Utah AI Mental Health Chatbot Regulation (HB 452)
Effective date
Penalty
Enforced by Utah Division of Consumer Protection. Fines up to $2,500 per violation plus disgorgement in some cases. Affirmative defenses exist for compliant…
Obligations mapped
3 obligations
Overview
Regulates AI-powered mental health chatbots. Requires clear disclosure that the service is not a human clinician, limits certain advertising during therapeutic-style conversations, and restricts sharing identifiable health information. Specific disclosure timing: before user can access the chatbot, after 7 days without use, and whenever asked by the user. Health data restrictions: businesses cannot share or sell individually identifiable health information or user input with third parties, except as necessary for chatbot function or to health providers with user consent under HIPAA. Advertising restrictions: ads delivered through chatbot must be disclosed, and no user input can be used to decide whether to advertise or to customize ads. Affirmative defense requires actual policy filing with the Division of Consumer Protection, not only having a policy on file internally.
This is an AI-specific state law.
See if this regulation applies to your company with the free exposure scan.
Who this applies to
This regulation applies to the following roles:
- Developers of covered AI systems
- Deployers and users of covered AI systems
- Organizations operating in Utah
This regulation applies to both companies that build AI products and companies that use AI tools from other vendors.
Utah Code § 13-72a-203(1), (2)(a) · Utah Code § 13-72a-203(1), (2)(b) and related sections
AI categories covered
- Healthcare AI
- Consumer-facing AI
Specific AI use cases:
- Companion, relationship, or social chatbots
What this requires you to do
3 obligations identified from statutory analysis.
Utah Code § 13-72a-203(1), (2)(c)
Utah Code § 13-72a-203(1), (2)(a)
Utah Code § 13-72a-203(1), (2)(b)
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.
Enforcement and penalties
Enforced by Utah Division of Consumer Protection. Fines up to $2,500 per violation plus disgorgement in some cases. Affirmative defenses exist for compliant programs.
Penalty amounts are based on statutory text and may be subject to adjustment, judicial interpretation, or enforcement discretion.
Legislative history
effective
Takes effect
signed
Signed by Governor Cox
Related regulations
- In EffectAI-Specific
Illinois HB 1806 / WOPRA - AI in Mental Health Therapy
Restricts AI use in mental health therapy contexts under Illinois WOPRA and related professional standards. Targets AI chatbot platforms marketed as mental health tools. Verification of enacted text details (including signed status, final effective date, and penalty structure) remains pending against the enrolled primary source.
Effective
- In EffectAI-Specific
New York AI Companion Models Law (A3008, Article 47)
Requires AI companion operators to disclose AI nature, provide reminders every 3 hours of use, and implement protocols to detect suicidal ideation or self-harm and refer users to crisis services. Carries the highest per-day penalties of any US AI law at $15,000 per day. Penalties fund the NY suicide prevention fund. Unlike California SB 243, the New York law does not include a private right of action.
Effective
- In EffectPrivacy ADM
Utah Consumer Privacy Act, Profiling Provisions (SB 227)
Utah's comprehensive privacy law. It is the least restrictive state privacy law regarding profiling and ADM among comparable statutes: it includes opt-out for targeted advertising and sale of personal data, but does not include a general profiling opt-out or ADM impact assessment requirement. No universal opt-out mechanism requirement. Trackers sometimes incorrectly list Utah as having ADM provisions similar to other states.
Effective
- UpcomingAI-Specific
Washington AI Chatbot Safety for Minors (HB 2225)
First-in-nation law requiring AI chatbot operators to disclose AI nature at regular intervals (every 3 hours for adults, every hour for minors) and implement safety measures to protect minors from manipulation, explicit content, and emotional exploitation. Includes self-harm and crisis protocols. Targets conversational AI engagement patterns specifically.
Effective
- In EffectAI-Specific
Utah Artificial Intelligence Policy Act (SB 149)
SB 332 extended the act's sunset from May 7, 2025 to July 1, 2027. SB 226 NARROWED disclosure requirements (not added). General consumer transactions now require disclosure only upon clear and unambiguous request. Regulated occupations require proactive disclosure for high-risk artificial intelligence interactions involving sensitive data or significant decisions. Safe harbor: if the AI system itself clearly and conspicuously discloses at the outset and throughout the interaction that it is nonhuman or AI, the entity is not subject to enforcement action. See Utah AI Policy Act Amendments (SB 226) for the 2025 amendments.
Effective
- In EffectAI-Specific
Utah AI Policy Act Amendments (SB 226 / SB 332)
SB 226 narrowed UAIPA disclosure: general consumer contexts require disclosure only on a clear and unambiguous request; regulated occupations still require proactive disclosure for high-risk artificial intelligence interactions (sensitive data and significant decisions). SB 332 extended the act's sunset from May 7, 2025 to July 1, 2027. Safe harbor unchanged: no enforcement if generative AI clearly and conspicuously discloses it is nonhuman at the outset and throughout the interaction. Applies together with the Utah Artificial Intelligence Policy Act (SB 149).
Effective
- In EffectAI-Specific
Utah Unauthorized AI Impersonation (SB 271)
Expands Utah's abuse of personal identity law to cover AI-generated deepfakes and digital replicas used for commercial purposes without consent. Prohibits distributing software primarily designed for unauthorized commercial impersonation. Covers AI-generated simulations of voice, video likeness, and audiovisual appearance. Not limited to deepfakes: it covers commercial misuse of personal identity including non-AI methods. First Amendment exemptions for newsworthiness, artistic expression, and parody. The software distribution prohibition targets nudification apps and similar tools.
Effective
Utah AI regulation guide lists every tracked rule for this jurisdiction with timelines and obligation tallies.
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.