LexLint.ioBeta

Know the law your code answers to.

Law / United States / Utah

Digital Content Provenance Standards Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72c

Utah Code 13-72c-101 et seq.

An AI transparency rule binding private bodies.

How the hook was established
express
What makes it apply
Market targeting, Place of effect
Obligation class
Content labelling, Disclosure
Audit expectation
none
Setting the rule reaches
General

What it requires

  • Detect whether compliant system provenance data is embedded in content you distribute, give users a way to see and download it, and do not knowingly strip it where technically feasible, if you operate a large online platform with over 2,000,000 unique monthly users
  • Include a latent disclosure in image, video, or audio content your generative AI system creates or substantially modifies, if your system has over 1,000,000 monthly visitors or users and is publicly accessible in the state
  • Include a latent disclosure identifying your device or proving whether content was AI-created or altered, if you manufacture capture devices for sale in the state, starting
  • This chapter takes effect , so it is a duty to prepare for rather than one owed today

These lines are LexLint's reading of the law's text.

In the frameworks

NIST AI RMF
  • MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
NIST AI 600-1
OWASP Agentic Top 10
  • ASI09Human-Agent Trust Exploitation
MIT mitigations Draft
  • 2.4Content Safety Controls
  • 4.1System Documentation
  • 4.2Risk Disclosure
  • 4.6User Rights & Recourse
FINOS AIGF
ETSI EN 304 223
  • 5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.
  • 5.3.1-1Users told where and how their data is used, accessed and stored, with developers informing operators.
  • 5.3.1-2.1That guidance covers proper use, limits and likely failure modes.

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Penalty structure

A court may separately impose a civil penalty of up to $5,000 for each violation of an administrative or court order issued to enforce this chapter, in addition to the $2,500 per-violation fine for the underlying provenance-standards violation.

Rule
Per violation only
As of
Currency
USD
Per violation unit
Violation
Per violation amount
2,500

What it makes you log

Logging duty

This act requires detecting, displaying, and not stripping provenance data already embedded in content, and embedding a latent disclosure in content a covered provider's system creates or a capture device captures. It states no duty for a large online platform, a covered provider, or a capture device manufacturer to keep a separate log or record of a disclosure or a detection.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

HB 276 (2026 General Session), enacted as Chapter 352, Laws of Utah 2026, creates new Chapter 72c, the Digital Content Provenance Standards Act, effective .

A large online platform (a public-facing social media, mass-messaging, or standalone search-engine service that exceeded 2,000,000 unique monthly users in the preceding 12 months) must detect compliant system provenance data in distributed content, give users a way to see it, and not knowingly strip it where technically feasible.

A covered provider (a person whose generative AI system has over 1,000,000 monthly visitors or users and is publicly accessible in the state) must include a latent disclosure in image, video, or audio content its system creates or substantially modifies. A capture device manufacturer must separately include a latent disclosure in captured content, for a device it produces for sale in the state on or after .

The Division of Consumer Protection enforces the chapter, with an administrative fine of up to $2,500 per violation and equivalent court remedies.

When LexLint raises it

When your app profile says your app generates audio with AI, generates content with AI, generates images with AI, generates video with AI or operates a social platform.

Back to the example  ·  Lint your app

Page updated .