Utah AI Laws and Regulation (2026)

Overview of Utah AI Laws

Utah has been at the forefront of state-level artificial intelligence regulation, becoming the first state in the nation to enact AI-focused consumer protection legislation in 2024. The state's approach emphasizes collaboration between government and industry through an innovative regulatory sandbox model rather than punitive enforcement.

Governor Spencer Cox signed the original Artificial Intelligence Policy Act (SB 149) on March 13, 2024, establishing the framework that other states have since studied and, in some cases, replicated. Utah followed this with five additional AI bills in 2025 that refined disclosure requirements, regulated mental health chatbots, expanded deepfake protections, and extended the Act's sunset date.

The creation of the Office of Artificial Intelligence Policy (OAIP) and its Learning Lab program represent Utah's unique contribution to AI governance. Rather than waiting for problems to emerge and then writing laws to address them, Utah has created a mechanism for testing AI systems under government supervision, generating real-world data to inform regulatory decisions.

This article covers all enacted and pending Utah AI legislation, the AI Learning Lab program, and the state's relationship with federal AI policy. This information is current as of March 2026, but you should consult a licensed Utah attorney for advice specific to your situation.

The AI Policy Act: SB 149 (2024)

The Artificial Intelligence Policy Act, enacted as SB 149 during the 2024 General Session, established Utah as a national leader in AI consumer protection. The law took effect on May 1, 2024.

Original Disclosure Requirements

SB 149 created transparency obligations for entities deploying generative AI in consumer-facing contexts. The original law required persons using generative AI in interactions with consumers to disclose the use of AI. Certain licensed professions, particularly mental health providers, were required to disclose upfront when a person was interacting with AI technology or looking at material created by generative AI.

Consumer Protection Framework

The Act amended the Utah Consumer Sales Practices Act (UCSPA) to clarify that using AI is not a defense to violations. If an AI system makes a deceptive statement or engages in unfair conduct, the entity deploying the AI bears the same liability as if a human had performed the act. This principle ensures that companies cannot use AI as a shield against consumer protection enforcement.

Enforcement Structure

The Utah Division of Consumer Protection enforces the AI Policy Act. The Division may impose administrative fines of up to $2,500 per violation, seek court-ordered injunctive relief, obtain disgorgement of profits, and recover attorney and investigative fees. The Attorney General's office may seek $5,000 in civil penalties for each violation of a prior administrative or court order.

Enforcement Detail	Provision
Primary enforcer	Utah Division of Consumer Protection
Administrative fine	Up to $2,500 per violation
AG civil penalty	$5,000 per violation of prior order
Additional remedies	Injunctive relief, disgorgement, attorney fees
Sunset date	July 1, 2027 (extended by SB 332)

2025 Amendments: Refining the Framework

The 2025 General Session produced five AI bills that significantly amended and expanded Utah's AI regulatory framework. All five took effect on May 7, 2025.

SB 226: Consumer Protection Amendments

Senate Bill 226 made the most significant changes to the AI Policy Act's disclosure requirements. The amendments narrowed the scope of when disclosure is required, responding to feedback from businesses that the original requirements were too broad.

Under SB 226, businesses must disclose the use of generative AI only if a consumer makes a "clear and unambiguous request" to determine whether the interaction is with a human or with AI. This replaced the original requirement for proactive disclosure in all consumer interactions.

However, the amendments created a higher standard for "high-risk AI interactions." Entities in regulated occupations must provide prominent disclosure at the outset of an interaction when:

• The interaction involves the collection of sensitive personal information (financial, health, or biometric data)
• The AI provides personalized recommendations or advice that could reasonably be relied upon to make significant personal decisions

Safe Harbor for AI Self-Disclosure

SB 226 added an important safe harbor provision. A business is not subject to enforcement for disclosure violations if the generative AI itself clearly and conspicuously discloses that it is nonhuman (or identifies as an AI assistant or generative AI) at the outset of and throughout the interaction in connection with a consumer transaction or provision of regulated services.

This safe harbor gives companies a practical compliance path: if the AI system is programmed to consistently identify itself as AI, the company receives protection from disclosure violation claims.

SB 332: Sunset Extension

Senate Bill 332 extended the AI Policy Act's sunset date from May 7, 2025, to July 1, 2027. Without this extension, Utah's AI law would have expired before the state could fully evaluate its effectiveness. The extension gives legislators and the Office of AI Policy additional time to gather data through the Learning Lab program before deciding whether to make the law permanent or modify it further.

SB 271: Identity Protection and Deepfakes

Senate Bill 271 expanded Utah's identity protection laws to address AI-generated deepfakes. The bill broadened the definition of "personal identity" to include any simulation, reproduction, or artificial recreation of an individual's picture, portrait, video likeness, voice, or audiovisual appearance created through generative AI, computer animation, digital manipulation, or other technological means.

SB 271 also expanded the scope of prohibited uses beyond advertising to include fundraising, solicitation of donations, and the purchase of products, merchandise, goods, and services. The law requires that consent for use of a person's identity must be given by the individual before deepfakes are generated, and consent can be revoked at any time.

Victims of unauthorized AI-generated identity use can file civil lawsuits to reclaim money made using their image or identity.

Mental Health Chatbot Regulation: HB 452

House Bill 452, signed by Governor Cox on March 25, 2025, and effective May 7, 2025, represents Utah's targeted response to the growing use of AI chatbots for mental health support.

What Qualifies as a Mental Health Chatbot

The law defines "mental health chatbots" as AI technology that uses generative AI to engage in conversations similar to communications one would have with a licensed therapist, and that a supplier represents, or a reasonable person would believe, can provide mental health therapy or help manage or treat mental health conditions.

Mandatory Disclosures

Mental health chatbots must clearly and conspicuously disclose that they are not human in three situations:

• Prior to any interaction with a user
• At the beginning of any interaction if the user has not accessed the chatbot within the last seven days
• Any time the user asks whether artificial intelligence is being used

Advertising Restrictions

The law prohibits mental health chatbots from advertising products or services during user interactions, unless the chatbot clearly identifies and discloses the advertisement. Additionally, chatbot operators must not use user inputs to determine whether to present advertisements to consumers. This provision prevents chatbots from exploiting sensitive mental health disclosures for advertising purposes.

Health Data Privacy

HB 452 prohibits providers from selling or sharing any individually identifiable personal health information or user inputs with third parties. Two narrow exceptions exist:

• Contractually bound suppliers necessary to ensure the chatbot's functionality
• Healthcare providers or health plans, but only with the user's consent

Affirmative Defense

The law provides an affirmative defense for operators who create, maintain, and implement a comprehensive policy for the mental health chatbot that meets specific requirements outlined in the statute. This policy must be filed with the Utah Division of Consumer Protection.

Penalties

Violations may result in administrative fines of up to $2,500 per violation and court action by the Division of Consumer Protection.

Office of Artificial Intelligence Policy

The Office of Artificial Intelligence Policy (OAIP), established by SB 149 and housed within the Utah Department of Commerce, is a first-in-the-nation government office dedicated to AI policy, regulation, and innovation.

Mission and Functions

The OAIP strengthens trust in AI activities in Utah through data-driven policy, timely regulatory adjustments, and innovation-enabling regulatory relief. The office consults with businesses, academic institutions, and other stakeholders to facilitate dialogue on regulatory proposals.

The office has authority to craft regulatory mitigation agreements that enable companies to deploy AI systems in novel ways while maintaining consumer protections. These agreements represent a flexible alternative to traditional regulation, allowing the state to respond quickly to AI developments without waiting for legislative action.

PIONR Framework

The OAIP developed the PIONR Framework for evaluating AI applications. The acronym stands for Prosperity, Integrity and Innovation, Openness, Natural Resource Stewardship, and Respect for Culture and Values. This framework provides a structured, transparent method for the OAIP to assess applicants for the AI Learning Lab program.

AI Learning Lab Program

The AI Learning Lab is Utah's regulatory sandbox for artificial intelligence, representing one of the most innovative approaches to AI governance in the country.

How the Learning Lab Works

The program allows businesses to test AI systems in a controlled environment under government supervision. Companies must apply to participate and enter into a participation agreement with the state. Approved participants may enter into regulatory mitigation agreements that reduce certain regulatory obligations for a limited time while the AI system is tested.

The Learning Lab's purpose is to research the risks, benefits, and impacts of AI technologies to inform the state's regulatory framework, encourage AI development within Utah, evaluate the effectiveness of current and potential regulation, and make findings and recommendations for future AI rules.

Healthcare AI Focus

The Learning Lab's first focus area is AI in healthcare, with a specific emphasis on mental health applications. This focus reflects Utah's recognition that healthcare AI presents both significant opportunities and substantial risks that benefit from supervised testing.

Regulatory Mitigation Agreements

The OAIP has entered into its first regulatory mitigation agreement with Doctronic, an AI platform for prescription medication renewals. In January 2026, Utah and Doctronic announced a groundbreaking partnership allowing AI-assisted prescription renewals under supervised conditions.

The program has also worked with ElizaChat, a mental wellness app for teens, demonstrating the Learning Lab's focus on AI applications that serve vulnerable populations.

UCPA and AI Provisions

The Utah Consumer Privacy Act (UCPA), enacted in 2022 and effective December 31, 2023, intersects with AI regulation in several ways.

The AI Policy Act amended the UCPA to clarify that using AI is not a defense to privacy violations. If an AI system processes personal data in ways that violate the UCPA, the entity deploying the AI bears the same responsibility as if a human had processed the data.

The UCPA requires businesses to provide consumers with opportunities to opt out of data processing for targeted advertising and profiling in decisions related to education, employment, health, criminal history, or access to basic necessities. These opt-out rights apply regardless of whether the processing is performed by AI systems.

2026 Legislative Activity

Utah's 2026 General Session introduced several significant AI bills, though federal opposition has complicated their progress.

HB 286: AI Transparency Act (Blocked by White House)

HB 286, the Artificial Intelligence Transparency Act, would have required frontier AI developers to publish public safety and child protection plans and included whistleblower protections for employees reporting safety concerns. The bill targeted companies using at least 10^26 FLOPs to train a model.

The bill received unanimous support from the House Economic Development and Workforce Services Committee. However, on February 12, 2026, the White House Office of Intergovernmental Affairs sent a letter calling the bill "unfixable" and categorically opposed to the administration's AI agenda. The bill was never called for a final House floor vote before the session ended on March 6, 2026.

HB 438: Companion Chatbot Safety Act

HB 438, based on recommendations from the OAIP's Learning Lab, passed the House 68-1 and the Senate 26-1. The bill requires companion chatbot operators to:

• Comply with Utah's consumer data privacy law
• Restrict advertising within chatbot interactions
• Provide notice that the chatbot is not human if a reasonable person would believe otherwise
• Implement procedures to address suicidal ideation and self-harm
• Provide reminders every three hours that the chatbot is not human when interacting with minors

HB 438 notably includes a private right of action with $1,000 in statutory damages, a departure from Utah's typical enforcement-only approach.

Expanded Deepfake Protections

A deepfake bill expanding on SB 271's 2025 protections received unanimous approval on the House floor and advanced to the Senate. If enacted, it would further restrict nonconsensual use of AI-generated content depicting individuals.

Federal AI Policy and Utah

The White House Confrontation

Utah's experience with HB 286 illustrates the growing tension between state AI regulation and federal AI policy. The White House's opposition to the bill signals that the current administration views frontier AI regulation as a federal matter, not appropriate for state-by-state action.

Utah lawmakers have pushed back against this position, noting that the state has been a leader in collaborative, innovation-friendly AI regulation. The defeat of HB 286 represents a significant setback for states seeking to regulate large AI companies.

Executive Order 14365

President Trump's Executive Order 14365, signed December 11, 2025, aims to limit state-level AI regulation. The order creates a DOJ AI Litigation Task Force to challenge state AI laws and threatens to withhold federal broadband funding from states with certain AI regulations.

Utah's existing AI Policy Act and 2025 amendments may be less vulnerable to federal challenge than HB 286, as they focus on consumer protection and disclosure rather than imposing requirements on frontier AI development. The executive order's exemptions for child safety protections also shield portions of Utah's chatbot and mental health regulations.

Looking Ahead: Utah's AI Regulatory Future

Utah's AI Policy Act expires on July 1, 2027, unless the Legislature acts to extend or make it permanent. The data gathered through the AI Learning Lab program will be critical in shaping that decision.

The state's collaborative approach to AI regulation, built around the Learning Lab model and regulatory mitigation agreements, positions Utah uniquely among states. Rather than imposing broad requirements through legislation, Utah is generating evidence about what works and what does not through supervised real-world testing.

Key questions for Utah's AI regulatory future include whether the AI Policy Act will be made permanent, how the Learning Lab will expand beyond healthcare, whether the state will revisit frontier AI regulation after the HB 286 setback, and how federal preemption efforts will affect Utah's existing laws.

More Utah Laws

Explore other Utah law topics on Recording Law:

• Utah Recording Laws
• Utah Data Privacy Laws
• Utah Whistleblower Laws
• Utah Background Check Laws
• Utah Sexting Laws