Utah’s AI Policy Act: the lightest lift, with a catch

Utah was first. When the Utah Artificial Intelligence Policy Act (UAIPA), SB 149, took effect on May 1, 2024, it became the first comprehensive state AI law in the country. It is also, by design, one of the lightest. If you have been bracing for Utah to look like Colorado or the EU, relax — and then read the catch, because there is one, and it sits exactly where most companies are least prepared: the consumer-facing chatbot.

Utah’s approach is disclosure-based, not risk-classification-based. It does not ask you to audit models, file impact assessments, or prove your training data. It asks a simpler question: when a person is talking to your AI, do they know it is an AI? The 2025 amendments — SB 226, SB 332, and HB 452, all effective May 7, 2025 — did not expand that duty. They narrowed it, and added an easy way out. For most businesses this is the lightest lift in the United States. But “light” is not “nothing,” and you cannot honor a disclosure rule on a chatbot you have never inventoried.

The core duty: tell people they’re talking to AI

The heart of the Act is straightforward. A person who uses generative AI to interact with a consumer must disclose that the consumer is dealing with AI and not a human. As originally written, that disclosure was triggered on request. SB 226 tightened the trigger: you must disclose only in response to a “clear and unambiguous” consumer request. Generative AI was also redefined to cover AI designed to simulate human conversation with consumers — which points the law squarely at chatbots and conversational agents rather than back-office models.

So for an ordinary consumer-facing business, the baseline duty is modest: if a customer clearly asks whether they are talking to a person or a machine, answer honestly. That is the floor.

The catch: regulated occupations and high-risk interactions

The duty is heavier for state-licensed professions — healthcare, legal, financial services, and the like. Those regulated occupations must proactively and prominently disclose generative-AI use, not just answer when asked. But SB 226 narrowed even this. The proactive duty now applies only to “high-risk artificial intelligence interactions,” defined as interactions that do any of the following:

• Collect sensitive personal information — health, financial, or biometric data.
• Provide personalized recommendations or advice a consumer could reasonably rely on for a significant personal decision.
• Provide financial, legal, medical, or mental-health advice or services.

If you operate in a licensed field and your AI touches any of those, the proactive-disclosure duty is real and concrete. This is the catch: the lightest-touch state law in the country still reaches hard into the interactions that matter most — the ones where a consumer is handing over sensitive data or leaning on advice for a consequential decision.

The safe harbor: just disclose up front

Here is what makes Utah genuinely easy to satisfy. SB 226 added a safe harbor: there is no enforcement of the disclosure provisions if the generative AI itself clearly and conspicuously discloses that it is not human — that it is an AI or AI assistant — at the outset of the interaction and throughout it. In plain terms: if your chatbot opens by saying it is an AI and keeps that clear, you are protected. You do not have to wait to be asked, and you do not have to parse whether a given exchange is “high-risk.” Disclose up front and throughout, and the disclosure rules are self-executing in your favor.

This is a rare gift in AI regulation: a rule you can fully comply with by changing one line of your bot’s greeting and persona. The catch is that it only works if you actually do it on every consumer-facing bot — which again requires knowing how many you have and where they live.

Two more pieces: the sunset and mental-health chatbots

SB 332 matters for planning: it extended the Act’s sunset to July 1, 2027. If you heard the law was expiring, that is out of date — it remains in force, and you should treat it as durable, not temporary.

HB 452 added targeted protections for users of mental-health chatbots. Suppliers of these tools may not advertise during interactions unless the advertising is disclosed, and may not sell or share individually identifiable health information collected from users. If you run a mental-health or wellness chatbot, this is a distinct, concrete obligation on top of the general disclosure rule — and it lands in exactly the “high-risk” territory the Act is most serious about.

Who enforces it

Enforcement sits with the Utah Division of Consumer Protection, working with the Attorney General, and runs through administrative fines. Utah also stood up an Office of Artificial Intelligence Policy and an “AI Learning Laboratory” — a regulatory-mitigation sandbox — signaling a state that wants to encourage AI deployment while keeping a light regulatory hand. That posture is the whole character of the law: permissive, disclosure-first, and narrowed further in 2025.

An honest limitation

We are describing Utah as light-touch, and it is — but “light” can lull a company into doing nothing, which is the wrong lesson. The amendments narrowed the law, yet they left fully intact the parts that bite: proactive disclosure in licensed, high-risk interactions and the HB 452 rules for mental-health bots. And the safe harbor, easy as it is, only protects bots you have actually configured to disclose. The sunset is now 2027, and Utah, like every state here, will keep amending. Dates and details move. None of that changes the foundation: you can only honor a disclosure rule on AI you have inventoried.

Utah is, for most companies, the easiest state AI law to satisfy — a disclosure rule with a one-line safe harbor. But it reaches hardest into consumer chatbots, regulated professions, and mental-health tools, which are precisely the systems firms tend to deploy through vendors and lose track of. The work that protects you here is the same work that protects you everywhere: know which AI talks to your customers, and make sure each one says what it is.

This briefing is general information from Sentinel Assurance Group, not legal advice. Regulatory dates and requirements change — we maintain these briefings, but verify against primary sources and counsel before acting. Last reviewed June 11, 2026.

See how a Gap Assessment maps your exposure →