Utah Advances AI Regulation with Focus on Consumer Protection and High-Risk Use Cases

Utah Advances AI Regulation with Focus on Consumer Protection and High-Risk Use Cases

According to an article by David Wright Tremaine, Utah has positioned itself at the forefront of state-level AI regulation alongside California and Colorado. While other states take broader approaches, Utah has focused on targeted rules, particularly around consumer interactions with generative AI (GenAI) and AI-powered services in high-risk settings. 

A new set of laws enacted in March 2025 builds upon the state’s 2024 AI Policy Act, refining transparency requirements, creating new obligations for mental health chatbot providers, and expanding prohibitions on unauthorized impersonation through AI.

Central to the new legislation are amendments to the AI Policy Act, which previously required businesses to make blanket disclosures when using GenAI in consumer interactions. Senate Bill 226 narrows that requirement to situations where consumers clearly ask whether they are interacting with AI. 

For regulated occupations, such as healthcare and financial services, “prominent” disclosures are now mandated when GenAI is used in high-risk interactions involving sensitive personal data or individualized advice. A statutory safe harbor is also available to companies that proactively make clear disclosures during these interactions. Meanwhile, Senate Bill 332 extends the law’s expiration date to July 2027.

Separately, House Bill 452 introduces strict regulations for AI-enabled mental health chatbots. These tools must clearly disclose their non-human nature, are barred from targeting users with undisclosed ads, and cannot share user inputs without consent. Violations can result in significant penalties, including fines and injunctive relief.

Finally, Senate Bill 271 expands Utah’s impersonation law to cover AI-generated likenesses, including voice and video. It also bans tools primarily intended to produce unauthorized impersonations, while preserving fair use protections.

For risk managers, the article says these developments highlight the need for robust compliance strategies as AI regulation becomes more specific and enforcement-ready. Businesses deploying GenAI tools, especially in sensitive contexts, should assess their disclosure practices, user consent protocols, and content moderation policies to mitigate legal exposure.