Does Utah's AI Policy Act apply to my product?

The Act reaches businesses that use generative AI in a consumer transaction connected to Utah. If your product puts a Utah consumer in front of a generative model - a support assistant, an intake bot, a recommendation flow - some disclosure duty is in scope. Two things raise the bar. If you operate in a state-regulated occupation, the duty becomes proactive and has to appear at the start of the interaction. And the 2025 amendments concentrated the heaviest obligations on regulated-occupation and high-risk uses, so a clinic or a law firm carries more than a general retail chatbot. The practical question for any consumer-facing feature is which tier applies and how you will prove it later.

How is the general disclosure duty different from the regulated-occupation duty?

The general duty is reactive. A business using generative AI in a consumer transaction discloses that the consumer is dealing with a machine when the consumer asks. The regulated-occupation duty flips that. A licensed professional using generative AI in the delivery of regulated services discloses it up front, prominently, before the consumer asks. The split tracks stakes: a patient assumes a licensed clinician stands behind every message. Utah's 2025 amendments sharpened the line, narrowing the proactive trigger so the upfront duty focuses on regulated-occupation and high-risk interactions. For engineering teams, the disclosure configuration becomes a policy variable worth recording, because which tier applied to a given session is what an auditor asks about.

Does DeepInspect show the disclosure to my users?

No. The consumer-facing disclosure - the banner, the spoken notice - lives in your product, where it belongs. DeepInspect operates one layer back, on the HTTP traffic between your authenticated users or agents and the LLMs they call. Its role is the evidence side. For every model request that crosses the proxy, it writes a per-decision record capturing the identity, the model, the governing policy, and the timestamp. That record lets you show, months after the fact, that a specific interaction under Utah's Act ran with the disclosure configuration you intended. Your application owns what the consumer sees in the moment. DeepInspect owns the durable proof that the interaction was handled under policy. Both matter when the Division of Consumer Protection asks.

How does Utah's AI disclosure law compare to the California and Texas laws?

All three place a transparency-style duty on consumer-facing AI, with different triggers. Utah's Act, effective May 1, 2024, requires disclosure of generative AI in consumer interactions, weighted more heavily for regulated occupations. The Texas Responsible AI Governance Act took effect January 1, 2026, with civil penalties and Attorney General enforcement. The California AI Transparency Act, also effective January 1, 2026, targets AI systems with 1 million or more monthly users. The triggers differ across occupation, penalty model, and platform scale. The evidentiary demand converges. In a dispute, each regime comes down to whether you can produce a per-interaction record showing what the AI did and under which policy. A team operating in all three states builds one record format and maps it to each statute's disclosure language.

Why does a disclosure requirement create a logging requirement?

Because a duty you cannot evidence is a duty you cannot defend. Utah's Act tells you to disclose generative AI use to consumers, and the Division of Consumer Protection enforces after the fact, one complaint at a time. When an inquiry lands, the regulator is looking backward at an interaction that already closed. The only thing that answers its questions is a record made at the time: generative AI was invoked, this identity made the call, this policy and disclosure state governed it, at this timestamp. A disclosure obligation therefore pulls an audit obligation in behind it. Proving compliance retrospectively depends on a per-interaction record, and a banner rendered in the present tense falls short of that record.

← Blog

July 19, 2026

Utah's AI Disclosure Law: Requirements and Evidence

Utah's Artificial Intelligence Policy Act made generative-AI disclosure a legal duty, with tighter rules for regulated occupations. This walks through what the law requires, how it sits beside the California and Texas laws, and why a disclosure duty implies a per-decision audit trail.

ByParminder Singh· Founder & CEO, DeepInspect Inc.

Industry Verticalsregulationcomplianceai-complianceai-governanceauditai-security

Utah's Artificial Intelligence Policy Act took effect on May 1, 2024, and made one thing a statutory duty: a business that puts a consumer in front of generative AI has to disclose it. The Utah Division of Consumer Protection enforces the Act, and the same law created an Office of Artificial Intelligence Policy to steer state approach. Regulated occupations carry a heavier, proactive version of the duty. Proving you met it, interaction by interaction, is where the architecture does the work.

I want to walk through what SB 149 requires, how the 2025 amendments moved the disclosure trigger, where Utah lines up with the California and Texas laws, and why a disclosure duty pulls an audit duty in behind it.

The Utah Artificial Intelligence Policy Act

Utah signed SB 149, the Artificial Intelligence Policy Act, into law in March 2024, effective May 1, 2024. The Act amends Utah's consumer protection statutes so that a business using generative AI in a consumer transaction carries a disclosure duty tied to that use.

The general disclosure trigger

Under the baseline rule, a business using generative AI to interact with a consumer must clearly and conspicuously disclose that the consumer is dealing with generative AI, not a person, when the consumer asks.

The Division of Consumer Protection administers it

The Utah Division of Consumer Protection enforces the Act. SB 149 also created the Office of Artificial Intelligence Policy, which runs a regulatory learning laboratory that lets companies test AI uses under state supervision before full enforcement applies.

Regulated occupations carry a proactive disclosure duty

The Act draws a sharper line for people in state-regulated occupations. A licensed professional, in the fields Utah's Division of Professional Licensing oversees, cannot wait for the consumer to ask. When generative AI is used in the delivery of regulated services, the disclosure has to be prominent and delivered at the start of the interaction.

The reason is the stakes. A patient using a clinic's intake chatbot relies on a licensed professional's judgment, and the law treats a silent AI substitution as a consumer-protection problem. Utah's 2025 amendments refined this structure. They narrowed the proactive-disclosure trigger, focusing the upfront duty on regulated-occupation and high-risk interactions rather than every consumer exchange.

A disclosure duty creates an evidence gap

The usual implementation is a disclosure banner. The consumer sees a line of text saying they are talking to an automated assistant. The banner is necessary. On its own, it proves nothing about any particular past interaction.

When the Utah Division of Consumer Protection opens an inquiry into a complaint, the question is narrow and retrospective. On this date, for this consumer, was generative AI used, was the disclosure presented, and under what configuration did the session run? A banner in your current front-end build says nothing about what a user saw eight months ago. Application logs carry the same weakness. They lack audit-log integrity: the service that ran the interaction also wrote the log, the log can be edited or rotated, and it rarely ties a model call back to the disclosure state that governed it.

Disclosure obligations imply audit obligations

A disclosure duty is worth as much as your ability to prove you met it. That proof is per-interaction, and it has a fixed shape. For each consumer session that touched generative AI, you need a record showing the model was invoked, which identity made the call, which policy governed the routing and the disclosure state, and a timestamp precise enough to line the record up against a complaint to the Division of Consumer Protection.

That record is a per-decision audit record with two properties a regulator cares about. It is generated independently of the application, so the system under review is not vouching for itself. It is tamper-evident, so a signature breaks if anyone edits it after the fact. Audit-trail requirements across regulations keep converging on this shape, because the question of who did what, under which policy, and when carries across every statute.

Utah sits inside a widening set of state AI laws

The other states rhyme with Utah. The Texas Responsible AI Governance Act took effect January 1, 2026, carrying civil penalties and enforcement by the Texas Attorney General. The California AI Transparency Act, effective January 1, 2026, requires disclosure for AI systems with 1 million or more monthly users. In the EU, Article 12 of the EU AI Act requires automatic recording of events over the lifetime of a high-risk system.

The vocabulary shifts between these regimes. Utah calls the duty disclosure. California legislates transparency. The EU writes it as record-keeping. The infrastructure underneath stays constant: a durable, identity-bound record of what an AI system did in a specific interaction. A team shipping consumer AI features under the EU AI Act and the state laws builds that evidence layer once and points it at each obligation.

DeepInspect

This is the evidence side of a disclosure law, and it is what DeepInspect produces. DeepInspect runs as a stateless proxy between your authenticated users or agents and any LLM they call. Every generative AI request crosses it, and every request produces a per-decision audit record: which identity made the call, which model answered, which policy governed the route, and the timestamp, all signed and tamper-evident.

That record turns a disclosure duty into something you can defend. When the Utah Division of Consumer Protection asks whether a given interaction used generative AI and under which policy it ran, the answer is a signed record generated outside the application, rather than a screenshot of a banner. The proxy is model-agnostic, so one record format covers every model you call.

If your consumer AI features fall under Utah's Act or the parallel state laws, let's talk today.

Frequently asked questions

Does Utah's AI Policy Act apply to my product?: The Act reaches businesses that use generative AI in a consumer transaction connected to Utah. If your product puts a Utah consumer in front of a generative model - a support assistant, an intake bot, a recommendation flow - some disclosure duty is in scope. Two things raise the bar. If you operate in a state-regulated occupation, the duty becomes proactive and has to appear at the start of the interaction. And the 2025 amendments concentrated the heaviest obligations on regulated-occupation and high-risk uses, so a clinic or a law firm carries more than a general retail chatbot. The practical question for any consumer-facing feature is which tier applies and how you will prove it later.
How is the general disclosure duty different from the regulated-occupation duty?: The general duty is reactive. A business using generative AI in a consumer transaction discloses that the consumer is dealing with a machine when the consumer asks. The regulated-occupation duty flips that. A licensed professional using generative AI in the delivery of regulated services discloses it up front, prominently, before the consumer asks. The split tracks stakes: a patient assumes a licensed clinician stands behind every message. Utah's 2025 amendments sharpened the line, narrowing the proactive trigger so the upfront duty focuses on regulated-occupation and high-risk interactions. For engineering teams, the disclosure configuration becomes a policy variable worth recording, because which tier applied to a given session is what an auditor asks about.
Does DeepInspect show the disclosure to my users?: No. The consumer-facing disclosure - the banner, the spoken notice - lives in your product, where it belongs. DeepInspect operates one layer back, on the HTTP traffic between your authenticated users or agents and the LLMs they call. Its role is the evidence side. For every model request that crosses the proxy, it writes a per-decision record capturing the identity, the model, the governing policy, and the timestamp. That record lets you show, months after the fact, that a specific interaction under Utah's Act ran with the disclosure configuration you intended. Your application owns what the consumer sees in the moment. DeepInspect owns the durable proof that the interaction was handled under policy. Both matter when the Division of Consumer Protection asks.
How does Utah's AI disclosure law compare to the California and Texas laws?: All three place a transparency-style duty on consumer-facing AI, with different triggers. Utah's Act, effective May 1, 2024, requires disclosure of generative AI in consumer interactions, weighted more heavily for regulated occupations. The Texas Responsible AI Governance Act took effect January 1, 2026, with civil penalties and Attorney General enforcement. The California AI Transparency Act, also effective January 1, 2026, targets AI systems with 1 million or more monthly users. The triggers differ across occupation, penalty model, and platform scale. The evidentiary demand converges. In a dispute, each regime comes down to whether you can produce a per-interaction record showing what the AI did and under which policy. A team operating in all three states builds one record format and maps it to each statute's disclosure language.
Why does a disclosure requirement create a logging requirement?: Because a duty you cannot evidence is a duty you cannot defend. Utah's Act tells you to disclose generative AI use to consumers, and the Division of Consumer Protection enforces after the fact, one complaint at a time. When an inquiry lands, the regulator is looking backward at an interaction that already closed. The only thing that answers its questions is a record made at the time: generative AI was invoked, this identity made the call, this policy and disclosure state governed it, at this timestamp. A disclosure obligation therefore pulls an audit obligation in behind it. Proving compliance retrospectively depends on a per-interaction record, and a banner rendered in the present tense falls short of that record.

← All posts