Utah AI Policy Act compliance, generated from your own systems.
Utah SB 149 — the Artificial Intelligence Policy Act — establishes generative-AI disclosure duties under the Utah Consumer Sales Practices Act, creates the Office of Artificial Intelligence Policy (OAIP) and the AI Learning Lab regulatory-sandbox programme.
Use of generative AI in consumer interactions must be disclosed if asked. In regulated occupations, it must be disclosed up front — and the operator remains liable as if a human had performed the act.
Under § 13-2-12, a person using generative AI in a consumer transaction subject to the UCSPA must clearly and conspicuously disclose that the consumer is interacting with generative AI, if and when the consumer asks. Failure is a UCSPA violation, with civil penalties and full Division of Consumer Protection enforcement.
Under § 13-72-301, where the consumer interaction involves a regulated occupation — those requiring a licence from the Division of Professional Licensing (doctors, lawyers, accountants, real-estate agents, mental-health professionals and others) — the disclosure obligation is affirmative: it must be made up front in oral interactions, prominently in written interactions, before the generative AI is used. Subsequent 2025 amendments (HB 452) added specific rules for mental-health chatbots.
A person using generative AI is liable for the act, statement or omission of the AI as though a human had performed it. Generative-AI use is not a defence; it is a fact about how the act was performed.
Beyond disclosure, the OAIP runs the AI Learning Lab — a regulatory-sandbox programme through which operators of novel AI can obtain regulatory mitigation agreements while learning agendas are studied. The OAIP also reports annually to the legislature on AI-policy recommendations.
The files this framework actually requires.
Utah's compliance footprint is small and concrete. Hael generates the disclosure language, the consumer-response procedure and the regulated-occupation evidence the Division will ask for.
GRC tools tell you these are missing. Hael generates them — from each system's real configuration.
A checklist tells you what's missing. Hael puts it on record.
Utah does not ask 'are you using AI?' It asks 'did you tell the consumer when you should have?' Hael holds the evidence that you did.
Discover, classify, produce — for Utah AI Policy Act.
Find the systems in Utah AI Policy Act scope, including embedded third-party AI.
Assess each against Utah AI Policy Act's risk tiers and obligations.
Generate the Utah AI Policy Act records, versioned and current.
Every obligation, mapped to the control that satisfies it.
Rows are the framework's clauses.
Columns are the controls and files that satisfy them.
Cells update as the underlying configuration changes.
Clause by clause.
Author once. Satisfy many.
Utah's disclosure infrastructure is the consumer-notice surface of the same generative-AI governance Colorado, California ADMT and the EU AI Act (Article 50 transparency) ask for. Build the operator-side acceptable-use and disclosure policy once; render it to each jurisdiction's surface.
Make every consumer-facing generative-AI surface Utah-fit.
Bring a generative-AI consumer interaction. We'll register it, classify the disclosure obligation (general or regulated-occupation), and show the disclosure language and response procedure Hael would generate.