Utah
AI behavior law: bot and agent disclosure, crawler and training-data rules, automated-agent transactions, and algorithmic decision-making.
Summary
Utah was the first US state to enact a private-sector AI-behavior statute when Governor Cox signed SB 149 (Utah Artificial Intelligence Policy Act) in March 2024, requiring disclosure when consumers interact with AI systems. The legislature has moved quickly: 2025 amendments (SB 226, SB 332, HB 452) refined disclosure obligations, extended the act's sunset, and added targeted rules for mental health chatbots. The 2026 session added four more enacted laws covering digital-content provenance standards for large AI providers, identity-protection extensions for AI-manipulated content, health-insurance AI preauthorization disclosure, and expanded powers for the Office of Artificial Intelligence Policy — making Utah one of the most active state AI regulatory jurisdictions in the US despite ongoing federal pressure to limit state-level AI regulation. A companion-chatbot safety bill (HB 438, 2026) that passed the House 68-1 did not clear the Senate before adjournment and did not become law.
Enacted law
Government obligations
| Instrument | Category | Effective | Source |
|---|---|---|---|
| Identity Protection Modifications — AI Defamation and Identity Replication (SB 256) (Utah Code Ann. §§ 45-2 (defamation), 13-71 (identity), as amended (SB 256, 2026 General Session)) | Bot / agent disclosure | 2026-05-06 | Perkins Coie (perkinscoie.com); Recording Law (recordinglaw.com) |
| Office of Artificial Intelligence Policy Amendments (HB 320) (Utah Code Ann. §§ 13-72 et seq. (HB 320, 2026 General Session)) | Automated decision-making | 2026-05-06 | PolicyEngage (trackbill.com); Utah Department of Commerce (commerce.utah.gov) |
Private sector obligations
| Instrument | Category | Effective | Source |
|---|---|---|---|
| Artificial Intelligence Policy Act Amendments (SB 226) (Utah Code Ann. §§ 13-72-101 et seq., as amended (SB 226, 2025 General Session)) | Bot / agent disclosure | 2025-05-07 | Davis Wright Tremaine (dwt.com); Perkins Coie (perkinscoie.com) |
| Artificial Intelligence Policy Act Sunset Extension (SB 332) (Utah Code Ann. § 13-72 (SB 332, 2025 General Session)) | Bot / agent disclosure | 2025-05-07 | Davis Wright Tremaine (dwt.com); National Law Review (natlawreview.com) |
| Digital Content Provenance Standards Act (HB 276) (Utah Code Ann. §§ 13-72b, 13-72c (HB 276, 2026 General Session)) | Bot / agent disclosure | 2027-01-01 | DataGuidance (dataguidance.com); Digital Policy Alert (digitalpolicyalert.org); Troutman Privacy (troutmanprivacy.com) |
| Health Insurance Preauthorization AI Disclosure (SB 319) (Utah Code Ann. §§ 31A-22 (health insurance), as amended (SB 319, 2026 General Session)) | Automated decision-making, Bot / agent disclosure | 2029-07-01 | Utah Legislature Fiscal Note (pf.utleg.gov); Utah AFP (utahafp.org) |
| Identity Protection Modifications — AI Defamation and Identity Replication (SB 256) (Utah Code Ann. §§ 45-2 (defamation), 13-71 (identity), as amended (SB 256, 2026 General Session)) | Bot / agent disclosure | 2026-05-06 | Perkins Coie (perkinscoie.com); Recording Law (recordinglaw.com) |
| Mental Health Chatbot Regulation (HB 452) (Utah Code Ann. § 13-72a (HB 452, 2025 General Session)) | Bot / agent disclosure | 2025-05-07 | Wilson Sonsini (wsgr.com); Future of Privacy Forum (fpf.org) |
| Utah Artificial Intelligence Policy Act (Utah Code Ann. §§ 13-72-101 et seq. (SB 149, 2024 General Session)) | Bot / agent disclosure | 2024-05-01 | Utah State Legislature (le.utah.gov); Skadden (skadden.com) |
Drafted & in discussion
| Instrument | Status | Applies to | Category | Source |
|---|---|---|---|---|
| Companion Chatbot Safety Act (HB 438) (HB 438, 2026 General Session (not enrolled)) | Dead / withdrawn | Private sector | Bot / agent disclosure | Transparency Coalition (transparencycoalition.ai); Utah News Dispatch (utahnewsdispatch.com) |
Automated-access legality
Carried forward from the crawler-law index. Governs whether automated clients may access public websites in this jurisdiction.
| Dimension | Value |
|---|---|
| Authorization test | without permission |
| Public-page carve-out | yes |
| Terms-of-service browsewrap enforceable | notice dependent |
| Terms-of-service clickwrap enforceable | yes |
| Copyright exception model | fair use |
| Text and data mining — commercial status | unsettled |
| Text and data mining — opt-out mechanism | none |
| robots.txt legal weight | non binding notice |
| AI training-specific law | none |
| Privacy regime | UCPA |
| Trespass to chattels | not recognized |
Last reviewed: 2026-05-23. Confidence: high. Not legal advice.