Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Utah AI Policy Act

Amended Utah · In force May 1, 2024 · next deadline Jul 1, 2027 (in 8 months)

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Coming up
SunsetJul 1, 2027 · in 8 months · Source
Scheduled repeal of Title 13, Ch. 72SB 332 extends the AI Policy Act repeal date from May 1, 2025 to July 1, 2027.
Already passed
Takes effectMay 7, 2025 · 18 months ago · Source
SB 226 amendments effectiveDisclosure duties narrowed (on clear request or high-risk interactions), safe harbor added, provisions recodified in Title 13, Ch. 75.
Takes effectMay 1, 2024 · 2.5 years ago · Source
AI Policy Act effectiveGenerative AI disclosure duties and the Office of AI Policy take effect.

Summaries for reference, not legal advice. Check the official text.

What it does

Makes businesses liable under Utah consumer protection law for deceptive acts committed through generative AI. Businesses must disclose generative AI use when a consumer clearly and unequivocally asks, and must disclose it proactively in high-risk interactions and regulated-occupation services. The act created the Office of Artificial Intelligence Policy and a regulatory learning lab. In 2025, SB 226 narrowed the disclosure duties and added a safe harbor, and SB 332 moved the act's repeal date to July 1, 2027.

Who it applies to
Persons using generative AI to interact with consumers in connection with activities regulated by the Utah Division of Consumer Protection, and licensed regulated occupations. No size threshold.
Penalties
Division of Consumer Protection administrative fines up to $2,500 per violation; courts may impose fines up to $2,500 per violation, and violating an administrative or court order carries a civil penalty up to $5,000 per violation.
Enforced by
Utah Division of Consumer Protection; Utah Attorney General
Official name
Utah Artificial Intelligence Policy Act (SB 149, 2024), as amended by SB 226 and SB 332 (2025)
Citation
Utah Code Title 13, Ch. 72 and Ch. 75; SB 149 (2024); SB 226 (2025); SB 332 (2025); Utah Code 63I-2-213
Topics
AI
Verified 2026-09-22 le.utah.gov le.utah.gov le.utah.gov le.utah.gov
Research notes

SB 226 and SB 332 were verified from the enrolled bill text. The SB 149 signing date (March 13, 2024) was not re-verified. Whether the 2026 Utah session changed the July 1, 2027 repeal date was not verified because the search budget ran out. HB 452 (2025, mental health chatbots) is a related Utah law not covered here.

Related

AmendedCalifornia
CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months
In forceCalifornia
California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026
In forceCalifornia
California ADS employment regulationsClarifies that using an automated-decision system in hiring or other employment decisions can violate the Fair Employment and Housing Act if it discriminates on protected traits. Employers must keep automated-decision data and employment records for at least four years. AI assessments that elicit disability information can be unlawful medical inquiries.In effect since Oct 1, 2025
EnactedCalifornia
California AI Auditor RegistryCreates a state registry for AI auditors run by the Government Operations Agency. From 2029 only registered auditors may offer, sell or conduct covered AI audits, and they must show their registration number in advertising. Registered auditors must file information and follow conduct rules.Next: Jan 1, 2027 Act takes effect · in 2 months
AmendedCalifornia
California AI Transparency Act (SB 942)Covered generative AI providers must offer a free AI-content detection tool, give users the option of a visible (manifest) disclosure on AI-generated image, video or audio, and embed a latent, machine-readable provenance disclosure. Licensees must keep those disclosures intact, and providers must revoke a license within 96 hours of learning a licensee disabled them. AB 853 delayed the operative date to August 2, 2026 and extends duties to large online platforms and GenAI hosting platforms from 2027 and to capture-device makers from 2028.Next: Jan 1, 2027 Large online platform and hosting platform duties · in 2 months
In forceCalifornia
California AI autonomous-harm defense banA defendant that developed, modified or used AI cannot argue in a civil case that the AI acted autonomously and so caused the harm on its own. Other defenses such as causation and comparative fault remain.In effect since Jan 1, 2026
In forceCalifornia
California SB 243 (companion chatbots)Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.Next: Jul 1, 2027 First annual report to Office of Suicide Prevention · in 8 months
In forceCalifornia
California SB 53 (TFAIA)Frontier AI developers must publish transparency reports when deploying new or substantially modified frontier models and report critical safety incidents to the Office of Emergency Services (OES). Large frontier developers must also write, implement and publish a frontier AI framework for catastrophic risk, update it annually, and send OES quarterly summaries of their catastrophic-risk assessments. The act also adds whistleblower protections and creates the CalCompute public computing consortium.Next: Jan 1, 2027 First OES anonymized incident report and CDT definition review · in 2 months
Questions about Utah AI Policy Act
What are the Utah AI Policy Act compliance deadlines?
May 1, 2024: AI Policy Act effective. May 7, 2025: SB 226 amendments effective. Jul 1, 2027: Scheduled repeal of Title 13, Ch. 72.
When does Utah AI Policy Act take effect?
Utah AI Policy Act took effect on May 1, 2024. The next milestone is Jul 1, 2027: Scheduled repeal of Title 13, Ch. 72.
Who does Utah AI Policy Act apply to?
Persons using generative AI to interact with consumers in connection with activities regulated by the Utah Division of Consumer Protection, and licensed regulated occupations. No size threshold.
What are the penalties under Utah AI Policy Act?
Division of Consumer Protection administrative fines up to $2,500 per violation; courts may impose fines up to $2,500 per violation, and violating an administrative or court order carries a civil penalty up to $5,000 per violation.