Utah House Bill 286 (Artificial Intelligence Transparency Amendments)

• Authority: Utah
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Defunct
• Most recent activity date: 2026-03-06

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Governance failure
• AI pursuing its own goals
• AI possessing dangerous capabilities
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Exposure to toxic content
• Fraud, scams, and targeted manipulation
• Competitive dynamics
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 8 subdomains, with strong focus on AI system security (2.2), malicious actors using AI for weapons and cyberattacks (4.2), dangerous AI capabilities (7.2), goal misalignment (7.1), lack of transparency (7.4), and governance structures (6.5). Coverage is concentrated in security, safety incident prevention, and AI safety domains, with particular emphasis on catastrophic risks and child protection.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

This legislation does not regulate AI use within specific economic sectors but rather regulates AI developers themselves (large frontier developers). The companies being regulated operate primarily in Information (AI/tech companies, data processing) and Scientific Research and Development Services (AI model development and research). The law is sector-agnostic regarding end-use applications.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding state statute enacted by the Utah Legislature with mandatory obligations, civil penalties up to $3 million for violations, and designated enforcement through the Attorney General and Office of Artificial Intelligence Policy.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Legislature of the state of Utah
• Summary: The document is explicitly enacted by the Utah State Legislature as stated in the enacting clause, making it a state legislative proposal that becomes binding law upon passage.

Target

• Entity Types: AI_Developer
• Entities: Large frontier developers (frontier developers with annual revenue ≥$500M); Frontier developers (developers using ≥10^26 FLOPs for model training)
• Summary: The document explicitly targets 'large frontier developers' and 'frontier developers' - defined as entities developing AI models using substantial computing resources, which clearly identifies them as AI developers under the taxonomy.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Attorney General of Utah; Office of Artificial Intelligence Policy
• Summary: The Attorney General is explicitly designated to bring civil enforcement actions for violations and recover penalties, while the Office of Artificial Intelligence Policy receives reports, establishes rules, and coordinates enforcement activities.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Office of Artificial Intelligence Policy; Business and Labor Interim Committee
• Summary: The Office of Artificial Intelligence Policy receives ongoing safety incident reports, quarterly risk assessments, and prepares annual reports on implementation. The Business and Labor Interim Committee receives annual reports with recommendations for modifying the law.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers most AI lifecycle stages with primary focus on Deploy and Operate and Monitor stages through mandatory pre-deployment assessments and ongoing incident reporting. It also substantially addresses Plan and Design through required safety planning frameworks, and Verify and Validate through third-party evaluation requirements. The technical scope explicitly focuses on frontier AI models (defined by 10^26 FLOPs compute threshold) and foundation models used in covered chatbots.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• Foundation Models
• Frontier AI
• AI Systems
• Compute Threshold

Technical Scope Summary

The document explicitly focuses on 'frontier models' (foundation models trained with ≥10^26 FLOPs) and 'foundation models' more broadly. It defines specific compute thresholds for determining coverage. The document addresses both model-level and system-level considerations, particularly for chatbot deployments. No explicit mention of open-weight models, general purpose AI, task-specific AI, generative vs predictive AI distinctions.