What is AI regulation in Utah?
AI regulation: countries and regions
Utah regulates AI through a layered framework rather than one sweeping statute. The core law is the Artificial Intelligence Policy Act, which created the Office of Artificial Intelligence Policy and a learning laboratory that can issue temporary regulatory mitigation or joint interpretation agreements. Utah also imposes disclosure and consumer protection duties for generative AI, especially in high-risk regulated services. Unlike Colorado's discrimination-centred approach, Utah leans more on transparency, existing consumer law and supervised pilots.
What this means
In practice, Utah's AI regime does three main things. It gives the state a dedicated office to study AI and supervise novel deployments. It requires certain disclosures when people interact with generative AI. It ties AI use back to ordinary consumer protection and professional regulation rather than treating AI as a separate legal world.
That makes Utah more open to controlled experimentation than some jurisdictions, but it is not hands-off. If a business uses AI in consumer-facing chat, in licensed professional services, or in a project that needs temporary relief from state rules, Utah expects the organisation to be clear about the technology, keep guardrails in place and remain accountable under the laws that still apply.
As of 4 June 2026, the framework reflects the 2024 Artificial Intelligence Policy Act, the 2025 generative AI disclosure rules now codified in Chapter 77, and 2026 amendments that expanded the laboratory to include joint interpretation agreements. The core Act is also scheduled to sunset on 1 July 2027 unless lawmakers extend or replace it.
Why it matters
For founders, operators, advisers and buyers, Utah matters because its triggers are practical rather than abstract. The state asks direct questions. Are you speaking to consumers through generative AI? Are licensed professionals using AI in an interaction that could affect health, money, legal choices or another significant decision? Are you trying to deploy something novel that existing Utah rules do not clearly fit? If so, Utah's framework can change what disclosures, controls and engagement with regulators you need.
It also matters for multistate governance. A company that builds one national AI policy around Colorado-style discrimination assessments or around broad international risk tiers can still miss Utah's distinct features, especially its prompt-based disclosure rule for ordinary consumer chat, its stricter disclosure rule for certain regulated services, and its option to work with the Office of Artificial Intelligence Policy on a supervised pilot rather than wait for generic rulemaking.
How it works
The overall architecture
Utah does not regulate AI through one omnibus code that imposes the same duties on every system. Its architecture is layered. The Artificial Intelligence Policy Act established the institutional framework in 2024. A later chapter now codifies disclosure and enforcement rules for generative AI interactions with consumers and in some regulated services. Utah has also added narrower sector laws for defined use cases, which shows a preference for targeted legislation once the state has gathered evidence from study, guidance or supervised deployment.
The core Act defines AI broadly, but the legal duties that matter most in day-to-day operations are narrower. In other words, Utah's definitions are broad enough to give the state room to govern changing technologies, while the concrete obligations are tied to specific situations such as consumer chat, licensed services, and applications that seek temporary regulatory flexibility.
The Office of Artificial Intelligence Policy
At the centre of the model is the Office of Artificial Intelligence Policy, inside the Utah Department of Commerce. The office is responsible for creating and administering the AI learning laboratory, consulting with businesses and other stakeholders about potential regulatory proposals, making rules needed to administer the laboratory, and reporting annually to the Business and Labor Interim Committee. The office may also publish guidance and best practices for Utah consumers and sectors using AI.
That institutional design matters because Utah is not relying only on after-the-fact enforcement. It has built a standing office whose job is to observe real deployments, produce legislative recommendations, and connect operators with the regulators whose rules may apply. In practical terms, the office acts as both a policy hub and a gateway for controlled experimentation.
Disclosure duties for generative AI
Utah's current disclosure rules focus on generative AI that interacts with individuals. In an ordinary consumer transaction, a supplier must tell the individual that they are interacting with generative AI and not a human if the individual clearly asks or otherwise clearly prompts the supplier about whether AI is being used. That is a narrower trigger than a universal duty to self-identify in every interaction.
The position is stricter for regulated occupations. If a person providing services in a regulated occupation uses generative AI in a high-risk interaction, the provider must prominently disclose that the recipient is interacting with generative AI. The law requires that disclosure verbally at the start of a verbal interaction and in writing before a written interaction begins.
Utah defines a high-risk interaction in practical terms. It includes collecting sensitive personal information such as health, financial or biometric data, and providing personalised recommendations, advice or information that could reasonably be relied upon for significant personal decisions, including financial, legal, medical and mental health matters. The division may also add other applications by rule.
The safest operational route is often broader than the minimum statutory trigger. Utah provides a safe harbour from enforcement of the disclosure section if the AI clearly and conspicuously says at the outset and throughout the interaction that it is generative AI, not human, or an AI assistant. For many organisations, that makes always-on disclosure the cleaner compliance choice even where the bare minimum duty would otherwise arise only after a clear user prompt.
Consumer protection and enforcement
Utah also makes an important accountability point. A business cannot defend a consumer protection violation by saying that the AI made the statement, took the action, or was used in furtherance of the violation. In effect, Utah rejects the idea that AI can sit between a business and legal responsibility.
Violations of the generative AI disclosure chapter also count as violations of Utah's consumer sales practices law. The Division of Consumer Protection administers and enforces the chapter, while the attorney general advises the division and acts as its counsel in enforcement. The division director may impose an administrative fine of up to $2,500 for each violation. Courts may issue injunctions, order disgorgement and other relief, and impose fines of up to $2,500 per violation in an action brought by the division. A person who violates an administrative or court order issued for a chapter violation may face a civil penalty of up to $5,000 for each violation.
This matters in governance terms because Utah does not treat the disclosure chapter as a freestanding etiquette rule. It is wired into established unfair and deceptive practice enforcement. That gives the rules more practical weight than a soft transparency principle on its own.
The learning laboratory and regulatory relief
Utah's distinctive feature is its learning laboratory. The statute says the programme exists to analyse and research AI risks, benefits, impacts and policy implications, encourage responsible deployment in the state, evaluate the viability of current and proposed regulation with AI companies, and produce findings and recommendations for legislation and regulation. The office is required to set a learning agenda and may consult agencies, governmental entities, industries, academic institutions and other knowledgeable public or private actors when doing so.
The 2026 amendments made this mechanism more concrete and more flexible. A participant can now apply not only for a regulatory mitigation agreement, but also for a joint interpretation agreement. A regulatory mitigation agreement is a temporary instrument that permits use or deployment despite a state law or rule that might otherwise impede it, subject to terms. A joint interpretation agreement is different. It clarifies how a state law or rule applies to an AI technology without necessarily creating the same kind of temporary mitigation.
These agreements are not open-ended. The law requires them to specify scope limits, safeguards, any mitigation granted, required disclosures to consumers, and reporting necessary for office audits. Participants remain subject to every legal and regulatory requirement that the agreement does not expressly waive, modify or clarify. The office must carry out regular audits while an agreement is in force. The state does not treat participation as endorsement or approval, and the office may terminate an agreement at any time.
Time limits are also built in. An initial demonstration period for a regulatory mitigation agreement or joint interpretation agreement may not exceed 12 months. A participant may request another 12-month extension, but the office must decide before the current period expires. The structure is therefore experimental and temporary by design, not a back door to permanent deregulation.
How Utah differs from Colorado
Utah's model is often easier to understand by contrast. Colorado built its AI regime around algorithmic discrimination in consequential decisions. That is a different organising logic from Utah's. Utah does not impose a broad statewide duty on developers and deployers to prevent discriminatory effects in consequential decisions as the central feature of its framework.
The contrast is even clearer now that Colorado is in transition. Colorado's attorney general explains that the 2024 law created consumer protections against algorithmic discrimination in consequential decisions by high-risk AI systems, and that Senate Bill 26-189, signed in May 2026, repeals and reenacts those provisions with a new automated decision-making technology framework due to take effect on 1 January 2027. Utah, by comparison, continues to centre its statewide model on transparency, consumer protection accountability, professional-service disclosure and supervised pilots. For multistate teams, that means Utah is not just a lighter version of Colorado. It is a differently structured regime.
What is still provisional
Utah's approach is durable enough to plan around, but parts of it remain provisional. First, the core Artificial Intelligence Policy Act is set to sunset on 1 July 2027 unless the legislature renews or replaces it. That signals that lawmakers still view the institutional framework as something to monitor and refine.
Second, some operational detail can still move through rulemaking and agreement terms. The office has rulemaking authority over participant disclosures, reporting and administration of the learning laboratory. The Division of Consumer Protection, in consultation with the office, may also specify which forms of disclosure do or do not satisfy the safe harbour. Finally, older materials may cite earlier section numbers or older chapter numbers, so teams should verify current codification before relying on a summary prepared in 2024 or 2025.
Examples
ElizaChat in schools. Utah's first regulatory mitigation agreement involved ElizaChat, a Utah company with an AI-supported mental health application. The official pilot page says the app may be rolled out in phases in participating school districts. The pilot includes risk assessments, escalation to trusted adults for high-risk situations, clear disclosures about AI use and limits, data privacy and security standards, parental consent, and continuing oversight from the Office of Artificial Intelligence Policy and the Division of Professional Licensing. The app is framed as a support tool, not a replacement for clinicians.
Doctronic prescription renewals. Utah later approved a Doctronic pilot for routine prescription refills. The office's pilot page says the AI may handle 30-day, 60-day and 90-day renewals for medications that have already been prescribed, under physician oversight and with identity and prescription verification controls. The same page says the tool may not issue new prescriptions, handle controlled or addictive substances, or change treatment plans. This is a good example of Utah using a tightly scoped agreement with explicit guardrails rather than a broad sector-wide exemption.
Learning agenda to targeted legislation. The Office of Artificial Intelligence Policy says its first learning agenda focused on AI in mental health. The office's policy work page presents House Bill 452 as legislation that followed that research and stakeholder engagement. That shows Utah's preferred sequence: study a use case, gather input, issue guidance where appropriate, and then legislate more narrowly for a defined risk area rather than start with one universal duty for all AI.
Common misunderstandings
"Utah has a single omnibus AI law." Not really. The Artificial Intelligence Policy Act is the core institutional framework, but disclosure duties and some sector-specific rules sit in separate chapters.
"Every chatbot in Utah must always announce itself in the first message." Not under the general consumer rule. For ordinary consumer transactions, the duty is triggered when the individual clearly asks whether AI is being used. Always-on disclosure is a safer compliance choice because it can fit the safe harbour, but it is not always the minimum statutory baseline.
"A mitigation agreement means the state has approved the product." No. Utah law says participation in the learning laboratory, including signing an agreement, does not amount to state endorsement or approval.
"A sandbox agreement switches off the rest of the law." No. Participants remain subject to all legal and regulatory requirements that are not expressly waived, modified or clarified, and they can still face civil or criminal exposure where the agreement does not protect them.
"Utah has copied Colorado." No. Colorado's model is organised around discrimination in consequential decisions. Utah's core model is organised around transparency, consumer protection accountability, regulated-service disclosure and supervised pilots.
Risks and boundaries
Utah's general disclosure law mainly addresses conversational generative AI and the way people experience those interactions. It is not a complete framework for every analytics tool, recommendation engine or internal decision support system used behind the scenes. Many non-conversational uses of AI still sit mostly under existing privacy, consumer, employment, health and professional conduct rules.
A disclosure is also not enough on its own. Where a licensed professional uses AI, the underlying duties of the regulated occupation still apply. Utah says that expressly. So an organisation cannot treat an AI notice as a substitute for supervision, competence, recordkeeping, privacy controls, advertising compliance or professional judgment.
The learning laboratory is powerful, but it is discretionary and temporary. Agreements can be tailored narrowly, audited, limited in time, or terminated. They do not bind federal regulators, and they do not erase private claims or every other state law. They are therefore best understood as a controlled governance tool, not a blanket permission slip.
There is also live legislative uncertainty. The core Act is scheduled to sunset on 1 July 2027, and Utah has already amended and renumbered parts of its AI laws since first enactment. That does not make the current framework unstable in day-to-day use, but it does mean serious teams should verify current text and sections rather than rely on older summaries or cached references.
What to do next
Map every Utah-facing AI interaction first. Separate ordinary consumer chat from high-risk regulated-service use. For the latter, build verbal and written disclosures into intake and service workflows, and make sure licensed staff remain responsible for the service itself. For broader consumer chat, decide whether to use always-on notices so that you are closer to the safe harbour rather than waiting for users to ask whether AI is involved. Review advertising, privacy and consumer protection controls so that AI is never treated as a shield. If a novel deployment is blocked by state rules or falls into a grey area, assess whether engagement with the Office of Artificial Intelligence Policy, a joint interpretation agreement or a regulatory mitigation agreement is appropriate. Finally, track the 1 July 2027 sunset and later Utah amendments so your governance model does not freeze around an outdated version of the statute.
FAQs
Does Utah have one comprehensive AI law?
No. Utah has a core institutional law, the Artificial Intelligence Policy Act, plus separate disclosure and enforcement rules for generative AI interactions and some narrower sector statutes.
When must a business tell a customer they are talking to AI?
In an ordinary consumer transaction, the business must disclose AI use if the individual clearly asks or otherwise clearly prompts the business about whether AI is being used. Many businesses will still choose always-on disclosure because it aligns better with Utah's safe harbour.
When is upfront disclosure mandatory?
Upfront disclosure is required when a person in a regulated occupation uses generative AI in a high-risk interaction. The law requires a verbal notice at the start of a verbal interaction and a written notice before a written one begins.
What counts as a high-risk AI interaction in Utah?
The statute points to practical triggers, especially collecting health, financial or biometric data, or providing personalised advice or information that could reasonably be relied upon for significant financial, legal, medical or mental health decisions.
Who enforces Utah's AI disclosure rules?
The Division of Consumer Protection enforces the disclosure chapter, and the Utah attorney general advises and represents the division in that work.
What is the AI learning laboratory?
It is Utah's official programme for studying AI use cases, supervising limited real-world deployments, and feeding lessons back into guidance, legislation and regulation.
What is a joint interpretation agreement?
It is a 2026 addition to Utah's framework. It allows the Office of Artificial Intelligence Policy and the relevant regulator or government body to clarify how a state law or rule applies to a specific AI deployment.
Is Utah's AI Policy Act permanent?
No. The Act is currently scheduled to sunset on 1 July 2027 unless the legislature renews or replaces it.