthcare, with a specific emphasis on mental health applications. This focus reflects Utah's recognition that healthcare AI presents both significant opportunities and substantial risks that benefit from supervised testing.

Regulatory Mitigation Agreements

The OAIP has entered into its first regulatory mitigation agreement with Doctronic, an AI platform for prescription medication renewals. In January 2026, Utah and Doctronic announced a groundbreaking partnership allowing AI-assisted prescription renewals under supervised conditions.

The program has also worked with ElizaChat, a mental wellness app for teens, demonstrating the Learning Lab's focus on AI applications that serve vulnerable populations.

UCPA and AI Provisions

The Utah Consumer Privacy Act (UCPA), enacted in 2022 and effective December 31, 2023, intersects with AI regulation in several ways.

The AI Policy Act amended the UCPA to clarify that using AI is not a defense to privacy violations. If an AI system processes personal data in ways that violate the UCPA, the entity deploying the AI bears the same responsibility as if a human had processed the data.

The UCPA requires businesses to provide consumers with opportunities to opt out of data processing for targeted advertising and profiling in decisions related to education, employment, health, criminal history, or access to basic necessities. These opt-out rights apply regardless of whether the processing is performed by AI systems.

2026 Legislative Activity

Utah's 2026 General Session introduced several significant AI bills. Federal opposition stopped the highest-profile one, a second died in the Senate, and a third, HB 276, was signed into law.

HB 286: AI Transparency Act (Blocked by White House)

HB 286, the Artificial Intelligence Transparency Act, would have required frontier AI developers to publish public safety and child protection plans and included whistleblower protections for employees reporting safety concerns. The bill targeted companies using at least 10^26 FLOPs to train a model.

The bill received unanimous support from the House Economic Development and Workforce Services Committee. However, on February 12, 2026, the White House Office of Intergovernmental Affairs sent a letter calling the bill "unfixable" and categorically opposed to the administration's AI agenda. The bill was never called for a final House floor vote before the session ended on March 6, 2026.

HB 438: Companion Chatbot Safety Act (Failed)

HB 438, based on recommendations from the OAIP's Learning Lab, passed the House 68-1 on February 20, 2026. It did not pass the Senate. The final Senate substitute (HB0438S05) failed on a 12-15-2 vote on March 5, 2026, and the House struck the bill's enacting clause on March 6, 2026, killing it for the session. Utah has no enacted companion-chatbot-specific statute as a result.

As proposed, HB 438 would have required companion chatbot operators to:

• Comply with Utah's consumer data privacy law
• Restrict advertising within chatbot interactions
• Provide notice that the chatbot is not human if a reasonable person would believe otherwise
• Implement procedures to address suicidal ideation and self-harm
• Provide reminders every three hours that the chatbot is not human when interacting with minors

The bill also would have included a private right of action with $1,000 in statutory damages, a departure from Utah's typical enforcement-only approach. None of these requirements are currently Utah law.

HB 276: Counterfeit Intimate Images and Content Provenance (Enacted)

HB 276, titled Artificial Intelligence Modifications, is the AI bill from the 2026 General Session that became law. The governor signed it on March 24, 2026. Its enrolled text enacts two new chapters of the Utah Code, both effective January 1, 2027.

Digital Voyeurism Prevention Act (Utah Code 13-72b)

The Digital Voyeurism Prevention Act builds on the identity protections SB 271 added in 2025. A generation service may not distribute a counterfeit intimate image without first obtaining consent from the identifiable individual depicted. To count, the consent system must require affirmative consent before distribution, verify the individual's identity with reasonable accuracy, and keep the consent record for at least seven years. A service may not demand personal information beyond what is reasonably necessary to verify identity.

Covered platforms carry a parallel duty. Under Utah Code 13-72b-301, a covered platform may not knowingly allow distribution of a counterfeit intimate image without the depicted person's consent, with "knowingly allow" tied to receiving notice and failing to meet the chapter's takedown requirements.

Unlike most of Utah's AI framework, this chapter creates a private right of action. An injured person may sue the generation service. Actual damages need not be alleged or proved, and on a finding of violation the court must enjoin the conduct and order the images destroyed. A plaintiff may recover actual damages including emotional distress, punitive damages where the violation was willful, reckless, or malicious, and reasonable attorney fees and costs. Each distribution is a separate violation. Suit may be brought within three years of discovery or 10 years of the violation, whichever is later. Generation services and platforms that maintain compliant notice and removal procedures and respond in good faith get a safe harbor.

Digital Content Provenance Standards Act (Utah Code 13-72c)

The Digital Content Provenance Standards Act regulates AI content labeling rather than one category of harm:

• Large online platforms, defined as platforms that exceeded 2,000,000 unique monthly users in the preceding 12 months, must detect whether compliant provenance data is attached to content they distribute, expose its availability through their interface, and let users inspect or download it. They may not knowingly strip compliant provenance data or digital signatures where it is technically feasible not to.
• Covered providers, meaning generative AI systems with over 1,000,000 monthly visitors or users that are publicly accessible in Utah, must embed a latent disclosure in image, video, and audio content their system creates or substantially modifies. The disclosure conveys the time and date of creation or alteration and either the capture device manufacturer's name or digital signatures sufficient to show AI involvement.
• Capture device manufacturers must include a latent disclosure in captured content, a requirement that applies to devices sold in Utah after January 1, 2028. Users may disable the disclosure.

The Division of Consumer Protection administers and enforces Part 2 of this chapter under Utah Code 13-72c-301, with administrative fines up to $2,500 per violation, injunctive relief, disgorgement of unlawful proceeds, attorney and investigative fees, and civil penalties up to $5,000 for each violation of a court order.

Federal AI Policy and Utah

The White House Confrontation

Utah's experience with HB 286 illustrates the growing tension between state AI regulation and federal AI policy. The White House's opposition to the bill signals that the current administration views frontier AI regulation as a federal matter, not appropriate for state-by-state action.

Utah lawmakers have pushed back against this position, noting that the state has been a leader in collaborative, innovation-friendly AI regulation. The defeat of HB 286 represents a significant setback for states seeking to regulate large AI companies.

Executive Order 14365

President Trump's Executive Order 14365, signed December 11, 2025, aims to limit state-level AI regulation. The order creates a DOJ AI Litigation Task Force to challenge state AI laws and threatens to withhold federal broadband funding from states with certain AI regulations.

Utah's existing AI Policy Act and 2025 amendments may be less vulnerable to federal challenge than HB 286, as they focus on consumer protection and disclosure rather than imposing requirements on frontier AI development. The executive order's exemptions for child safety protections also shield portions of Utah's chatbot and mental health regulations.

Looking Ahead: Utah's AI Regulatory Future

Title 13, Chapter 72, the chapter that houses the Office of Artificial Intelligence Policy and the AI Learning Lab, is repealed on July 1, 2027 under Utah Code 63I-2-213 unless the Legislature acts to extend it or make it permanent. The consumer disclosure duties in Chapter 77 are not on that repeal list and continue past that date. The data gathered through the AI Learning Lab program will be critical in shaping the decision on Chapter 72.

The state's collaborative approach to AI regulation, built around the Learning Lab model and regulatory mitigation agreements, positions Utah uniquely among states. Rather than imposing broad requirements through legislation, Utah is generating evidence about what works and what does not through supervised real-world testing.

Key questions for Utah's AI regulatory future include whether the Office of AI Policy and Learning Lab framework will be made permanent before its July 1, 2027 repeal date, how the Learning Lab will expand beyond healthcare, whether the state will revisit frontier AI regulation after the HB 286 setback, and how federal preemption efforts will affect Utah's existing laws.

More Utah Laws

Explore other Utah law topics on Recording Law:

• Utah Recording Laws
• Utah Data Privacy Laws
• Utah Whistleblower Laws
• Utah Background Check Laws
• Utah Sexting Laws