Utah H.B. 286 Artificial Intelligence Transparency Amendments

• Authority: Utah
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Proposed
• Most recent activity date: 2026-03-06

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Governance failure
• AI pursuing its own goals
• AI possessing dangerous capabilities
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Fraud, scams, and targeted manipulation
• Loss of human agency and autonomy
• Competitive dynamics
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8-10 subdomains, with strong focus on malicious actors (4.2, 4.3), AI system security (2.2), governance structures (6.5), and AI safety failures (7.1, 7.2, 7.4). Coverage is concentrated in security, catastrophic risk prevention, child safety, and transparency domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Scientific Research & Development Services

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Educational Services
• National Security

All other sectors had no coverage in this document.

Sectors Summary

This legislation primarily governs large frontier AI developers operating in the Information and Scientific Research and Development Services sectors. The law does not regulate AI use in specific downstream sectors like healthcare or finance, but rather regulates the entities that develop frontier AI models regardless of their eventual application domains.

Legislative Status

Hard Law

Legislative Status Summary

This is binding state legislation enacted by the Utah Legislature with mandatory obligations ('shall'), civil penalties up to $3,000,000 for violations, and enforcement by the Attorney General. It creates legally enforceable requirements with clear sanctions and monitoring mechanisms.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Utah Legislature
• Summary: This is state legislation enacted by the Utah Legislature as indicated by the standard legislative enactment language and bill designation (H.B. 286).

Target

• Entity Types: AI_Developer
• Entities: Large frontier developers (frontier developers with affiliates having annual revenue of at least $500,000,000)
• Summary: The legislation explicitly targets 'large frontier developers' defined as entities that train frontier models using at least 10^26 FLOP and have annual revenue of at least $500 million. The requirements apply to their development, deployment, and operation of frontier AI models and covered chatbots.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Office of the Attorney General; Office of Artificial Intelligence Policy
• Summary: The Attorney General has explicit authority to bring civil actions to recover penalties, while the Office of AI Policy receives reports, establishes reporting mechanisms, and coordinates enforcement activities.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Office of Artificial Intelligence Policy; Business and Labor Interim Committee; law enforcement agencies; public safety agencies
• Summary: The Office of AI Policy receives quarterly reports, maintains a reporting mechanism, prepares annual reports to the Legislature, and can transmit reports to various government bodies. The Business and Labor Interim Committee receives annual reports with recommendations. Law enforcement and public safety agencies receive reports of imminent critical safety incidents.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document covers multiple lifecycle stages with primary focus on deployment, operation and monitoring. It requires public safety and child protection plans during the planning/design phase, addresses model building through compute thresholds and training requirements, emphasizes verification through third-party assessments and risk evaluations, mandates publications before deployment, and establishes comprehensive ongoing monitoring through incident reporting and quarterly assessments.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• Foundation Models
• Frontier AI
• Compute Threshold

Technical Scope Summary

The document explicitly defines and focuses on frontier models (trained with 10^26 FLOP), foundation models (trained on broad data, designed for generality, adaptable to wide range of tasks), and artificial intelligence models generally. It establishes compute thresholds and addresses model weights, chatbots, and cybersecurity. It does not explicitly mention general purpose AI, task-specific AI, generative AI, predictive AI, or open-weight models.