Law / United States / 
Utah
SB 226 (2025), required disclosures for generative AI in consumer transactions
Utah Code 13-77-103 to 13-77-104
In force since .
An AI transparency rule binding private bodies.
- Audit expectation
- none
What it requires
- Disclose that the individual is interacting with generative AI when they ask clearly and unambiguously, if you use generative AI to interact with someone in a consumer transaction
- Disclose proactively and prominently, verbally or in writing as applicable, if you work in a state-regulated occupation and the interaction is high risk
- High risk here means collecting sensitive health, financial, or biometric information, or giving advice relied on for significant decisions
- A safe harbor applies where the generative AI clearly and conspicuously discloses its non-human nature throughout the interaction
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Has the Division of Consumer Protection adopted a rule defining the "other applications" that make an interaction a high-risk artificial intelligence interaction under Utah Code 13-77-101(5)(c), and which interactions does it add?
- Is an interaction with generative artificial intelligence high risk under Utah Code 13-77-101(5)(b) when it gives general information rather than "personalized recommendations, advice, or information that could reasonably be relied upon to make significant personal decisions"?
What it makes you log
Logging duty
The disclosure duty and its safe harbor name no record. Neither requires a supplier to create, keep, or produce a log of an interaction or of a disclosure given.
- Kind
- None
- As of
What this law does
A supplier using generative AI to interact with an individual in a consumer transaction must disclose that the individual is interacting with generative AI, but only if the individual makes a clear and unambiguous request.
An individual in a state-regulated occupation must proactively and prominently disclose generative AI use, verbally or in writing as applicable, but only where the interaction meets the statute's high-risk definition (collection of sensitive health, financial, or biometric information, or advice relied on for significant decisions).
This duty was enacted by SB 226 (2025), which repealed a broader duty SB 149 (2024) had placed at the former Utah Code 13-2-12 inside the original Artificial Intelligence Policy Act. The 2026 session claimed Chapters 75 and 76 for the Franchise Protection Act and the App Store Accountability Act, so the compiled code now carries this same duty, unchanged in text and in its effective date, at Chapter 77, Utah Code 13-77-103 to 13-77-104.
SB 332 (2025) separately extended the sunset of the Artificial Intelligence Policy Act itself, Chapter 72, to without touching this disclosure duty. A safe harbor at 13-77-104 excuses a supplier whose generative AI clearly and conspicuously discloses its non-human nature throughout the interaction.
When LexLint raises it
When your app profile says your app deploys a chatbot, generates content with AI or makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .