Summary
- Original 2024 law (SB 149) made it no defence to a consumer protection violation that "the AI said it", required disclosure of generative AI on request in consumer dealings, and required licensed professionals to disclose AI use up front. It also created the Office of Artificial Intelligence Policy and an AI Learning Laboratory that can grant temporary regulatory mitigation agreements.
- 2025 rewrite (SB 226) moved the disclosure rules into Utah Code Chapter 13-77 and narrowed them:
- A supplier using generative AI in a consumer transaction must disclose it is AI and not a human if the person clearly and unambiguously asks (13-77-103(1)).
- People in regulated occupations (Department of Commerce licences or state certification) must prominently disclose generative AI use when it is a high-risk AI interaction: collecting health, financial or biometric data, or giving personalised financial, legal, medical or mental health advice. Verbal at the start of a call; written before a chat starts (13-77-103(2), (3); 13-77-101(5)).
- Safe harbor: no enforcement if the AI itself clearly says, at the outset and throughout, that it is AI, not human, or an AI assistant (13-77-104).
- Sunset extended (SB 332): the AI Policy Act chapter (13-72) now repeals on 1 Jul 2027 instead of 1 May 2025. The 13-77 disclosure chapter is not on that repeal list.
- Mental health chatbots (HB 452, 2025): suppliers may not sell or share Utah users' health data or inputs (narrow exceptions), may not use inputs to target ads, must label in-chat ads, and must disclose the bot is AI before use, after seven days of inactivity, and whenever asked (Chapter 13-72a). Suppliers can file a written safety policy with the licensing division (58-60-118).
Who it applies to
- Suppliers in consumer transactions with individuals, and licensed professionals regulated by the Utah Department of Commerce.
- Extraterritorial: yes. The rules attach to consumer transactions with people in Utah and to "Utah users" of mental health chatbots, so an out-of-state or Indian supplier serving Utah consumers is covered.
- Learning lab participation is voluntary.
Key dates
- SB 149 signed by Governor
- SB 149 takes effect: Utah Code 13-2-12 disclosures and Chapter 13-72 (Office of AI Policy, learning lab)
- SB 226 (Chapter 465) replaces 13-2-12 with Chapter 13-77: narrower on-request disclosure, high-risk proactive disclosure, safe harbor
- HB 452 (Chapter 269) mental health chatbot rules (Chapter 13-72a) take effect
- HB 320 (Chapter 127 of 2026) amends Office of AI Policy and learning lab provisions
- Chapter 13-72 (Office of AI Policy, learning lab, regulatory mitigation) repealed unless extended (63I-2-213, as amended by SB 332)Upcoming
Full date record
| Date | Event |
|---|---|
| 2024-03-13 | SB 149 signed |
| 2024-05-01 | SB 149 effective |
| 2025-05-07 | SB 226 (Chapter 13-77) and HB 452 (Chapter 13-72a) effective; 13-2-12 repealed |
| 2025 | SB 332 extends Chapter 13-72 repeal date to 1 Jul 2027 |
| 2026-05-06 | HB 320 (2026) amendments to the Office and learning lab take effect; a 2026 technical amendment (Chapter 95) updated 13-77 definitions |
| 2027-01-01 | Separate 2026 Digital Voyeurism Prevention Act (Chapter 13-72b) takes effect (not part of this Act) |
| 2027-07-01 | Chapter 13-72 repeals unless the 2027 session extends it |
Penalties and enforcement
- Enforced by the Division of Consumer Protection, with the AG as its counsel (13-77-105).
- Administrative fine up to USD 2,500 per violation; in court, fines up to USD 2,500 per violation, injunctions, disgorgement and other relief (13-77-105(4), (5)).
- A breach of Chapter 13-77 is also a deceptive act under the Utah Consumer Sales Practices Act (13-77-105(1)).
- Mental health chatbot breaches carry the same USD 2,500 caps, plus mandatory attorney fees, court costs and investigative fees if the division wins (13-72a-204).
- No federal preemption action against Utah's law was found as of 2026-10-19 (limited search).
What it means for an Indian company
- Customer support bots and AI agents serving Utah consumers: answer "am I talking to a human?" truthfully every time. The easiest route is the safe harbor: an always-visible "AI assistant" label at the start and throughout (SC-AI-022 Disclose AI interaction to users).
- Health, fintech, legaltech and wealth-tech apps used by Utah licensed professionals: build a proactive disclosure step (spoken at call start, written before chat) for any flow collecting health, financial or biometric data or giving personalised advice (SC-AI-004 AI risk classification and use-case tiering).
- Mental wellness and therapy chatbots: block sale or sharing of user inputs, turn off input-based ad targeting, add the seven-day re-disclosure, and consider filing a safety policy with Utah's licensing division (SC-AI-011 Lawful basis and consent for personal data used in AI, SC-AI-034 Unlawful and prohibited content safeguards).
- Startups wanting to test in Utah can apply to the learning lab for a regulatory mitigation agreement, but plan for the 1 Jul 2027 sunset.
- Low penalties per violation, but they multiply across conversations; log disclosures as evidence (SC-AI-032 Logging and record keeping).
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when Utah AI Policy Act is done.
Glossary
- Supplier: a seller or service provider in a consumer transaction under Utah consumer law.
- Generative AI: an AI system trained on data that simulates human conversation by text, audio or visuals and produces unscripted outputs with little human oversight.
- Regulated occupation: a job needing a Utah Department of Commerce licence or state certification.
- High-risk AI interaction: AI use that collects health, financial or biometric data or gives personalised advice people may rely on for major decisions.
- Safe harbor: a built-in defence if the AI clearly says it is AI at the start and throughout.
- Learning laboratory: the Office of AI Policy's sandbox for testing AI products and policy.
- Regulatory mitigation agreement: a temporary deal easing specific rules for a learning lab participant.
- Mental health chatbot: a generative AI tool that holds therapy-like conversations and is presented as improving mental health.
Key takeaways
- Since 7 May 2025 the live disclosure rules are in Chapter 13-77 (SB 226), not the original 13-2-12.
- Disclosure is on clear request for consumer dealings, and proactive only for licensed professionals in high-risk interactions.
- Only the Office of AI Policy and learning lab chapter sunsets, on 1 Jul 2027; disclosure duties do not.
- Fines up to USD 2,500 per violation; mental health chatbots have extra privacy, ad and disclosure rules.
Official sources
- Utah Code Chapter 13-77, Generative AI consumer disclosures, accessed 2026-10-19 (via official-site search index; direct connection to le.utah.gov failed)
- Utah Code Chapter 13-72, Artificial Intelligence Policy Act, accessed 2026-10-19
- Utah Code Chapter 13-72a, AI applications relating to mental health, accessed 2026-10-19
- SB 149 (2024) bill page and status, accessed 2026-10-19
- SB 226 (2025) enrolled, accessed 2026-10-19
- SB 332 (2025) enrolled, accessed 2026-10-19
- HB 452 (2025) enrolled, accessed 2026-10-19
- Utah Department of Commerce, AI FAQ, accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.