introduction
Amendments to the Utah Artificial Intelligence Policy Act (UAIP) will come into effect on May 7, 2025. These amendments provide a major update to Utah’s 2024 Artificial Intelligence (AI) Act. In particular, this amendment focuses on AI regulation in the areas of consumer protection (SB 226 and SB 332), mental health applications (HB 452), and fraudulent spoofing (aka “deepfake”) (SB 271).
Background (SB 149)
In March 2024, Utah became one of the first states to enact a comprehensive artificial intelligence law with the passage of the Utah Artificial Intelligence Policy Act (UAIP, SB 149) to specifically address AI. These provisions, commonly referred to as the “Utah AI Act,” pose important obligations to businesses using AI systems to interact with Utah consumers. The UAIP Act came into effect as of May 1, 2024.
If you are providing or using software or services powered by AI accessed by Utah residents, you should understand these requirements even if you are not based in Utah. This post will help you break down these important revisions and what it means to your business operations.
defined by genai
Utah law defines the generator AI (genai) as a system trained with (a) data. (SB 149, 13-2-12(1)(a)).
Transparency and disclosure requirements
If the company provides services in a regulated occupation (i.e., an occupation that requires that you obtain a state accreditation or license to practice that occupation), the company shall disclose when interacting with Genai on the provision of regulatory services, if defined by law as “high risk.” Disclosures regarding regulated services are provided at the initiation of an interaction and are disclosed either verbally or in writing during oral interactions. If Genai suppliers want the benefits of a safe harbor, the use of AI systems will be disclosed at the start of the interaction and throughout the exchange of information. (SB 226).
If a company uses Genai to interact with people in Utah in a “unregulated” occupation, the company must make it clear that it is interacting with the Genai system, not the human when asked by Utah consumers.
SB 226 Additionally, they added the mandatory requirements for high-risk interactions related to health, financial and biometric data, or provided personalized advice in areas such as finance, legal, and healthcare. Additionally, SB 226 has granted the consumer protection department authority to create rules to specify the required form and method of disclosure.
Enforcement and penalties
Utah’s Consumer Protection Department could impose administrative fines of up to $2,500 for each UAIP violation. The court or Utah Attorney General may also impose a civil penalty of up to $5,000 for each violation of a court or executive order. As SB 226 revealed, violations of the law are subject to injunctive relief, aversion to benefits, and payment of departmental attorneys’ fees and costs.
Key takeout
The 2024 Act requires that companies make clear and prominent disclosures when they are asked or requested by people who interact with AI systems when they are interacting with genai. The restrictions will be even closer when using genai in a regulated occupation that includes sensitive personal information or important personal decisions in the high risk category revised under SB 226 in 2025. In these cases, the Company shall disclose its use of genai. If the supplier requires the benefit of a 2025 Safe Harbor under SB 226, the AI System shall disclose its use at the start of the interaction and throughout the interaction.
Conclusion
Utah, along with several other states, took the lead in enacting AI-related laws. State may continue to regulate AI technology ahead of the federal government.
Stay tuned for subsequent blog posts that provide the latest updates on mental health applications (HB 452) and fraudulent spoofing (aka “deepfake”).
