Utah Artificial Intelligence Policy Act (SB 149, amended by SB 226 / SB 332 / HB 452): AI Compliance Requirements

When using generative AI (defined since SB 226 as AI designed to simulate human conversation) in a consumer transaction, you must clearly and conspicuously disclose AI involvement when the consumer makes a clear and unambiguous request to know whether they are interacting with a human or AI. Safe harbor: no enforcement action lies if the AI itself clearly and conspicuously identifies as non-human at the outset and throughout — voluntarily self-identifying up front is the conservative best practice.

When using generative AI in a regulated occupation (state-licensed/certified professions, e.g. legal, medical, mental health, accounting), you must proactively and prominently disclose that the consumer is interacting with AI — not a human — at the outset of any "high-risk artificial intelligence interaction." Since SB 226 (eff. May 7, 2025) a high-risk interaction is one that (a) collects sensitive personal data (health, financial, or biometric) or (b) provides personalized advice the consumer could reasonably rely on for a significant personal, financial, legal, or health decision. Routine, low-risk regulated-occupation interactions no longer trigger proactive disclosure, but disclosing at the outset of every interaction remains the conservative best practice and qualifies for the safe harbor.

Do not use generative AI to deceive or defraud consumers. The Act extends existing Utah Consumer Sales Practices Act fraud prohibitions to AI-generated interactions.

If you operate a mental health chatbot: (1) Disclose AI nature at start of every interaction and whenever asked. (2) Do not advertise products during interactions without labeling. (3) Do not sell or share individually identifiable health information or user inputs with third parties (except necessary contractors or with user consent).

Utah SB 271 (2025, "Unauthorized Artificial Intelligence Impersonation Amendments," eff. May 7, 2025) amends the Abuse of Personal Identity Act to cover AI-generated impersonation: "personal identity" now expressly includes an individual's video likeness, voice, and audiovisual appearance, and any simulation, reproduction, or artificial recreation of these via generative AI, computer animation, digital manipulation, or other technological means. Using a real person's AI-simulated identity without consent in advertising, fundraising, solicitation of donations, or the marketing/sale of products, merchandise, goods, or services is prohibited. Remedy is civil under Utah Code § 45-3-4: injunctive relief, actual damages, and attorney fees; the identity-abuse chapter separately preserves potential criminal prosecution under the distinct Utah Criminal Code § 76-9-407, though SB 271 itself creates no new criminal offense.

IN FORCE. Utah SB 73 ("Online Age Verification Amendments", 2026 General Session) rebuilt Utah Code Title 78B, Chapter 3, Part 10 into an enforced regime. WHO IT BINDS: a "commercial entity" — corporation, LLC, partnership, limited partnership, sole proprietorship or other legally recognized entity — that knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website containing a "substantial portion" of such material, defined at § 78B-3-1001 as more than 33-1/3% of total material on the website. A rebuttable presumption of substantial portion arises if the entity markets or brands the website as primarily providing such material, uses a website name, domain name or subdomain indicating it does, or advertises or promotes such material as a primary feature. THE CORE DUTY (§ 78B-3-1002(1)(a)): perform reasonable age verification methods to verify the age of an individual attempting to access the material. Note the drafting change SB 73 made — the old text imposed liability only "if the entity fails to" verify; the amended text states the duty affirmatively and moves liability into § 78B-3-1003, which is what let the Division of Consumer Protection be given enforcement power over it. THREE FURTHER DUTIES: (a) § 78B-3-1002(2) — neither the commercial entity nor any third party performing the verification may RETAIN any identifying information of the individual after access has been granted; (b) § 78B-3-1002(4), NEW — the entity may not facilitate or encourage use of a VPN, proxy server or other means to circumvent age verification, including by providing instructions on how to use a VPN or proxy to reach the website, or means for individuals in Utah to circumvent geofencing or blocking; (c) § 78B-3-1002(3), NEW — an individual counts as accessing from Utah if actually located in Utah "regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual's geographic location", so a VPN in the request path is not a defence and geo-blocking by IP alone will not discharge the duty. SAFE HARBOR (§ 78B-3-1006): a commercial entity is DEEMED IN COMPLIANCE if it uses an age verification method meeting standards established by Division rule under § 78B-3-1005 — the Division may make rules on third-party age-verification services, user privacy and data security, verifying the reliability and accuracy of methods, and retaining, protecting and securely disposing of information obtained. Track that rulemaking: it is the only route to deemed compliance. EXEMPTIONS: § 78B-3-1002(5) exempts bona fide news or public-interest broadcasts, website video, reports or events and preserves news-gathering organisations' rights; § 78B-3-1002(6) provides that no internet service provider, ISP affiliate or subsidiary, search engine or cloud service provider violates the section solely by providing access or connection to a website or to a facility, system or network not under its control, to the extent it is not responsible for creating the content.

IMMINENT — effective 1 October 2026 under the express special effective-date clause at SB 73 § 22(3), which lists §§ 59-35-101 through 59-35-105 (and § 59-1-403) as taking effect on that date while the rest of the bill took effect 6 May 2026. SB 73 § 8 creates a new Utah Code Title 59, Chapter 35, "Covered Entity Excise Tax". WHO OWES IT: a "covered entity", defined at § 59-35-102(1) as a commercial entity that is REQUIRED TO PERFORM AGE VERIFICATION UNDER SECTION 78B-3-1002 — so liability for the tax is bolted directly onto the age-verification trigger in the requirement above, and nothing else. There is no separate registration test, revenue floor or nexus test in the chapter. THE RATE AND BASE (§ 59-35-103): "An excise tax is imposed on a covered entity in an amount equal to 2% of the sales price of covered transactions," payable by the covered entity to the State Tax Commission. READ THE BASE CAREFULLY — it is broader than the harmful material that made the entity covered. A "covered transaction" (§ 59-35-102(2)) is amounts paid to or charged by a covered entity for access to digital images, digital audio-visual works, digital audio works, digital books, OR GAMING SERVICES, including the streaming of or subscription for access to any of those, regardless of the delivery method and regardless of whether the amount buys single-use access or subscription access (including a right terminating on a condition). The definition is not limited to material harmful to minors, so once an entity is covered, its whole digital-access revenue stream from Utah-facing transactions of these types is in the base. HOW IT IS TRIGGERED — THIS IS NOT SELF-ASSESSMENT BY DEFAULT: § 59-35-104(7) provides that the Commission administers the tax "based on referrals of covered entities from the division", and § 78B-3-1004(7) requires the Division of Consumer Protection to notify the Commission IN WRITING of any commercial entity it determines is required to perform age verification under § 78B-3-1002. A Division determination is therefore the event that puts an entity on the Commission's roll — and it is the same determination that exposes the entity to the § 78B-3-1004 fines, so a single Division finding opens both the enforcement and the tax fronts at once. FILING MECHANICS (§ 59-35-104): the Commission administers, collects and enforces the tax under Title 59 Chapter 1 (General Taxation Policies) and by the same procedures used for Chapter 12 Part 1 (Tax Collection). A covered entity that collects the tax must remit to the Commission, IN AN ELECTRONIC FORMAT APPROVED BY THE COMMISSION, both the tax due in the previous QUARTER and the tax return (§ 59-35-104(2)(a)) — so the default cadence is quarterly electronic filing. Override: if the covered entity is already required to file a Utah sales and use tax return, it must instead file the return and remit this tax on the SAME SCHEDULE as its sales-and-use tax filing (§ 59-35-104(2)(b)), which for most filers means aligning this tax to an existing return cycle rather than standing up a separate quarterly one. RECORDS: a covered entity must maintain records of covered transactions sufficient to determine the amount of tax due for THREE YEARS (§ 59-35-104(3)) — build the transaction-level retention before 1 October 2026, because the base spans every covered-transaction type, not just the material that triggered coverage. WHERE THE MONEY GOES (§ 59-35-105): the Division of Finance deposits 90% of receipts into the new Minor Mental Health Restricted Account (distributed to the Department of Health and Human Services for minors' mental-health treatment, parent/educator/minor education, early prevention and intervention, and research and public awareness) and 10% into the Minor Online Safety Restricted Account created at § 78B-3-1007, which funds Division enforcement; if that account exceeds $4,000,000 at the close of a fiscal year the excess transfers back to the Minor Mental Health account.

Utah's Office of Artificial Intelligence Policy runs a voluntary programme under which a business that uses or wants to deploy AI technology in Utah may apply for either a regulatory mitigation agreement — which permits the use or deployment despite a law or rule that might impede or interfere with it, and may set cure-period terms before penalties are assessed, reduced civil fines during the demonstration period, or other tailored terms — or, new under HB 320, a joint interpretation agreement, an agreement between the participant, the Office, and a relevant agency or governmental entity that clarifies how a provision of state law or rule applies to your AI technology. HB 320 (2026 General Session, effective May 6, 2026) restructured the programme: it moved the application route into Utah Code § 13-72-401 (renumbered from § 13-72-302, with §§ 13-72-303 and 13-72-305 renumbered to §§ 13-72-402 and 13-72-403 and § 13-72-304 repealed), dropped the old invitation-and-acceptance "learning laboratory" gating and its application-fee/data-usage rulemaking, and widened the counterparties beyond state agencies to "governmental entities" — the judiciary, state-funded higher education and public education, and political subdivisions. Executing an agreement creates binding duties on you: the agreement must specify limitations on the scope of your use (which may include the number and types of users and geographic limitations), the safeguards you will implement, any required disclosures to consumers, and reporting requirements to comply with audits from the Office; the Office must perform regular audits of your application of the AI technology while the agreement remains in effect; and you remain subject to all legal and regulatory requirements not expressly waived or modified by the agreement or clarified in the joint interpretation agreement. The Office may terminate an agreement at any time and for any reason. HB 320 also newly authorises the Office to publish guidance and best practices for Utah consumers, and requires it to report executed agreements annually to the Business and Labor Interim Committee before November 30 — so agreement terms are not confidential from the legislature.