Although other states and jurisdictions have implemented laws and regulations to address certain aspects of AI use in business scenarios, Colorado was the first to enact a broader, more comprehensive set of rules and restrictions on private companies using AI statewide. Since then, other states appear to have noticed, notably Utah.
The first version of the Utah Artificial Intelligence Policy Act (UAIPA) was enacted on March 13, 2024, introducing regulatory measures to govern the use of generative artificial intelligence (GenAI) in consumer interactions. The original law primarily focused on disclosure obligations whenever consumers interact with AI. Recent amendments to UAIPA provide more distinct guidelines and regulations to Utah’s AI laws, branching out to focus on other areas such as mental health applications and unauthorized impersonations.
Overview of amendments to Utah’s AI policies
The 2025 amendments to UAIPA were introduced through Senate Bill 226, Senate Bill 332, House Bill 452, and Senate Bill 271, refining the scope of AI regulations in Utah. All four legislations took effect on May 7, 2025. These changes impact businesses and entities that use GenAI systems to interact with Utah consumers.
Key elements of the combined bills
- UAIPA sunset date extended: The law’s expiration date has been moved from May 7, 2025, to July 1, 2027.
- Revised disclosure requirements: Disclosure requirements are more clearly defined and distinct depending on the use case scenario.
- High-risk AI interactions defined: Establishes a statutory safe harbor for businesses that comply with disclosure rules.
- Unauthorized AI-generated impersonations prohibited: Expanded restrictions and definitions on deepfakes are included.
Updated compliance requirements for employers
- AI use disclosure: In most general use cases defined by the original 2024 UAIPA scope, businesses are now only required to disclose AI interactions upon a "clear and unambiguous" consumer request.
- Mental health chatbot compliance: Employers are required to adhere to advertising, disclosure, and privacy rules specific to mental health chatbots.
- Safe harbor compliance for generative AI: Systems using generative AI must clearly disclose their nonhuman nature at the outset and throughout interactions.
Enforcement and penalties
- Administrative fines: The Utah Division of Consumer Protection may impose fines of up to $2,500 per violation.
- Civil penalties: Courts or the Utah Attorney General may impose fines of up to $5,000 per violation.
- Additional legal consequences: Violations may result in injunctive relief, disgorgement of profits, and payment of additional attorney fees.
The evolution of statewide AI regulation
While Utah and Colorado are leading the way in terms of more comprehensive statewide AI business regulations and guidelines, there appears to be a growing wave of regulations for businesses throughout 2025 and moving into 2026. Below are a few other states that have recently enacted or signed upcoming AI laws that will go into effect soon:
The recent amendments to Utah’s AI regulations may set a future precedent for other consumer protection and ethical AI use as states continue to navigate and evolve in uncharted territories. Businesses operating or dealing with consumers in multiple states should meet with their legal counsel to ensure compliance with evolving state laws regarding the regulation of AI.
This content is for informational purposes only and shall not constitute legal opinion or advice. Consult your legal counsel to ensure compliance.
