Utah AI Disclosure Law: What Your Chatbot Must Tell Customers
Utah's AI Policy Act asks less of your chat widget than most owners assume, and more of your business than they expect. What the rule actually requires in 2026.
The chat bubble in the corner of your site used to be a form with better manners. Now it answers questions, quotes turnaround times, books appointments, and does all of that at 11pm without checking with you first.
Utah has a law about that, and it is the oldest one of its kind in the country. Most owners I talk to hold one of two wrong ideas about it. Either they assume a statute with "artificial intelligence" in the title cannot possibly apply to a five person shop in Murray, or they assume every AI feature now needs a legal banner bolted to it. Both are wrong. The first mistake is the expensive one.
The volume is new. The law is not.
Adoption stopped being a coastal story a while ago. The Small Business and Entrepreneurship Council's Small Business Technology Use Survey, fielded in February 2026 among 517 employers with 2 to 99 employees, found 82 percent had adopted at least one AI tool, and the typical small business runs five.
Utah got out in front of this. The Artificial Intelligence Policy Act, passed as SB 149, took effect May 1, 2024 and made Utah the first state to regulate generative AI specifically rather than folding it into a broader privacy bill. It was amended in 2025 and it is still on the books. If you deploy a conversational AI tool that talks to Utah customers, this is your statute, whether or not anyone has ever mentioned it to you.
What the law actually asks you to disclose
Start with the rule that applies to everyone, because it is narrower than the headlines suggest.
If a consumer asks whether they are talking to a human or to AI, you have to tell them clearly. That is the whole general obligation. The 2025 amendments in SB 226 tightened the trigger further: the duty is set off by what Davis Polk's client update on the amendments describes as "a clear and unambiguous request" to determine whether the interaction is with a person or a machine. No proactive announcement is required. No banner. Someone has to ask.
Here is the part that trips up real deployments. Every off the shelf chat widget I have configured ships with rules for pricing, hours, and location. None ship with a rule for "wait, is this a real person?" A customer types some version of that question now and then, and the bot routes it to the generic fallback. That is the exact moment the statute cares about, and it is the one nobody tests before launch.
The 2025 amendments also narrowed what counts as a covered system. It now has to be designed to simulate human conversation. Automated appointment confirmations and reminder texts fall outside that definition, which is a sensible line. Your scheduler texting "you're on for Thursday at 2" is not the thing the legislature was worried about. The widget that argues with a customer about a refund is.
The high risk rule, and who it actually catches
There is a second, stricter duty, and this one requires you to speak first.
For a high risk interaction, the disclosure has to come at the outset, before the conversation gets going. The test has two parts and both must be present: the interaction collects sensitive personal information such as financial, health, or biometric data, and it provides personalized recommendations or advice that could reasonably be relied on for significant personal decisions. Financial, legal, medical, and mental health advice are the named examples. This track applies to regulated occupations, meaning work that requires a state license or certification.
This is not abstract for us. We are building a website for a Salt Lake City private practice therapist, and the question of what the intake flow may and may not do came up early, because the honest answer changes the design. A pre-session intake form that collects history and hands it to a human clinician is one thing. A conversational tool that responds to what a person discloses is a different thing wearing similar UI. Utah drew a further line around that second category in 2025 with HB 452, which sets separate rules for mental health chatbots, including restrictions on advertising during interactions and on sharing individually identifiable health information.
The same fork shows up in operations work. We are building a healthcare analytics dashboard for a residential treatment provider, and intake automation gets designed conservatively there for the same reason: the moment a workflow both collects sensitive data and appears to advise, it stops being a convenience feature and becomes a regulated interaction. That tension is covered in more depth in our post on patient intake automation.
The sentence that should worry you more than the disclosure rule
Buried under the disclosure debate is the provision that matters most for an ordinary business, and it has nothing to do with banners.
Utah's AI Policy Act confirms that you cannot escape liability under state consumer protection law by pointing out that the offending statement came from a generative AI tool rather than an employee. Your chatbot's promises are your promises. If it invents a discount, a warranty, a turnaround time, or a guarantee you never authorized, the analysis is the same as if a person at the front desk had said it.
Enforcement runs through the Utah Division of Consumer Protection, which can impose administrative fines of $2,500 per violation and go to state court for injunctions and disgorgement. There is no private right of action, so this is a regulator problem rather than a plaintiff's bar problem. That is genuinely better news than the equivalent picture in accessibility law, which we covered in website accessibility for small business, where the volume comes from private filings.
The realistic failure mode, then, is not a missing disclosure. It is a well meaning bot with an unconstrained answer space, trained loosely on your site copy, improvising commitments at midnight. I have watched a demo bot promise same day service for a company that had never offered it, because the phrase appeared once in an old post. When that generosity reaches your insurer, the risk picture in our post on AI liability starts to matter too.
The safe harbor is the cheapest compliance you will ever buy
The 2025 amendments added an enforcement safe harbor, and it is close to free.
If your tool clearly and conspicuously discloses that the consumer is interacting with generative AI at the outset and throughout the interaction, you get the benefit of it. In practice that is one line of copy in the chat header, not a project. You give up nothing. Customers who care already suspect, and the ones who do not will not read it.
That is an unusually good trade for a compliance requirement, which is why I would take it even though the general rule does not force you to.
What this looks like on a real site
Six things, none of which need a lawyer or a budget.
- Open your own chat widget and type "am I talking to a real person?" If the answer is evasive, absent, or routed to a generic fallback, fix that response first. It is the one the statute names.
- Add a persistent label in the chat header. "You are chatting with an AI assistant" satisfies the safe harbor's outset and throughout requirement in one move.
- Write down what the bot may never say. Prices it cannot confirm, timelines, guarantees, availability, anything that sounds like a commitment. Then test each one adversarially.
- Give it a clean handoff to a human, and make the handoff obvious rather than buried.
- If you hold a state license, decide whether the tool collects sensitive information and gives actionable advice. If both are true, disclose at the outset, before the first question.
- Keep transcripts. If a regulator ever asks what your tool told someone, the answer should not be a guess.
Most of that list is an afternoon. Item three takes real thought, and it is the one that protects you.
Frequently asked questions
Does this apply if my business is not in Utah but my customers are? It is a Utah consumer protection statute, so the customer's location matters more than where your office sits. I am not a lawyer, and jurisdiction questions get argued. Designing around "a Utah consumer might use this" is cheaper than the alternative reasoning.
Do I need a disclosure on an AI tool that only writes drafts for my staff? No. The obligation attaches to systems that interact with consumers and simulate human conversation. An internal drafting tool your team edits before anything ships is not a consumer interaction. That is a workflow question rather than a compliance question, and it belongs with the rest of your workflow automation planning.
Is a voice agent answering my phone covered? Treat it as covered. A phone agent designed to sound like a person is squarely within the intent of the rule, and the safe harbor works the same way: say it up front, in the greeting. This is the deployment I see rushed most often, usually because the vendor demo sounds impressive and nobody scripts the disclosure.
How long is this law good for? The Act now carries a repeal date of July 1, 2027, extended two years by SB 332 in 2025. It has been amended twice and reauthorized once already, and Utah's Office of Artificial Intelligence Policy keeps running its learning lab and regulatory relief program. Plan on the obligation persisting in some form rather than lapsing.
The useful way to hold all of this: Utah asks less of your chat widget than you feared and more of your business than you expected. The disclosure is a sentence. The liability is everything the tool says while wearing your logo. Start by asking your own bot whether it is human, then spend the real effort on the list of things it must never promise. If you want help drawing that boundary before the tool goes live on your site, we can work through it with you.