Understanding Utah AI Laws What You Need to Know in 2025
Utah is leading the way in artificial intelligence regulation. If your business uses AI to interact with Utah residents, you need to understand the state’s AI laws right now because they just changed again in May 2025. These rules apply whether your company is based in Utah or not, and violations can carry penalties of up to $5,000 per incident.
At John Park Law, our Utah business attorneys can help you understand how the Utah AI Act applies to your company and ensure your AI systems meet all disclosure requirements. Call us at 801-701-3330 to discuss your compliance strategy.
Whether you’re launching an AI-powered service or already using automated systems to serve Utah customers, understanding these rules will help you avoid costly violations and protect your business.
What Is the Utah AI Act?
Utah passed the Artificial Intelligence Policy Act in March 2024, becoming one of the first states to create comprehensive AI rules. The original law took effect on May 1, 2024. However, new amendments took effect in May 2025 that narrowed the original law’s focus to high-risk interactions.
The law focuses on one main goal: ensuring people know when they’re talking to AI rather than a human. This matters most when AI makes important decisions or handles sensitive information about your health, finances, or legal matters.
Who Do These AI Laws Apply To?
The Utah AI Act applies to any company that uses generative AI to interact with Utah residents. Generative AI means systems trained on data that can create human-like responses when people interact with them. Think ChatGPT-style tools, AI chatbots, or automated customer service systems.
Your business location doesn’t matter. If Utah residents use your AI-powered services, you must follow these rules. This includes online businesses, apps, websites, and any platform where AI communicates directly with users.
When Must You Disclose AI Use?
The disclosure requirements depend on what type of service you provide and how risky the interaction is.
For Regulated Occupations
If your business operates in a field that requires state licensing or certification, like healthcare, law, accounting, or financial advising, the rules are strict. You must tell people upfront when they’re interacting with AI during “high-risk” situations. High-risk means the AI handles sensitive health data, financial information, biometric data, or gives personalized advice about medical, legal, or financial matters.
The disclosure must happen at the start of the interaction. If it’s a phone call, you say it out loud. If it’s a text conversation or online chat, you put it in writing. You can’t hide this information in fine print or wait until someone asks.
For Non-Regulated Businesses
If your business doesn’t require special licenses, you still have obligations. When a Utah customer asks whether they’re talking to AI, you must tell them the truth. You can’t dodge the question or mislead people about whether a human is involved.
The Safe Harbor Provision
Utah created a safe harbor that gives businesses extra legal protection. To qualify, your system must disclose its identity at the beginning of every interaction and keep reminding users throughout the conversation. This ongoing disclosure matters. One mention at the start isn’t enough for safe harbor protection.
Companies that meet the safe harbor requirements get stronger defenses if someone challenges their AI practices. Given the penalties involved, most businesses should aim for safe harbor compliance.
What Are the Penalties?
Utah takes AI disclosure violations seriously. Utah’s Division of Consumer Protection can fine you up to $2,500 for each violation. If a court or the Attorney General gets involved, those penalties could increase to $5,000 per violation.
If you interact with hundreds of customers without proper disclosures, you’re looking at significant financial exposure. Courts can also order injunctive relief, which means they can force you to stop using your AI system until you fix the problems. The state can even take your profits from violations and make you pay their attorney fees.
What Changed in the 2025 Amendments?
The May 2025 updates made three major changes:
- Stricter rules for high-risk interactions. The new amendments specifically call out health data, financial information, biometric data, and personalized advice in healthcare, law, and finance as high-risk categories requiring mandatory upfront disclosure.
- More enforcement power. The Division of Consumer Protection now has the authority to create specific rules about how disclosures must look and where they must appear.
- Expanded remedies. The state can now pursue disgorgement of profits, meaning they can take all the money you made from violations, not just impose fines.
Reach Out to Our Utah Business Lawyers in Cottonwood Heights
If your business uses AI to interact with customers, you should talk to a Utah business lawyer at our firm who understands technology law. The stakes are too high to guess. Our attorneys can review your AI systems, draft proper disclosures, and help you qualify for safe harbor protection.
You especially need legal help if you operate in a regulated profession, handle sensitive customer data, or use AI to give personalized advice. The line between compliance and violation isn’t always clear. What seems like a simple chatbot to you might trigger high-risk disclosure requirements under Utah law.
The technology moves fast, but the law moves faster in Utah. Protect your business by getting ahead of these requirements before they become expensive problems. Contact John Park Law today at 801-701-3330 to get started or fill out our confidential contact form.
John Park is a highly experienced attorney in estate planning, probate, business law and guardianship to help people organize the elements of their lives through careful estate planning and asset protection measures.