Utah AI Policy Act Amendments (SB 226 / SB 332)
Effective date
Penalty
Administrative fine up to $2,500 per violation (Division of Consumer Protection). Court or AG civil penalty up to $5,000 per violation of court or administra…
Obligations mapped
5 obligations
Overview
SB 226 narrowed UAIPA disclosure: general consumer contexts require disclosure only on a clear and unambiguous request; regulated occupations still require proactive disclosure for high-risk artificial intelligence interactions (sensitive data and significant decisions). SB 332 extended the act's sunset from May 7, 2025 to July 1, 2027. Safe harbor unchanged: no enforcement if generative AI clearly and conspicuously discloses it is nonhuman at the outset and throughout the interaction. Applies together with the Utah Artificial Intelligence Policy Act (SB 149).
This is an AI-specific state law.
See if this regulation applies to your company with the free exposure scan.
Who this applies to
This regulation applies to the following roles:
- Deployers and users of covered AI systems and tools
- Organizations operating in Utah
This regulation applies to companies that use or deploy AI tools and systems built by other vendors. If your company uses AI-powered products in the areas listed below, this regulation may apply to you.
SB 149
AI categories covered
- Consumer-facing AI
Specific AI use cases:
- Chatbots and virtual assistants
- Content generation
What this requires you to do
5 obligations identified from statutory analysis.
Utah Code 13-75-104(2); 13-75-101(5)(c)
Utah Code 13-75-102
Utah Code 13-75-104
Utah Code 13-75-103(2)-(3)
Utah Code 13-75-103(1)
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.
Enforcement and penalties
Administrative fine up to $2,500 per violation (Division of Consumer Protection). Court or AG civil penalty up to $5,000 per violation of court or administrative order.
Penalty amounts are based on statutory text and may be subject to adjustment, judicial interpretation, or enforcement discretion.
Legislative history
sunset
Law sunsets unless extended again
effective
2025 amendments take effect
amended
SB 226 (narrows disclosure triggers) and SB 332 (extends sunset to July 1, 2027) signed
effective
SB 149 takes effect. Office of AI Policy established.
Related regulations
- In EffectAI-Specific
Utah Artificial Intelligence Policy Act (SB 149)
SB 332 extended the act's sunset from May 7, 2025 to July 1, 2027. SB 226 NARROWED disclosure requirements (not added). General consumer transactions now require disclosure only upon clear and unambiguous request. Regulated occupations require proactive disclosure for high-risk artificial intelligence interactions involving sensitive data or significant decisions. Safe harbor: if the AI system itself clearly and conspicuously discloses at the outset and throughout the interaction that it is nonhuman or AI, the entity is not subject to enforcement action. See Utah AI Policy Act Amendments (SB 226) for the 2025 amendments.
Effective
- In EffectPrivacy ADM
Utah Consumer Privacy Act, Profiling Provisions (SB 227)
Utah's comprehensive privacy law. It is the least restrictive state privacy law regarding profiling and ADM among comparable statutes: it includes opt-out for targeted advertising and sale of personal data, but does not include a general profiling opt-out or ADM impact assessment requirement. No universal opt-out mechanism requirement. Trackers sometimes incorrectly list Utah as having ADM provisions similar to other states.
Effective
- In EffectAI-Specific
Utah AI Mental Health Chatbot Regulation (HB 452)
Regulates AI-powered mental health chatbots. Requires clear disclosure that the service is not a human clinician, limits certain advertising during therapeutic-style conversations, and restricts sharing identifiable health information. Specific disclosure timing: before user can access the chatbot, after 7 days without use, and whenever asked by the user. Health data restrictions: businesses cannot share or sell individually identifiable health information or user input with third parties, except as necessary for chatbot function or to health providers with user consent under HIPAA. Advertising restrictions: ads delivered through chatbot must be disclosed, and no user input can be used to decide whether to advertise or to customize ads. Affirmative defense requires actual policy filing with the Division of Consumer Protection, not only having a policy on file internally.
Effective
- In EffectAI-Specific
Utah Unauthorized AI Impersonation (SB 271)
Expands Utah's abuse of personal identity law to cover AI-generated deepfakes and digital replicas used for commercial purposes without consent. Prohibits distributing software primarily designed for unauthorized commercial impersonation. Covers AI-generated simulations of voice, video likeness, and audiovisual appearance. Not limited to deepfakes: it covers commercial misuse of personal identity including non-AI methods. First Amendment exemptions for newsworthiness, artistic expression, and parody. The software distribution prohibition targets nudification apps and similar tools.
Effective
Utah AI regulation guide lists every tracked rule for this jurisdiction with timelines and obligation tallies.
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.