Utah Artificial Intelligence Policy Act (SB 149, as amended in 2025)

Applies To

Overview

Utah's SB 149 took effect on 1 May 2024. It required anyone using generative AI in matters enforced by the Division of Consumer Protection to disclose that use clearly if the consumer asked. People in regulated occupations had to disclose it upfront, verbally at the start of a conversation or in writing before a written exchange. In 2025, SB 226 repealed that section from 7 May 2025 and moved the duties to a new chapter. Suppliers must still disclose generative AI use when a consumer asks. Regulated professions must now disclose upfront only before high-risk AI interactions. SB 226 also added a disclosure safe harbor and gave the Division rulemaking power on disclosures. Separately, SB 332 extended the Act's sunset from 1 May 2025 to 1 July 2027. The Act has its own penalties: administrative fines of up to $2,500 per violation, plus court remedies including injunctions and disgorgement. Violating an administrative or court order can bring a further $5,000 per violation. The Office of Artificial Intelligence Policy runs an AI learning laboratory, recommends legislation, and can make rules only for that laboratory.

Key Requirements

• •Disclose generative AI use to a consumer when asked, in transactions the Division of Consumer Protection oversees.
• •Regulated professions must disclose AI use upfront before high-risk AI interactions (since May 2025).
• •A disclosure safe harbor and Division rulemaking on disclosure form were added in 2025.
• •Fines reach $2,500 per violation, and $5,000 per violation of an administrative or court order.
• •The Office of Artificial Intelligence Policy runs an AI learning laboratory and can make rules only for it.
• •The Act is set to expire on 1 July 2027 unless extended.

What Your Organization Must Do

• →Map where your business uses generative AI with Utah consumers in consumer protection matters.
• →Build a process to disclose generative AI use clearly whenever a consumer asks.
• →Identify regulated occupation staff who must disclose AI use upfront before high-risk AI interactions.
• →Review the 2025 disclosure safe harbor and align your disclosure wording with it.
• →Watch for Division of Consumer Protection rules on the form of required disclosures.
• →Diarize the 1 July 2027 sunset date and track any extension before planning long term.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

Which businesses does Utah SB 149 actually cover?

Businesses using generative AI with consumers in matters the Division of Consumer Protection oversees, and people in regulated occupations such as licensed professions in Utah.

Does Utah SB 149 require proactive AI disclosure or only disclosure upon request?

It is mostly on request: businesses must disclose generative AI use when a consumer asks. Regulated professions must disclose upfront, and since May 2025 only before high-risk AI interactions. The law has no rule against an AI denying it is AI.

What penalties apply if a company violates Utah SB 149's disclosure requirements?

The Act has its own penalties. The Division can fine up to $2,500 per violation, courts can add fines, injunctions, and disgorgement, and violating an order can cost $5,000 per violation.

How does Utah SB 149 compare to the FTC's guidance on AI disclosure?

Utah's law creates specific state disclosure duties, while the FTC acts under its general ban on unfair or deceptive practices. Utah's rules are clearer about when AI use must be disclosed.

What is the Utah Office of Artificial Intelligence Policy and can it issue binding rules?

It runs an AI learning laboratory, consults stakeholders, and recommends legislation. It can make rules only to run the laboratory, not binding guidance for businesses generally.

Does Utah SB 149 impose obligations on third-party AI vendors whose technology a business deploys?

The statute places disclosure obligations on the deploying entity, not the AI vendor directly. However, if a vendor's system fails to meet disclosure requirements, the deploying business remains liable. Vendor contracts should include explicit representations and warranties requiring the vendor to support compliance with Utah SB 149 disclosure standards.