Utah SB 226 (Artificial Intelligence Consumer Protection Amendments 2025)

• Authority: Utah
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2025-03-27

Risk subdomain coverage

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• False or misleading information
• Fraud, scams, and targeted manipulation
• Overreliance and unsafe use
• Lack of transparency or interpretability

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of risk domains, primarily addressing consumer protection aspects related to transparency and disclosure requirements. It touches on privacy concerns (2.1) through requirements for high-risk AI interactions involving sensitive data, and has implicit minimal coverage of misinformation risks (3.1) through liability provisions. The document does not substantively address most AI risk domains as it focuses on procedural disclosure requirements rather than risk mitigation.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Finance & Insurance
• Professional & Technical Services
• Health Care & Social Assistance

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Trade, Transportation & Utilities
• Information
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This legislation governs AI use across multiple sectors through two primary mechanisms: (1) broad consumer transaction requirements applicable to Trade, Transportation and Utilities, Information, Finance and Insurance, and Professional and Technical Services sectors, and (2) specific requirements for regulated occupations which primarily affect Health Care and Social Assistance, Professional and Technical Services, and Finance and Insurance sectors.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding state statute enacted by the Utah Legislature with mandatory disclosure requirements, enforcement mechanisms including administrative fines up to $2,500 per violation and court-imposed fines up to $5,000 for violating orders, and designated enforcement authority to the Division of Consumer Protection and Attorney General.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: This is a state bill enacted by the Legislature of the state of Utah, as indicated in the enactment clause and the document structure showing it as Utah SB 226.

Target

• Entity Types: AI_Deployer, AI_Developer
• Summary: The bill explicitly targets suppliers that use generative AI to interact with individuals in consumer transactions and individuals providing regulated services who use generative AI, particularly in high-risk interactions.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: The bill explicitly grants enforcement authority to the Division of Consumer Protection and assigns the Attorney General to provide legal advice and act as counsel. The division director can impose administrative fines and bring court actions.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The Division of Consumer Protection is responsible for administering and enforcing the chapter, which includes monitoring compliance. The Office of Artificial Intelligence Policy is consulted in rulemaking regarding disclosure methods.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Deploy and Operate and Monitor stages of the AI lifecycle. It focuses on disclosure requirements when generative AI is deployed in consumer transactions and regulated services, and establishes ongoing monitoring and enforcement mechanisms through the Division of Consumer Protection.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• Generative AI

Technical Scope Summary

The document explicitly defines and focuses on 'generative artificial intelligence' as AI systems trained on data that simulate human conversation through text, audio, or visual communication and generate non-scripted outputs. It also references the broader term 'artificial intelligence technology' by cross-reference to another statute. The document does not mention frontier AI, general purpose AI, foundation models, predictive AI, open-weight models, or compute thresholds.