Regulon.AI — UT-SB-226 · UT SB 226 (AI Consumer Protection)

Summary

Requires suppliers using generative AI in consumer transactions to disclose that the consumer is interacting with AI (not a human) when the consumer clearly asks. Imposes a heightened, proactive disclosure obligation on individuals in regulated occupations who use generative AI in high-risk interactions — requiring prominent disclosure at the start of verbal or written interactions. Provides a safe harbor from enforcement for entities that clearly and conspicuously disclose AI involvement at the outset and throughout the interaction. Establishes that use of generative AI is not a defense to violations of statutes administered by the Division of Consumer Protection. Enforced exclusively by the Division of Consumer Protection and the Attorney General, with administrative fines up to $2,500 per violation and court-imposed penalties up to $5,000 for violating orders.

Enforcement & Penalties

Enforcement Authority

Division of Consumer Protection administers and enforces. Attorney General provides legal counsel and may bring civil actions on behalf of the Division. Division director may impose administrative fines; courts may also impose fines and equitable relief. Violation of an administrative or court order subjects violator to additional civil penalties. No private right of action. Violations also constitute violations of the Utah Consumer Sales Practices Act § 13-11-4(1).

Penalties

Administrative fines up to $2,500 per violation. Court-imposed fines up to $2,500 per violation. Disgorgement of money received in violation, payable to injured individuals. Civil penalty up to $5,000 per violation for violating an administrative or court order. Court shall award reasonable attorney fees, court costs, and investigative fees upon judgment or injunctive relief.

Who Is Covered

"Supplier" means the same as that term is defined in Section 13-11-3.

An individual providing services in a regulated occupation.

What Is Covered

"Generative artificial intelligence" means an artificial intelligence technology system that: (a) is trained on data; (b) is designed to simulate human conversation with a consumer through one or more of the following: (i) text; (ii) audio; or (iii) visual communication; and (c) generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight.

Compliance Obligations 3 obligations · click obligation ID to open requirement page

T-01 AI Identity Disclosure · T-01.3 · Professional · Chatbot

Utah Code § 13-75-103(1)(a)-(b)

Plain Language

When a supplier uses generative AI to interact with a consumer in a consumer transaction, the supplier must disclose that the consumer is interacting with AI (not a human) if the consumer asks or prompts whether AI is being used. The consumer's question must be a clear and unambiguous request — vague or ambiguous inquiries do not trigger the obligation. This is an on-demand disclosure duty, not a proactive one: no disclosure is required unless the consumer affirmatively asks. Compare to the heightened obligation in § 13-75-103(2) for regulated occupations, which requires proactive disclosure without a consumer prompt.

Statutory Text

(1)(a) A supplier that uses generative artificial intelligence to interact with an individual in connection with a consumer transaction shall disclose to the individual that the individual is interacting with generative artificial intelligence and not a human, if the individual asks or otherwise prompts the supplier about whether artificial intelligence is being used. (b) The individual's prompt or question under Subsection (1)(a) must be a clear and unambiguous request to determine whether the interaction is with a human or with artificial intelligence.

T-01 AI Identity Disclosure · T-01.1 · Professional · ChatbotHealthcareFinancial Services

Utah Code § 13-75-103(2)-(3)

Plain Language

Individuals in regulated occupations (those regulated by the Utah Department of Commerce and requiring a license or state certification) must proactively and prominently disclose when a client is interacting with generative AI, if the use constitutes a high-risk AI interaction. This is an unconditional, proactive disclosure — unlike the consumer transaction rule in § 103(1), it does not wait for the consumer to ask. The disclosure must be provided verbally at the start of a verbal interaction and in writing before a written interaction begins. The high-risk trigger covers collection of sensitive personal data and personalized financial, legal, medical, or mental health advice, plus any additional categories the Division defines by rule. The provision also requires continued compliance with all existing requirements of the regulated occupation when delivering services through generative AI.

Statutory Text

(2) An individual providing services in a regulated occupation shall: (a) prominently disclose when an individual receiving services is interacting with generative artificial intelligence in the provision of regulated services if the use of generative artificial intelligence constitutes a high-risk artificial intelligence interaction; and (b) comply with all requirements of the regulated occupation when providing services through generative artificial intelligence. (3) A disclosure required under Subsection (2) shall be provided: (a) verbally at the start of a verbal interaction; and (b) in writing before the start of a written interaction.

T-01 AI Identity Disclosure · T-01.1 T-01.2 · Chatbot

Utah Code § 13-75-104(1)-(2)

Plain Language

A safe harbor protects any person from enforcement under the disclosure requirements of § 13-75-103 if their generative AI system clearly and conspicuously discloses — both at the outset and throughout the interaction — that it is generative AI, is not human, or is an AI assistant. This applies to both consumer transactions and regulated services. The practical takeaway: if you embed a persistent, prominent AI disclosure from the first message and maintain it throughout the session, you are shielded from enforcement even if you otherwise would have failed to comply with the on-demand or proactive disclosure requirements. The Division may issue rules specifying what forms and methods of disclosure satisfy or fail to satisfy this safe harbor.

Statutory Text

(1) A person is not subject to an enforcement action for violating Section 13-75-103 if the person's generative artificial intelligence clearly and conspicuously discloses: (a) at the outset of any interaction with an individual in connection with: (i) a consumer transaction; or (ii) the provision of regulated services; and (b) throughout the interaction that it: (i) is generative artificial intelligence; (ii) is not human; or (iii) is an artificial intelligence assistant. (2) In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the division in consultation with the office, may make rules specifying forms and methods of disclosure that: (a) satisfy the requirements of Subsection (1); or (b) do not satisfy the requirements of Subsection (1).