Utah AI Law Explained From the Statute: What Is in Force Now

Short answer: yes, Utah's artificial intelligence (AI) laws are in force today, but they are narrower than most guides say. Utah has no single AI act. The disclosure rules for businesses sit in Utah Code chapter 13-77 and have no end date. The Artificial Intelligence Policy Act, chapter 13-72, creates a state office and a program for testing AI under relaxed rules. It is set to be repealed on July 1, 2027. A business must say it is using AI only when a customer clearly asks, or when a licensed professional uses AI in a high-risk way. This is not legal advice. Ask a lawyer whether it applies to you.

TL;DR

• Status on October 5, 2026: the consumer disclosure chapter (13-77) is in force and has no end date in the code.
• Same for: the mental health chatbot chapter (13-72a).
• Ends in 2027: the Policy Act (13-72), the state office and test program, is repealed on July 1, 2027 unless the legislature acts.
• Who enforces: the Division of Consumer Protection, with the attorney general as its lawyer. Fines run up to $2,500 per violation.
• What changed: a 2025 law cut back the 2024 disclosure rule. A 2026 law reworked the testing program.
• Old citations: many guides cite section 13-2-12. That section was repealed on May 7, 2025.
• Different model: Utah asks for honest answers about AI. Colorado and Texas write duties and bans.

Why older Utah AI guides are out of date

Utah passed its first law aimed at generative AI in 2024. The legislature changed it in 2025 and again in 2026. The 2024 rule lived in section 13-2-12. The current rule lives in a new chapter. The testing program was reworked, and its chapter number changed along the way.

Section 13-77-101(4) defines generative AI. It is a system that "is trained on data" and is "designed to simulate human conversation." It also "generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight." A fixed menu bot does not fit.

The dates, in order

I read the enrolled bills, meaning the final text both chambers passed. I also read the code's history lines and the official Utah Code, the state's published set of laws, on October 5, 2026.

• March 13, 2024: Senate Bill (S.B.) 149 signed. It was Laws of Utah 2024, chapter 186. It took effect May 1, 2024. It created the Policy Act, added section 13-2-12, and set a repeal date of May 1, 2025.
• December 2, 2024: a Department of Commerce news release announced the office's first test agreement, with a company called ElizaChat.
• May 7, 2025: three acts took effect. S.B. 226 (chapter 465) repealed section 13-2-12, enacted the new disclosure chapter, and moved the Policy Act repeal date to July 1, 2027. S.B. 332 made the same date change, and the code's history note for section 63I-2-213 credits chapter 277. House Bill (H.B.) 452 (chapter 269) added the mental health chatbot chapter.
• May 6, 2026: H.B. 320 took effect. It reworked the Policy Act's testing program.
• May 6, 2026: S.B. 38 took effect. It renumbered the consumer protection division's chapter and amended four AI sections that refer to the division. Some parts start July 1, 2026.
• July 1, 2027: Title 13, chapter 72 is repealed under section 63I-2-213 unless lawmakers change it.

What this means for you: cite chapter 13-77 for the disclosure rule, since section 13-2-12 is gone, and treat July 1, 2027 as a date to recheck.

The enrolled S.B. 226 numbered the new chapter 13-75. The code editors renumbered it 13-77 to avoid a clash with another 2025 act, as the note under section 13-77-103 says. For how acts become code sections, see what a session law is.

What the disclosure rules require today

Section 13-77-103 has two duties.

Consumer transactions. A supplier is a seller, lessor, broker or similar person who regularly deals in consumer transactions (section 13-11-3). A consumer transaction is a sale, lease or other transfer of goods or services, mainly for personal, family or household use. Securities (stocks, bonds and similar investments) and insurance are left out. A supplier that uses generative AI with a customer in such a transaction "shall disclose" that the person "is interacting with generative artificial intelligence and not a human." The duty applies "if the individual asks or otherwise prompts the supplier." The question must be "a clear and unambiguous request to determine whether the interaction is with a human or with artificial intelligence." So there is no duty to announce AI unprompted.

Licensed professions. A regulated occupation is a job that the Department of Commerce oversees and that needs a license or state certification. A person in one must "prominently disclose" AI use in regulated services if the use is high-risk. The disclosure must be spoken at the start of a verbal exchange and written before a written one.

A high-risk AI interaction is one that collects health, financial or biometric data (such as a face scan or fingerprint). It is also one that gives personal advice that could be relied on for a significant decision, such as financial, legal, medical or mental health advice (section 13-77-101(5)).

The 2024 rule was wider. Old section 13-2-12(4) said a person providing a regulated service "shall prominently disclose when a person is interacting with a generative artificial intelligence." It had no high-risk limit. The 2025 law added one.

A safe harbor is a way to avoid enforcement. Section 13-77-104 protects a business whose AI "clearly and conspicuously" says at the start, and throughout, that it is AI, is not human, or is an AI assistant.

Duties at a glance

Most businesses need to check three things: what a customer chatbot says when asked, whether licensed staff use AI in a high-risk way, and whether a product is a mental health chatbot.

The testing program: deals that relax a rule during a test

This is the part Utah is known for. The Office of Artificial Intelligence Policy sits inside the Department of Commerce. It runs a "learning laboratory" (section 13-72-301). A company that wants to test AI under a rule it might break can apply for a regulatory mitigation agreement. That is a time-limited deal with the office. Section 13-72-101 says it lets a participant use AI "despite a law or rule that might impede or interfere with that use." It can set a cure period, which is extra time to fix a problem before a penalty. It can cut fines during the test, or add other terms.

H.B. 320 added the joint interpretation agreement. That is a deal among the company, the office and an agency that "clarifies the application" of a rule to AI. Under section 13-72-403, a first agreement lasts up to 12 months. The office may grant up to two 12-month extensions. In 2024 only one extension was allowed.

The limits matter. A participant "remains subject to all legal and regulatory requirements not expressly waived" in the deal (section 13-72-401(7)). The office can end an agreement "at any time and for any reason." Taking part is not state approval. The state is not liable for what a participant does. The office lists its agreements on the Department of Commerce website.

One item to watch. Sections 13-77-101(1) and 13-72a-101 borrow their definition of "artificial intelligence technology" from section 13-72-101, which is in the chapter set for repeal in 2027. I found no provision that moves that definition. The legislature may address it in 2027, so recheck both chapters after the next session.

Enforcement, penalties and private lawsuits

The Division of Consumer Protection enforces chapter 13-77, and the attorney general acts as its lawyer (section 13-77-105). A violation "constitutes a violation of Subsection 13-11-4(1)," which bars deceptive acts by a supplier. The penalties are:

• An administrative fine, meaning a fine set by the agency itself, of up to $2,500 per violation.
• In court, a fine of up to $2,500 per violation. A court may also order an injunction, which is an order to stop. It may order disgorgement, which means giving back money earned from the violation. It can pay that money to injured people.
• The division's attorney fees and costs, if it wins.
• Up to $5,000 per violation for breaking an order.

The mental health chatbot chapter uses the same amounts (section 13-72a-204).

Chapter 13-77 says nothing about private lawsuits. Section 13-77-106 keeps other remedies under state and federal law. The Consumer Sales Practices Act has its own section on lawsuits by consumers, section 13-11-19. Whether a consumer can use it for an AI disclosure violation is a legal question I did not resolve. Do not assume consumers can sue under chapter 13-77, and do not assume they cannot. Ask a lawyer.

Section 13-77-104(2) lets the division write rules on disclosure forms. I found no such rule in the Utah Administrative Code, the state's published agency rules, on October 5, 2026. The office's own rules, R166-72, date from July 9, 2024. They predate H.B. 320.

How Utah differs from Colorado and Texas

Think of three models. Colorado wrote duties for software that shapes big decisions about people. Texas wrote a list of banned aims. Utah wrote a truthful-answer rule for chatbots and licensed professionals, and then built a program where firms can test AI under watch. Utah does not require a company to test an AI tool for bias, write a formal risk report, or disclose what data trained the tool.

The federal government has not displaced any of this. Executive Order 14365, signed December 11, 2025, sets up a Justice Department task force to challenge state AI laws. In its text, the only state law it names is Colorado's. An executive order is an order from the president to federal agencies. It cannot repeal a Utah statute.

A worked example

A Utah online shop runs a sales chatbot. A shopper types, "Am I talking to a real person?" That is a clear request. The bot must say it is AI. If the bot only greets people and nobody asks, the chapter sets no duty to announce it. Now take a licensed professional whose AI intake assistant collects health details. That use is high-risk. The professional must say so aloud at the start of a call, or in writing before a chat begins.

Utah AI law: what a business should check

1. Find every chatbot or voice agent that talks to Utah customers. Test whether it answers "Are you a human?" truthfully.
2. If you hold a license from the Department of Commerce, mark any AI use that collects health, financial or biometric data or gives advice. Add the spoken or written notice.
3. If you run a mental health chatbot, check the three rules in chapter 13-72a.
4. Cite chapter 13-77. Section 13-2-12 was repealed.
5. If your product needs relief from a Utah rule, ask the office about an agreement before launch.
6. Put July 1, 2027 on your calendar and check for a bill in the 2027 session.

What goes wrong

The usual error is quoting the 2024 rule. Another is assuming the Policy Act is the disclosure law. It is not. The Policy Act builds the office and the test program. A third is treating a sandbox deal as a permit. The statute says it is not state approval.

How to check the current text

Read the section on the Utah Legislature's site. Check the line at the bottom that says "Amended by Chapter." It names the act that last changed it. Then compare it with the repeal list in section 63I-2-213. To cite Utah law, see how to find and cite Utah law. This guide is part of US Law Data: The Complete Guide.

FAQ

Is the Utah AI law in effect? Yes. The disclosure chapter took effect May 7, 2025. The Policy Act chapter is in force until July 1, 2027, unless the legislature extends it.

Do I have to tell customers my chatbot is AI? Only if they clearly ask during a sale. A licensed professional must also say so for high-risk AI use. You can earn a safe harbor by saying it up front and throughout.

What is the Utah Artificial Intelligence Policy Act? It is Title 13, chapter 72. It creates the state AI office and a test program. The program can ease rules for a company during a test. The business disclosure rules are not in it.

When does the Utah AI Policy Act end? Section 63I-2-213 repeals chapter 13-72 on July 1, 2027. The consumer disclosure chapter has no repeal date in that section.

What is a regulatory mitigation agreement? It is a time-limited deal with the state office that lets a company test AI despite a rule that might block it. It can set a cure period or lower fines.

What are the penalties? Up to $2,500 per violation, plus injunctions, disgorgement, fees, and up to $5,000 for breaking an order.

Can I sue under Utah's AI law? The chapter does not say. Only the division is given enforcement powers. Section 13-77-106 keeps other remedies open. Whether a consumer can sue under the older Consumer Sales Practices Act for an AI violation is a question for a lawyer.

Can I sue under Utah's AI law? The chapter does not say. Only the division is given enforcement powers. Section 13-77-106 keeps other remedies open. Whether a consumer can sue under the older Consumer Sales Practices Act for an AI violation is a question for a lawyer.

Does the federal order on state AI laws cancel Utah's law? No. Only the legislature or a court can end a state statute. Utah's chapters stay in force until one of them acts.

If you build or buy tools that need statute text and its amendment history, start with the US primary law API.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill AI: the pipelines that pull statutes, regulations and court rules from every US jurisdiction's official publisher, and the REST API, MCP server and open dataset that serve them.