Utah AI Policy Act Compliance 2026: Generative AI Disclosure Rules
Utah was the first US state to pass a broad, enforceable generative-AI law — and while it's shorter and lighter than the EU AI Act, it has real teeth. Its core principles are simple: disclose when customers are talking to AI, hold a higher bar in regulated professions, and never treat "an AI did it" as an excuse. If you run a chatbot or any customer-facing generative AI that touches Utah consumers, here's what applies.
The Two-Tier Disclosure Rule
The heart of the Utah Artificial Intelligence Policy Act is a disclosure regime that splits by who you are. For ordinary businesses, the rule is reactive: if a consumer asks whether they're dealing with a human or generative AI, you must clearly and conspicuously tell them it's AI. You don't have to volunteer it unprompted for every interaction.
For people in regulated occupations — licensed professionals like those in healthcare, accounting, law-adjacent services, and other state-licensed fields — the bar is higher. They mustproactively and prominently disclose, at the start of the interaction, that a consumer is dealing with generative AI rather than a human. No waiting to be asked.
Which Tier Are You In?
- •Licensed healthcare and telehealth providers
- •Accountants and financial professionals
- •Mental-health and counseling services
- •Other state-licensed/certified occupations
- •Must disclose AI up front, before interaction
- •Applies to AI used in the regulated service
- •Ecommerce and retail support chatbots
- •SaaS and marketing AI assistants
- •General customer-service automation
- •Lead-gen and sales AI agents
- •Must disclose AI when a consumer asks
- •Clear, conspicuous response required
"The AI Did It" Is Not a Defense
The Act's most quietly important provision isn't about disclosure at all — it's about liability. Utah clarified that using generative AI does not excuse a violation of the state's consumer- protection statutes. If your AI chatbot makes a deceptive claim, an unauthorized promise, or a misleading statement to a consumer, your business is liable exactly as if a human employee had said it. You can't point at the model. This closes the loophole companies hoped AI might open and makes chatbot governance a direct legal-risk issue, not just a UX one.
Utah Built an Agency Around It
Utah didn't just pass a law — it created the Office of Artificial Intelligence Policy and a regulatory "AI Learning Lab" / sandbox. The sandbox lets companies test AI products under regulatory mitigation agreements, potentially reducing penalty exposure while they iterate. For an AI-forward business, that's a feature worth knowing: Utah is one of the few jurisdictions actively offering a supervised path to deploy novel AI rather than only threatening enforcement.
The Compliance Checklist
If You Run Customer-Facing AI
- ☐Build an instant, clear 'yes, this is AI' response path
- ☐Train chatbots to answer 'are you a bot?' truthfully
- ☐Review chatbot outputs for deceptive/unsubstantiated claims
- ☐Log conversations for consumer-protection defense
- ☐Audit marketing AI for misleading statements
- ☐Assign an owner for AI consumer-protection risk
If You're in a Regulated Occupation
- ☐Add up-front, prominent AI disclosure to every interaction
- ☐Disclose before the consumer engages, not on request
- ☐Coordinate with your licensing board's AI guidance
- ☐Document the disclosure for audit purposes
- ☐Keep a human-in-the-loop for regulated advice
- ☐Consider the Utah AI sandbox for novel use cases
How It Fits the Wider US AI Patchwork
Utah's law is narrower than Colorado's risk-based AI Act or California's transparency rules, but it landed first and set a template other states are watching: disclosure plus a clear statement that AI doesn't dilute existing liability. If you operate across multiple states, the practical move is to comply with the strictest applicable rule — proactive AI disclosure and clean, non-deceptive chatbot outputs everywhere — rather than maintaining a different chatbot configuration per state.
Frequently Asked Questions
We're a SaaS company with a support chatbot. Do we have to label it as AI up front?
If you're not in a state-regulated occupation, no — you must disclose it's generative AI when a Utah consumer asks, clearly and conspicuously. Up-front proactive disclosure is required of licensed/regulated professionals. That said, proactively labeling your bot is low-cost and removes ambiguity, so many companies do it anyway.
Our chatbot promised a customer a refund we don't actually offer. Are we liable?
Yes. The Utah AI Policy Act makes clear that generative AI is not a defense to consumer-protection violations. A deceptive or unauthorized statement by your chatbot is treated as your business's statement. This is exactly why output review and conversation logging matter.
What counts as a 'regulated occupation' for the proactive-disclosure rule?
It refers to occupations that require a license or state certification to practice — healthcare providers, accountants, mental-health professionals, and similar fields overseen by Utah licensing authorities. If your service requires a professional license, assume the heightened proactive-disclosure duty applies and check your board's specific AI guidance.
Can we test an AI product in Utah without full penalty exposure?
Potentially. Utah's Office of Artificial Intelligence Policy runs a regulatory sandbox / AI Learning Lab that lets approved participants test AI under a regulatory mitigation agreement, which can limit certain penalties during the testing period. It's an application-based program, not an automatic exemption.
Small Law, Real Teeth
The Utah AI Policy Act is far shorter than the EU AI Act, but it's enforceable today and it closes the "blame the AI" loophole outright. The two things to get right: be ready to disclose AI clearly (proactively if you're in a regulated profession), and make sure your AI's consumer-facing statements would survive a consumer-protection review.
If you operate nationally, treat Utah's rules as a floor and standardize honest, well-governed AI interactions everywhere — the rest of the state patchwork is converging on the same idea.