Utah enacts first state law specifically regulating generative AI

Utah’s governor signed SB 149, known as the Artificial Intelligence Policy Act, making Utah the first US state with a law specifically targeted at generative AI rather than data privacy or automated decision-making generally. The bill had passed the state legislature earlier the same month and took effect on 1 May 2024.

The law’s central requirement is disclosure: businesses in regulated occupations must tell a consumer, if asked, when they are interacting with generative AI rather than a person, and that any resulting output — text, audio or video — was generated with limited or no human oversight. It also holds that using generative AI does not excuse a business from consumer-protection laws that would otherwise apply to a human employee’s conduct, closing a gap where AI-mediated harm might have escaped existing statutes.

Beyond disclosure, the act created a state Office of Artificial Intelligence Policy and a regulatory “learning laboratory” — a sandbox in which companies could test AI applications with reduced regulatory liability under state supervision, an approach state legislators pitched as friendlier to innovation than blanket restriction.

Utah’s law was narrower than the comprehensive AI statutes some other states and the EU were drafting around the same period, but its early date and disclosure-first approach made it a reference point cited in subsequent state legislative debates. Utah amended the act the following year to tighten requirements for higher-risk interactions.