Utah Artificial Intelligence Policy Act (SB 149)

Applies To

Overview

The Utah Artificial Intelligence Policy Act applies to persons and entities operating in regulated occupations, as defined under Utah law, and to businesses engaging consumers in covered transactions where AI is used to interact directly with individuals. The core disclosure obligation requires that any person who knows they are communicating with an AI system must be informed of that fact upon request, and that AI systems must proactively identify themselves as AI in certain consumer-facing contexts. Failure to comply with disclosure requirements may expose entities to liability under the Utah Consumer Sales Practices Act, including remedies available to the Utah Division of Consumer Protection. The Act establishes the Office of Artificial Intelligence Policy to develop voluntary and mandatory guidance, engage stakeholders, and recommend future legislative or regulatory action. Enforcement is primarily channeled through the existing consumer protection framework rather than a standalone AI enforcement body. The effective date of the Act is May 1, 2024, following signature by the Governor.

Key Requirements

• •Disclose AI involvement upon request when an individual interacts with an AI system in the context of a regulated occupation or consumer transaction
• •AI systems must proactively identify themselves as AI and not deny being an AI when sincerely asked by a user
• •Entities that violate consumer protection laws through AI use without required disclosure face liability under the Utah Consumer Sales Practices Act
• •Businesses must maintain practices sufficient to ensure AI disclosure obligations are met across customer-facing deployments
• •The Office of Artificial Intelligence Policy may issue guidance that creates additional compliance expectations for covered entities
• •Penalties follow Utah Consumer Sales Practices Act enforcement mechanisms, which include civil remedies and Division of Consumer Protection investigative authority

What Your Organization Must Do

• →Audit all customer-facing AI deployments immediately to identify any interaction points within regulated occupations or consumer transactions where AI disclosure is not already present, prioritizing completion before or by May 1, 2024 effective date.
• →Implement a proactive AI identification protocol in all consumer-facing AI systems so that the system identifies itself as AI at the start of interactions and never denies being an AI when a user sincerely asks, assigning the Chief Compliance Officer or General Counsel to verify implementation.
• →Establish a documented request-response disclosure mechanism ensuring that any consumer who asks whether they are interacting with an AI receives a clear, affirmative answer in real time, and train customer service and technical teams on this requirement.
• →Update consumer protection compliance policies and vendor contracts to explicitly incorporate Utah SB 149 disclosure obligations, holding third-party AI vendors contractually accountable for meeting the same disclosure standards applied internally.
• →Designate a point of contact to monitor guidance and rulemaking issued by the Utah Office of Artificial Intelligence Policy within the Department of Commerce, reviewing new guidance as released and updating internal compliance procedures within 30 days of any material issuance.
• →Review litigation and enforcement risk under the Utah Consumer Sales Practices Act by mapping existing AI use cases against the statute's coverage and confirming that the legal team is prepared to respond to Division of Consumer Protection inquiries or civil claims related to AI disclosure failures.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

Which businesses does Utah SB 149 actually cover?

The law covers persons and entities operating in regulated occupations under Utah law and businesses that use AI to interact directly with consumers in covered transactions. It applies to both large enterprises and small businesses, so scope turns on whether your operations involve a regulated occupation or a direct consumer-facing AI interaction in Utah.

Does Utah SB 149 require proactive AI disclosure or only disclosure upon request?

Both. AI systems must proactively identify themselves as AI in consumer-facing contexts and must never deny being an AI when sincerely asked. Additionally, any individual who requests confirmation that they are communicating with an AI must receive a clear affirmative response in real time.

What penalties apply if a company violates Utah SB 149's disclosure requirements?

There is no standalone AI penalty structure. Violations are enforced through the Utah Consumer Sales Practices Act, which exposes entities to civil remedies and investigation by the Utah Division of Consumer Protection. The severity of exposure depends on the nature and scale of the deceptive AI use.

How does Utah SB 149 compare to the FTC's guidance on AI disclosure?

Utah SB 149 creates a state-level statutory obligation with defined liability triggers, whereas FTC guidance on AI transparency operates through broader unfair or deceptive acts or practices authority without a dedicated AI disclosure rule. Utah's law is more specific about the request-response and proactive identification requirements, giving compliance teams a clearer compliance standard at the state level.

What is the Utah Office of Artificial Intelligence Policy and can it issue binding rules?

The Office sits within the Utah Department of Commerce and is responsible for developing guidance, engaging stakeholders, and recommending future legislative or regulatory action. Its guidance may be voluntary or mandatory, so compliance teams should monitor issuances closely and treat mandatory guidance as creating enforceable obligations once published.

Does Utah SB 149 impose obligations on third-party AI vendors whose technology a business deploys?

The statute places disclosure obligations on the deploying entity, not the AI vendor directly. However, if a vendor's system fails to meet disclosure requirements, the deploying business remains liable. Vendor contracts should include explicit representations and warranties requiring the vendor to support compliance with Utah SB 149 disclosure standards.