It Is Not a Defense: Utah's 2025 Law on Generative AI in Consumer Transactions and Regulated Services

In its 2025 general session, Utah's legislature passed S.B. 226, the "Artificial Intelligence Consumer Protection Amendments." Its enrolled copy describes it as a bill that "enacts provisions related to the use of generative artificial intelligence in consumer transactions and regulated services." It enacts a new chapter of the Utah Code, Sections 13-75-101 to 13-75-106. Its Section 9 says that, "Except as provided in Subsection (2), this bill takes effect on May 7, 2025."

Among its highlighted provisions, it "requires certain disclosures when generative artificial intelligence is used in consumer transactions and regulated services" and "establishes liability for violations of consumer protection laws involving artificial intelligence." Parts of the enrolled copy follow, not the whole.

Definitions

In the act, generative artificial intelligence is a system that "is trained on data," that "is designed to simulate human conversation with a consumer" through text, audio or visual communication, and that "generates non-scripted outputs similar to outputs created by a human, with limited or no human oversight." All three parts are joined by "and."

A "regulated occupation" is one that "is regulated by the Department of Commerce" and "requires an individual to obtain a license or state certification to practice the occupation." The act does not list the occupations by name.

Not a Defense

"It is not a defense to the violation of any statute administered and enforced by the division under Section 13-2-1," the act says, that generative artificial intelligence "made the violative statement," "undertook the violative act," or "was used in furtherance of the violation." The division is the state's Division of Consumer Protection.

The act also repeals Section 13-2-12, a provision enacted in 2024 on generative artificial intelligence and liability for violations of consumer protection law. And the chapter "does not displace any other remedy or right authorized under" the laws of the state or federal law.

Required Disclosures

The act sets two duties to disclose. A supplier that uses generative AI to interact with an individual in connection with a consumer transaction must disclose that the individual is interacting with generative AI "and not a human," "if the individual asks or otherwise prompts the supplier about whether artificial intelligence is being used." The question must be "a clear and unambiguous request to determine whether the interaction is with a human or with artificial intelligence."

"An individual providing services in a regulated occupation shall" prominently disclose when an individual receiving services is interacting with generative AI in the provision of regulated services, "if the use of generative artificial intelligence constitutes a high-risk artificial intelligence interaction." That disclosure "shall be provided" "verbally at the start of a verbal interaction" and "in writing before the start of a written interaction."

Section 13-75-103 also asks something beyond disclosure. An individual providing services in a regulated occupation "shall" also "comply with all requirements of the regulated occupation when providing services through generative artificial intelligence."

What makes an interaction high-risk is set out in the definitions. It involves the collection of sensitive personal information, "including" health, financial or biometric data. Or it involves "the provision of personalized recommendations, advice, or information that could reasonably be relied upon to make significant personal decisions," including financial, legal, medical or mental health advice or services. Or it is one of the "other applications as defined by division rule."

A safe harbor covers the disclosure section. A person is not subject to an enforcement action for violating Section 13-75-103 if the person's generative AI "clearly and conspicuously discloses" at the outset of any interaction with an individual in connection with a consumer transaction or the provision of regulated services, and "throughout the interaction that it" is generative AI, is not human, or is an artificial intelligence assistant. The division, in consultation with the state's Office of Artificial Intelligence Policy, may make rules on which forms and methods of disclosure do, and do not, satisfy that.

The Fines, and the Policy Act

The division "shall administer and enforce" the chapter. Its director "may impose an administrative fine of up to $2,500 for each violation," and in an action the division brings, a court may impose a fine of the same ceiling. A person who violates an administrative or court order issued for a violation of the chapter "is subject to a civil penalty of up to $5,000 for each violation."

The act also moves the repeal date of the Artificial Intelligence Policy Act, Title 13, Chapter 72, from May 1, 2025 to July 1, 2027. Section 9 sets its own rule for when that change takes effect.

The two rules point the same way. The occupation's requirements still apply when the service runs through generative AI, and under the statutes the division enforces, the AI is no defense. Which of a firm's conversations with clients would count as high-risk?