Utah signs the Artificial Intelligence Policy Act (SB 149)

The Utah Artificial Intelligence Policy Act is a state law that requires disclosure when a person interacts with generative AI and creates a new state office to oversee AI policy. Utah's governor signed the bill, Senate Bill 149, on 2024-03-13, and the law's consumer-facing disclosure duties took effect May 1, 2024.

What it is

SB 149, titled Artificial Intelligence Amendments, creates the Artificial Intelligence Policy Act under Utah law.

Manatt described it as the first comprehensive state law addressing artificial intelligence in the country.

The act establishes liability for use of artificial intelligence that violates consumer protection law when not properly disclosed.

What it requires

A person who causes generative AI to interact with someone must disclose that fact if the person asks or prompts for it.

People who provide services in a licensed or certified regulated occupation must go further and prominently disclose generative AI use in the provision of those services.

The law also creates the Office of Artificial Intelligence Policy and a regulatory AI analysis function inside state government.

It establishes the Artificial Intelligence Learning Laboratory Program, a sandbox meant to assess AI technologies alongside their risks and policy implications.

Utah's Division of Consumer Protection can impose an administrative fine of up to $2,500 for each violation of the disclosure provisions.

A person who violates a resulting administrative or court order can face a civil penalty of no more than $5,000 for each violation.

Compliance lawyers have noted the act also makes a distinction in disclosure timing depending on the nature of the business involved.

What security leaders should do

Security leaders should inventory every customer-facing chatbot, virtual assistant, or generated-content workflow to confirm whether it meets the law's definition of generative AI and triggers a disclosure duty. Teams supporting licensed or certified professions should treat disclosure as a product requirement built into the interface itself, not a line buried in a privacy notice, since the statute ties stronger disclosure obligations directly to regulated occupations. Because enforcement runs through the state's Division of Consumer Protection with escalating fines for repeat violations, security and compliance functions should log where generative AI is deployed, who owns each deployment, and how disclosure is verified, so an audit trail exists if a complaint or investigation arises.