Utah AI Laws: AI Policy Act and HB 452 (2027)

As of November 2026, Utah has enacted targeted AI laws rather than one comprehensive act: the Artificial Intelligence Policy Act (SB 149, Utah Code ch. 13-72), the consumer disclosure rules added by SB 226 (ch. 13-77), and the mental health chatbot law (HB 452, ch. 13-72a). Two 2026 AI bills, the frontier-model bill (HB 286) and the companion chatbot bill (HB 438), did not pass.

Status as of November 4, 2026: Chapters 13-77, 13-72a and 13-72 are in force. HB 276 (digital content provenance and counterfeit intimate images) and SB 319 (insurer AI disclosure) are signed and take effect January 1, 2027. Chapter 13-72, which holds the Office of Artificial Intelligence Policy and its sandbox, is scheduled for repeal on July 1, 2027. On September 16, 2026, an interim committee voted to recommend a new date of July 1, 2037, but that recommendation is not law. The disclosure rules in Chapter 13-77 are not on that repeal list.

This page covers Utah state law as of November 4, 2026. It is general legal information, not legal advice. Federal law appears only in the short section near the end.

What Utah AI Law Applies Today

Utah's AI statutes sit in separate chapters with separate dates, which is why older summaries can be right about one chapter and wrong about the next.

We found no Utah comprehensive, high-risk or automated decision law, no frontier-model safety statute, and no AI hiring statute. That rests on a title scan of the 2026 General Session bill list plus the bill summaries of the candidates opened, so a law inside a broader bill could be missed.

SB 226 and Utah Code Chapter 13-77: The AI Disclosure Rule

SB 226 repealed the original disclosure section, Utah Code 13-2-12, and moved the consumer rules to Chapter 13-77, effective May 7, 2025. Much of what is published about "the Utah AI Act" still describes the 2024 version.

What counts as generative AI

The chapter's definition is narrower than the everyday term. Under 13-77-101(4), generative AI is a system that is trained on data, is designed to simulate human conversation with a consumer through text, audio or visual communication, and "generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight."

All three parts must be met. A scripted phone tree or a tool that does not converse with consumers does not obviously fit the definition.

The consumer transaction duty

Section 13-77-103(1) applies to a supplier that uses generative AI to interact with an individual in connection with a consumer transaction. The supplier must disclose that the person is interacting with generative AI "and not a human, if the individual asks or otherwise prompts the supplier about whether artificial intelligence is being used."

The trigger is limited. The prompt "must be a clear and unambiguous request to determine whether the interaction is with a human or with artificial intelligence."

The regulated occupation duty

Section 13-77-103(2) reaches an individual providing services in a regulated occupation, not every business. A regulated occupation is one regulated by the Department of Commerce that requires a license or state certification to practice.

That individual must "prominently disclose" when a person receiving services is interacting with generative AI in the provision of regulated services, if the use is a high-risk AI interaction. The disclosure comes verbally at the start of a verbal interaction and in writing before the start of a written interaction. The individual must also comply with all requirements of the occupation when providing services through generative AI.

A high-risk AI interaction under 13-77-101(5) is one that involves any of these:

• Collecting sensitive personal information, including health, financial or biometric data
• Personalized recommendations, advice or information that could reasonably be relied on for significant personal decisions, including financial, legal, medical or mental health advice or services
• Other applications defined by Division rule

The safe harbor in 13-77-104

A person is not subject to an enforcement action for violating 13-77-103 if its generative AI clearly and conspicuously discloses, at the outset of the interaction and throughout it, that it is generative AI, is not human, or is an AI assistant. The disclosure must come in connection with a consumer transaction or the provision of regulated services.

Both timing elements are required. A disclosure at the start alone does not meet the text.

AI is no defense

Section 13-77-102 says it is not a defense to a violation of any statute the Division administers and enforces under 13-2-102 that generative AI "made the violative statement," "undertook the violative act," or "was used in furtherance of the violation."

Penalties and who enforces

The Division of Consumer Protection administers and enforces Chapter 77, and the Attorney General acts as its counsel. Under 13-77-105:

Can a consumer sue?

Chapter 77 contains no private lawsuit provision of its own, but "no private right of action" overstates it. Section 13-77-106 says the chapter does not displace any other remedy or right under state or federal law.

Section 13-77-105(1) also makes a violation of the chapter a violation of 13-11-4(1), part of the Utah Consumer Sales Practices Act, and 13-11-19 of that act lets consumers sue over violations of that act. Whether a consumer can use that route for a Chapter 77 violation is a reading of the text, not a holding we can point to.

SB 149 and Chapter 13-72: The Office of AI Policy and the AI Sandbox

SB 149 was signed March 13, 2024 and took effect May 1, 2024. Today its chapter does one job: it created the Office of Artificial Intelligence Policy in the Department of Commerce and the Artificial Intelligence Learning Laboratory Program, which the office now also calls its AI Sandbox.

The learning lab's purpose under 13-72-301 is to research AI's risks, benefits and policy implications, encourage responsible deployment, evaluate current and proposed regulation, and produce recommendations. The office sets a periodic learning agenda. It lists healthcare AI, liability and agentic AI as its 2026 topics, after data provenance in 2025 and mental health in 2024. It says the sandbox is open to any AI application that runs into a state rule, not only clinical uses.

What changed with HB 320

HB 320 (Laws 2026 ch. 127), signed March 18, 2026 and effective May 6, 2026, revised the sandbox. It added joint interpretation agreements alongside regulatory mitigation agreements, and it did not amend the repeal date.

• Regulatory mitigation agreement: lets a participant use AI despite a law or rule that might impede it, and may set cure periods or reduced civil fines.
• Joint interpretation agreement: clarifies how a provision of state law or rule applies to AI technology.

The sandbox limits

• An agreement needs the office and the relevant agency or governmental entity head (13-72-401(2)). The office says it cannot grant one alone.
• Eligibility requires technical capability, financial resources, potential substantial consumer benefits that may outweigh identified risks, a plan to monitor and minimize risk, and appropriately limited testing (13-72-402).
• An initial demonstration period may not exceed 12 months, and the office may grant up to two 12-month extensions (13-72-403).
• The office may end an agreement "at any time and for any reason" and must audit participants while an agreement is in effect (13-72-401).
• A participant stays subject to every requirement not expressly waived or modified, and participation "does not constitute an endorsement or approval from the state" (13-72-401(7), (9)).

The office also says these agreements apply to state administrative enforcement and do not grant a liability shield, and that patients keep their civil, criminal and malpractice remedies.

Authorized AI pilots

The office's public list on November 4, 2026 showed these agreements. All were co-signed with the Division of Professional Licensing.

ElizaChat, not Doctronic, was the first regulatory mitigation agreement, as the Department of Commerce announced in December 2024. Doctronic was announced in January 2026.

The dispute over AI prescription renewals

On April 20, 2026, the Utah Medical Licensing Board wrote to the office that it learned of the Doctronic agreement only after the system was live, and it strongly recommended that the program "be immediately suspended pending further discussion."

The Division of Professional Licensing and the office answered on April 21, 2026 that they would not suspend the pilot at that time. They said a licensed physician reviews every AI-generated renewal in Phase 1, that the pilot excludes controlled substances, new prescriptions and treatment-plan changes, and that medical professionals reviewed it before launch. The letter describes the Board's role as advisory.

The office's page says the pilot remains in Phase 1, that moving to Phase 2 needs office approval medication group by medication group, and that a 2026 amendment tightened that threshold and removed two medications. The office's FAQ says the Medical Licensing Board has set up an AI working group that meets regularly with the office, and that the Board has raised concerns about how the prescribing pilots are supervised.

HB 452: Utah's Mental Health Chatbot Law (Chapter 13-72a)

HB 452 (Laws 2025 ch. 269) was signed March 25, 2025 and took effect May 7, 2025. It does not ban AI therapy chatbots. It sets disclosure, data and advertising rules.

What is a mental health chatbot

Under 13-72a-101(10), it is AI technology that uses generative AI to engage in interactive conversations "similar to the confidential communications that an individual would have with a licensed mental health therapist," and that a supplier represents, or a reasonable person would believe, can or will provide mental health therapy or help a user manage or treat mental health conditions.

The definition excludes technology that only provides scripted output, such as guided meditations, or that only analyzes input to connect someone with a human therapist. A "Utah user" is someone located in the state when using the chatbot.

What suppliers must do

Disclosure (13-72a-203). The chatbot must clearly and conspicuously disclose that it is AI technology and not a human. The disclosure comes before the user may access its features, at the start of any interaction if the user has not accessed it in the previous seven days, and any time the user asks or prompts about AI.

Data (13-72a-201). A supplier may not sell to or share with any third party a Utah user's individually identifiable health information or user input. The exceptions for health information are a request by a health care provider with the user's consent, delivery to the user's health plan at the user's request, and sharing with a contracted party as necessary for functionality under HIPAA-equivalent conditions.

Advertising (13-72a-202). A chatbot may not advertise a specific product or service in a conversation unless it clearly identifies the ad and discloses any sponsorship, affiliation or promotion agreement. A supplier may not use a user's input to decide whether to show an ad (except for the chatbot itself), to pick what to advertise, or to customize how an ad appears. Recommending that a user seek help from a licensed professional stays allowed.

Enforcement

The Division of Consumer Protection enforces the chapter. The fines match Chapter 77: up to $2,500 per violation, administratively or in court, and up to $5,000 for each violation of an order. The chapter contains no private right of action.

The affirmative defense is narrower than it looks

The defense is not in Chapter 72a. It sits in the licensing title at Utah Code 58-60-118, and it applies "only in an administrative or civil action alleging a violation of" 58-1-501(1) or (2), the unlawful conduct and unprofessional conduct provisions. It is no defense to a consumer protection action under Chapter 72a.

To use it, a supplier must create and follow a written policy, keep documentation on matters such as foundation models and training data, and file the policy with the "division." In Title 58 that word means the Division of Professional Licensing, not the Division of Consumer Protection. The section also says it does not recognize a chatbot as a licensed therapist.

HB 276: The Digital Content Provenance Standards Act (Chapter 13-72c)

HB 276 (Laws 2026 ch. 352) was signed March 24, 2026 and takes effect January 1, 2027. Chapter 13-72c sets three sets of duties, all in the bill's enrolled text.

• Large online platforms: public-facing social media platforms, mass messaging platforms or stand-alone search engines that exceeded 2,000,000 unique monthly users in the preceding 12 months. They must detect compliant system provenance data, provide an interface disclosing its availability, and let users inspect it. They may not, to the extent technically feasible, knowingly strip compliant provenance data or digital signatures.
• Covered providers: a person producing a generative AI system with over 1,000,000 monthly visitors or users that is publicly accessible in Utah, excluding systems used only for internal business operations and not made publicly accessible. They must include a latent disclosure in image, video or audio content their system creates or substantially modifies, conveying the time and date and related origin information to the extent technically feasible and reasonable.
• Capture device manufacturers: a latent disclosure in captured content, applying to devices produced for sale in Utah on or after January 1, 2028. The manufacturer may let users turn it off, and the duty applies only to the extent technically feasible and compliant with widely adopted standards.

The Division of Consumer Protection enforces Part 2 of the chapter under 13-72c-301: up to $2,500 per violation, disgorgement and injunctions in court, and up to $5,000 for each violation of an order. The same bill adds 63A-16-215, which directs the state's chief information officer to set provenance standards for some public state agency web content where fraudulent media creates a substantial risk of harm.

SB 319: Insurer AI Disclosure in Preauthorization

SB 319, signed March 19, 2026, amends Utah Code 31A-22-650 effective January 1, 2027. An insurer must post on its website a notice that it uses AI in reviewing authorization requests, if it does. It must also disclose that use to the Insurance Department, to each in-network health care provider, and to each enrollee.

The bill's AI language is a disclosure duty, and its limits on who decides do not name AI. Separately, the amended section requires that an adverse preauthorization determination on clinical or medical necessity be made by an individual who knows the condition or consults a specialist who does. That individual must also, except on the specialist route, exercise independent medical judgment, and must not rely solely on recommendations from any other source.

Utah Rule of Evidence 707: Machine-Generated Evidence (HJR 26)

HJR 26 enacted Rule 707 under the Legislature's constitutional power to amend court rules of evidence by a two-thirds vote. It passed the House 66-1-8 on February 26, 2026 and the Senate 27-0-2 on March 6, 2026, and by its terms it took effect on that vote. We did not confirm how the courts' published rule set displays it.

The rule covers machine-generated evidence offered without an expert witness that gives an inference, prediction, classification or conclusion that would fall under Rule 702(b) if an expert testified to it. A court may admit it only if it will help the trier of fact, is based on sufficient facts or data, is the product of reliable principles and methods, and reflects a reliable application of them to the case. It does not apply to the output of a simple scientific instrument.

AI in Utah Government and Policing

Police reports (SB 180, Laws 2025 ch. 330). Utah Code 53-25-902 requires each law enforcement agency to have a policy on employees' use of generative AI. A written police report or other record created wholly or partially with generative AI must carry a disclaimer and the author's certification that the author read and reviewed it for accuracy.

State agencies (Executive Order 2026-08). Governor Cox signed this order on October 6, 2026. It tells covered executive branch agencies to avoid AI that does not adhere to the state's Pro-Human AI principles, to have applicable employees complete AI literacy training, and to document how AI systems are integrated into processes that affect the public. It also has the Department of Government Operations help agencies identify AI uses while ensuring human-in-the-loop review for determinations affecting individual rights. It excludes the Attorney General's Office, the legislative and judicial branches, higher education and some other bodies. It is an order to the executive branch, not a rule binding private businesses.

Utah AI Bills That Died in 2026

HB 286 (AI Transparency Act). The bill would have required developers of certain frontier AI models to publish public safety and child protection plans and report safety incidents, and it included whistleblower protections. Its committee substitute reached models trained with at least 10^26 integer or floating-point operations, defined large frontier developers by revenue of at least $500,000,000, and capped civil penalties at $1,000,000 for a first violation and $3,000,000 for each later one.

The House committee recommended it 8-0-2 on January 27, 2026. It was circled on third reading on February 5, returned to Rules on March 3, and its enacting clause was struck on March 6, 2026. The legislative record shows no passage vote and states no reason.

HB 438 (Companion Chatbot Safety Act). The bill summary describes operator disclosure and data rules, added requirements for minors, annual reports to the office, and Division enforcement. It passed the House 68-1-6 on February 20, 2026. The Senate failed the final substitute 12-15-2 on March 5, and the House struck the enacting clause on March 6. Its terms are not Utah law.

SB 205 (Law Enforcement Artificial Intelligence Amendments). It would have amended the police AI policy rules and required agencies to post their generative AI policies. It passed the Senate 20-0-9 on February 26, 2026, then died in the House on March 6.

Deepfakes and AI Impersonation in Utah

SB 271 (2025) expanded Utah's abuse of personal identity law to cover unauthorized commercial use of simulated or artificially recreated identities, and SB 256 (2026) clarified that defamation law applies to content created through AI. HB 276 adds the Digital Voyeurism Prevention Act (ch. 13-72b) on January 1, 2027, which lets an injured person sue a generation service or covered platform over non-consensual counterfeit intimate images, subject to safe harbors and heightened pleading rules. HB 289 (2026) addresses apparent child sexual abuse material. Our Utah deepfake laws page covers these in detail.

AI Note-Takers and Recording Consent in Utah

Utah's wiretap statute, 77-23a-4, allows a person to intercept a communication if that person is a party or one of the parties has given prior consent, unless the purpose is criminal or tortious. See Utah AI meeting recording laws for how that applies to AI note-takers.

Federal Law and Utah's AI Statutes

As of November 4, 2026, we found no federal statute in the public laws of the 119th Congress that sets general rules for private AI systems or generally preempts state AI laws. In December 2025, Executive Order 14365 directed federal agencies to challenge or discourage state AI laws the administration views as conflicting with national policy, and called for a federal framework from Congress. The order itself does not declare any state law invalid. The Justice Department formed an AI Litigation Task Force in January 2026, the White House issued legislative recommendations in March 2026, and the FTC proposed a policy statement in July 2026. Separately, in April 2026 the Justice Department intervened in a lawsuit against Colorado's AI law under the Civil Rights Act of 1964. We did not find a published Commerce evaluation of state laws in the Federal Register or on ntia.gov, or a BEAD notice carrying the order's AI condition on NTIA's sites.

What Changes in Utah AI Law in 2027

What the July 1, 2027 repeal does and does not reach

Section 63I-2-213(2) reads: "Title 13, Chapter 72, Artificial Intelligence Policy Act, is repealed July 1, 2027." SB 226 and SB 332 each moved that date from May 1, 2025. HB 320 did not change it, and the September 2026 committee recommendation described below does not change it either. The section's only other entry is Chapter 47, an unrelated employer verification law.

So the office, the learning lab and the agreement authority are on the list. Chapters 13-72a, 13-72b, 13-72c and 13-77 are not. A Utah supplier's disclosure duty under Chapter 77 does not lapse with Chapter 72.

Two loose ends deserve attention, and both are our reading of the text rather than anything the Legislature has said:

• Cross-references. Chapters 13-77, 13-72a and 13-72b define terms by pointing to Chapter 72 sections. Chapter 13-72b, for example, takes "artificial intelligence technology" from 13-72-101. A repeal would leave those references aimed at a repealed section. No text we found says how a court would read them, and the Legislature could settle the point by extending Chapter 72 or moving the definitions. Chapter 13-72c carries its own definition of AI.
• Agreements still running. Nolla Health's listed term runs to October 5, 2027, and the two master agreements are open ended. Chapter 72 and 63I-2-213 do not say what happens to an agreement in force on the repeal date. Utah's general rule in 68-3-5 says a repeal does not affect an accrued right, a duty imposed or a penalty incurred, but 13-72-401(8) says a participant has no expectation of a property right or license to participate. We found no authority applying either to these agreements.

One display point can mislead. The Legislature's online code prints "Affected by 63I-2-213 on 7/1/2027" on sections we opened in Chapters 13-72a, 13-72b and 13-72c, as well as Chapter 72. The text of 63I-2-213 names only Chapter 72, and that text is what we rely on. Chapter 13-77 sections we opened carry no such note.

Bills for the 2027 session

On September 16, 2026, the Business and Labor Interim Committee reviewed the AI Policy Act and voted 15-0-5 to recommend renewing it with a new sunset date of July 1, 2037. That is a committee recommendation, not law. July 1, 2027 stays the repeal date unless the Legislature passes a bill that takes effect first.

The office presented its 2026 report at the same meeting, and the Legislature's summary says the report covered recommendations for legislation.

The Legislature's list of committee bill files as of September 21, 2026 showed no AI Policy Act file for that committee. The committee met again on October 21, 2026. Its minutes say the office presented recommendations for policy consideration from the 2026 learning laboratory, and they record no motion on the AI Policy Act. The minutes do not describe those recommendations, and they would not show a bill file opened outside a meeting, so a draft may exist that we did not see. The committee's next meeting is listed for November 18, 2026. The 2027 General Session bill list showed no bills on November 4, 2026, and the session has not convened.

Where to Report an AI Problem in Utah

The office directs reports by type. Send a deceptive business practice to the Division of Consumer Protection, a complaint about a licensed practitioner's conduct to the Division of Professional Licensing, and general concerns about an AI pilot to the Office of AI Policy.

More Utah Laws

Explore other Utah law topics on Recording Law:

• Utah Recording Laws
• Utah Data Privacy Laws
• Utah Whistleblower Laws
• Utah Background Check Laws
• Utah Sexting Laws
• Utah Deepfake Laws
• Utah AI Meeting Recording Laws
• AI Laws by State: The National Tracker

Frequently Asked Questions

Does Utah have an AI law?

Yes. As of November 2026, Utah has several targeted AI laws: the AI Policy Act (SB 149, ch. 13-72), the disclosure rules from SB 226 (ch. 13-77) and the mental health chatbot law (HB 452, ch. 13-72a). HB 276 and SB 319 take effect January 1, 2027. We found no comprehensive or high-risk AI act in a title scan of the 2026 session.

What is the Utah Artificial Intelligence Policy Act?

It is SB 149, signed March 13, 2024 and effective May 1, 2024, codified at Utah Code ch. 13-72. Today that chapter holds the Office of Artificial Intelligence Policy, the learning lab and the regulatory agreements. The consumer disclosure rules moved to ch. 13-77 in 2025 through SB 226.

Is the Utah AI Policy Act being repealed in 2027?

Chapter 13-72, which holds the office and the sandbox, is scheduled for repeal on July 1, 2027 under Utah Code 63I-2-213. The repeal section does not name Chapter 13-77, so the consumer disclosure duties are not on that list. On September 16, 2026, an interim committee voted to recommend renewing the Act with a July 1, 2037 sunset, but that is a recommendation, not law. The 2027 bill list showed no bills on November 4, 2026, and the committee's October 21, 2026 minutes record no motion on the Act.

Do Utah businesses have to disclose that they use AI?

In a consumer transaction, a supplier using generative AI must disclose it if the person makes a clear and unambiguous request. An individual in a licensed or state-certified occupation regulated by the Department of Commerce must prominently disclose generative AI up front in a high-risk AI interaction. A safe harbor applies if the AI itself clearly identifies as AI at the outset and throughout.

What are the penalties under Utah's AI law?

Under Chapters 13-77 and 13-72a, the Division of Consumer Protection may seek or impose up to $2,500 per violation. A violation of an administrative or court order can bring a civil penalty of up to $5,000 per violation. Courts may also order injunctions and disgorgement, and the Division recovers fees and costs if it wins.

Can I sue under Utah's AI disclosure law?

Chapter 13-77 has no private lawsuit provision of its own, but it says it does not displace other remedies, and it makes a violation a violation of 13-11-4(1) of the Utah Consumer Sales Practices Act, which has a consumer action section. HB 276's counterfeit intimate image chapter, effective January 1, 2027, does create a private right of action.

Does Utah ban AI therapy chatbots?

No. HB 452 sets disclosure, data and advertising rules for mental health chatbots. The chatbot must say it is AI and not a human, a supplier may not sell or share health information or user input except in listed cases, and in-conversation ads must be labeled.

What is Utah's AI sandbox?

It is the Artificial Intelligence Learning Laboratory Program under Utah Code ch. 13-72. A company can sign an agreement with the Office of AI Policy and the relevant agency that adjusts or clarifies how a specific rule applies during a test. An initial period may not exceed 12 months, with up to two 12-month extensions. Participation is not a state endorsement.

Can AI prescribe medication in Utah?

Only inside specific sandbox agreements. The office lists renewal or refill pilots for Doctronic, Legion Health and August AI, and a topical acne pilot for Nolla Health. The office's page says Doctronic remains in Phase 1, where a licensed practitioner authorizes every request. The Utah Medical Licensing Board asked in April 2026 that the Doctronic pilot be suspended, and the office and the Division of Professional Licensing answered that they would not suspend it at that time.

Does Utah have a law on AI in hiring?

We found no Utah AI hiring statute in a title scan of the 2026 session, which could miss a provision inside a broader bill. Chapter 13-77's disclosure rules are tied to consumer transactions and regulated occupations, not employment.

What happened to Utah's AI Transparency Act, HB 286?

It did not pass. The House committee recommended it 8-0-2 in January 2026, it was circled on third reading on February 5, and its enacting clause was struck on March 6, 2026. The legislative record shows no passage vote and states no reason.

Does Utah regulate companion chatbots?

Not with a companion chatbot statute. HB 438 failed in the Senate 12-15-2 on March 5, 2026. HB 452 covers mental health chatbots only, though Chapter 13-77's disclosure rules can apply to a chatbot used in a consumer transaction.

When does Utah HB 276 take effect?

January 1, 2027. It adds the Digital Voyeurism Prevention Act (ch. 13-72b) and the Digital Content Provenance Standards Act (ch. 13-72c). The capture device duty applies to devices produced for sale in Utah on or after January 1, 2028.

Must Utah police disclose AI-written reports?

Yes. Under Utah Code 53-25-902, a police report or other law enforcement record created wholly or partially with generative AI must carry a disclaimer and the author's certification that the author read and reviewed it for accuracy.