Utah is one in every of a handful of states that has been a frontrunner in its regulation of AI. Utah’s Synthetic Intelligence Coverage Act[i] (“UAIPA”) was enacted in 2024 and requires disclosures regarding client interplay with generative AI with heightened necessities on regulated professions, together with licensed healthcare professionals.
Utah not too long ago handed three AI legal guidelines (HB 452, SB 226 and SB 332), all of which grew to become efficient on Could 7, 2025, and both amend or increase the scope of the UAIPA. The legal guidelines govern using psychological well being chatbots, revise disclosure necessities for the deployment of generative AI in reference to a client transaction or provision of regulated providers, and lengthen the repeal date of the UAIPA.
HB 452
HB 452 creates disclosure necessities, promoting restrictions, and privateness protections for using psychological well being chatbots. [ii] “Psychological well being chatbots” seek advice from AI expertise that (1) makes use of generative AI to have interaction in conversations with a consumer of the psychological well being chatbot, much like communications one would have with a licensed therapist, and (2) a provider represents, or an inexpensive individual would consider, can present psychological well being remedy or assist handle or deal with psychological well being circumstances. “Psychological well being chatbots” don’t embody AI-technology that solely gives scripted output (resembling guided meditations or mindfulness workout routines).
Disclosure Necessities
A psychological well being chatbot should clearly and conspicuously disclose that the psychological well being chatbot is an AI expertise and never human. The disclosure have to be made (1) earlier than the consumer accesses options of the psychological well being chatbot, (2) originally of any interplay with the consumer, if the consumer has not accessed the psychological well being chatbot inside the earlier 7 days, and (3) if requested or prompted by the consumer whether or not AI is getting used.
Private Info Protections
Psychological well being chatbot suppliers could not promote or share with any third social gathering the individually identifiable well being info (“IIHI”) or consumer enter of a consumer. The prohibition doesn’t apply to IIHI that (1) a well being care supplier requests with the consumer’s consent, (2) is offered to a well being plan upon the request of the consumer, or (3) is shared by the provider as a coated entity to a enterprise affiliate to make sure efficient performance of the psychological well being chatbot and in compliance with the HIPAA Privateness and Safety Guidelines.
Promoting Restrictions
A psychological well being chatbot can’t be used to promote a selected services or products to a consumer in a dialog between the consumer and the psychological well being chatbot, except the psychological well being chatbot clearly and conspicuously (1) identifies the commercial as an commercial and (2) discloses any sponsorship, enterprise affiliation or settlement with a 3rd social gathering to advertise or promote the services or products. Suppliers of psychological well being chatbots could not use a consumer’s enter to (1) decide whether or not to show commercials to the consumer except the commercial is for the psychological well being chatbot itself, (2) customise how commercials are introduced, or (3) decide a product, service or class to promote to the consumer.
Affirmative Protection
HB 452 establishes an affirmative protection to violations of the legislation which requires, amongst different objects, creating, sustaining and implementing a coverage for the psychological well being chatbot that meets particular necessities outlined within the legislation and submitting such coverage with the Utah Division of Client Safety.
Penalties
Violation of the legislation could end in administrative fines as much as $2,500 per violation and court docket motion by the Utah Division of Client Safety.
SB 226
SB 226 pares again UAIPA’s disclosure necessities relevant to a provider that makes use of generative AI in a client transaction to when (1) there’s a “clear and unambiguous” request from a person to find out whether or not an interplay is with AI, relatively than any request, and (2) a person interacts with generative AI in the midst of receiving regulated providers that represent a “high-risk” AI interplay, as a substitute of any generative AI interplay within the provision of regulated providers.[iii]
Disclosure Necessities
If a person asks or prompts a provider about whether or not AI is getting used, a provider that makes use of generative AI to work together with a person in reference to a client transaction should disclose that the person is interacting with generative AI and never a human. Whereas this requirement additionally existed underneath the UAIPA, SB 226 clarifies that disclosure is simply required when the person’s immediate or query is a “clear and unambiguous request” to find out whether or not an interplay is with a human or AI.
The UAIPA additionally requires individuals who present providers of a regulated occupation to prominently disclose when an individual is interacting with generative AI within the provision of regulated providers, no matter whether or not the individual inquires if they’re interacting with generative AI. Underneath SB 226, such disclosure is simply required if using generative AI constitutes a “high-risk synthetic intelligence interplay.” The disclosure have to be offered verbally in the beginning of a verbal dialog and in writing earlier than the beginning of a written interplay. “Regulated occupation” means an occupation that’s regulated by the Utah Division of Commerce and requires a license or state certification to observe the occupation, resembling nursing, medication, and pharmacy. “Excessive-risk AI interplay” consists of an interplay with generative AI that includes (1) the gathering of delicate private info, resembling well being or biometric knowledge and (2) the availability of customized suggestions, recommendation, or info that would fairly be relied upon to make important private selections, together with the availability of medical or psychological well being recommendation or providers.
Secure Harbor
An individual just isn’t topic to an enforcement motion for violation of the required disclosure necessities if the individual’s generative AI clearly and conspicuously discloses on the outset of and all through an interplay in reference to a client transaction or the availability of regulated providers that it’s (1) generative AI, (2) not human, or (3) an AI assistant.
Penalties
Violation of the legislation could end in administrative fines as much as $2,500 per violation and a court docket motion by the Utah Division of Client Safety.
SB 332
SB 332 prolonged the repeal date of the UAIPA from Could 1, 2025 to July 1, 2027.[iv]
Wanting Ahead
Corporations that supply psychological well being chatbots or generative AI in interactions with people in Utah ought to consider their merchandise and processes to make sure compliance with the legislation. Moreover, the AI regulatory panorama on the state stage is quickly altering as states try to control using AI in an more and more deregulatory federal surroundings. Healthcare corporations creating and deploying AI ought to monitor state developments.
FOOTNOTES
[i] S.B. 149 (“Utah Synthetic Intelligence Coverage Act”), 65th Leg., 2024 Gen. Session (Utah 2024), obtainable right here.
[ii] H.B. 452, 66th Leg., 2025 Gen. Session (Utah 2025), obtainable right here.
[iii] S.B. 226, 66th Leg., 2025 Gen. Session (Utah 2025), obtainable right here.
[iv] S.B. 332, 66th Leg., 2025 Gen. Session (Utah 2025), obtainable right here.
