Utah Artificial Intelligence Policy Act and AI consumer protection disclosures

What it is

Utah was the first US state to pass a law focused on generative AI. The Artificial Intelligence Policy Act, Senate Bill 149 of 2024, took effect on 1 May 2024. It did two things. It required disclosure of generative AI in consumer dealings, and it created an Office of Artificial Intelligence Policy with a learning laboratory where companies could test AI under regulatory mitigation agreements.

The 2025 session reorganised it. SB 226, the Artificial Intelligence Consumer Protection Amendments, moved and narrowed the disclosure rules into a new chapter of the Utah Code, Title 13, Chapter 75, effective 7 May 2025. SB 332 extended the repeal date of the AI Policy Act itself, Title 13, Chapter 72, from May 2025 to 1 July 2027. In 2026, HB 320 amended the Office’s duties and the learning laboratory without changing that date.

What a business has to do today sits in Chapter 75. The office, the laboratory and the regulatory mitigation programme sit in Chapter 72.

Who it applies to

The disclosure rules reach two groups.

• A supplier, as defined in Utah’s Consumer Sales Practices Act, that uses generative AI to interact with an individual in connection with a consumer transaction.
• An individual providing services in a regulated occupation, one regulated by the Utah Department of Commerce that needs a state licence or certification, when the services are delivered through generative AI.

Generative AI here means an AI system trained on data that simulates human conversation with a consumer through text, audio or visual communication, and generates non-scripted outputs similar to a human’s with limited or no human oversight.

What it requires

Disclosure on request. A supplier using generative AI with a consumer discloses that the person is interacting with generative AI and not a human, if the person asks or prompts about it. The question has to be a clear and unambiguous request to find out whether the interaction is with a human or AI.

Proactive disclosure in high-risk interactions. A person in a regulated occupation prominently discloses when a client is interacting with generative AI in the provision of regulated services, if the use is a high-risk AI interaction. That means one involving the collection of sensitive personal information such as health, financial or biometric data, or personalised advice that could reasonably be relied on for significant personal decisions, such as financial, legal, medical or mental health advice. The disclosure is made verbally at the start of a spoken interaction and in writing before a written one. The professional must still meet every requirement of their occupation.

Safe harbour. A person is not subject to enforcement for breaching these duties if its generative AI clearly and conspicuously discloses, at the outset and throughout the interaction, that it is generative AI, not human, or an AI assistant.

No AI defence. It is not a defence to a breach of Utah consumer protection law that generative AI made the statement, did the act or was used to further the violation.

Enforcement. A breach is a deceptive act under the Consumer Sales Practices Act. The Division of Consumer Protection enforces it, with administrative fines and court actions of up to US$2,500 per violation, and civil penalties of up to US$5,000 per violation for breaching an order.

Key dates

• 1 May 2024. SB 149 takes effect.
• 7 May 2025. SB 226 and SB 332 take effect, creating Chapter 75 and extending Chapter 72.
• 6 May 2026. HB 320 takes effect, amending the Office of AI Policy and learning laboratory.
• 1 July 2027. Chapter 72, the Artificial Intelligence Policy Act, is scheduled to repeal unless extended.

How it relates to other frameworks

Utah’s disclosure duty is a narrow version of a rule now found in several places. Texas TRAIGA requires government agencies and health care providers to disclose AI interactions. Article 50 of the EU AI Act requires providers to design systems so people know they are interacting with AI, unless it is obvious. Utah’s version is lighter for ordinary businesses, which only need to answer honestly when asked, and heavier for licensed professionals.

Utah also legislated separately in 2025 on mental health chatbots (HB 452), which is outside this page. Where a Utah business’s AI makes decisions about people rather than conversing with them, the more relevant rules are the profiling provisions in other state privacy laws and decision-focused laws such as Colorado SB 26-189.

Working with it in Aicura

US state framework content is available in Aicura on the Enterprise tier and is switched on in Settings under Frameworks. The AI Register records which systems and agents talk to customers or clients, and which business units in regulated occupations use them. Guardrails enforce rules on what those systems may say at the AI gateway that sits between your applications and the models they call, which is one way to make sure a disclosure is given and that the system does not claim to be human. Governance policy reviews check your AI Transparency Statement against the frameworks you choose. Aicura gives guidance for your own judgement and your advisers’. It does not decide whether an interaction is high-risk under Utah law.