USA – UTAH Trends and Developments Contributed by: Clifford Blair, Kirton McConkie
ing its implementation, concluding that Utah had not demonstrated that the statute was likely to withstand First Amendment scrutiny, notwithstanding the state’s interest in protecting minors. The related litigation, most prominently NetChoice v Reyes , remains ongo - ing. Most recently, the state urged the Tenth Circuit Court of Appeals to reinstate the law, arguing that it regulates structural platform features rather than protected speech. Members of the appellate panel questioned whether the statute can meaningfully dis - tinguish between regulated design features and con - stitutionally protected expression. As a result of the litigation, no social media age-verification or platform- design restrictions are currently enforceable in Utah while the legal challenges proceed. The Artificial Intelligence Policy Act and AI Governance Utah’s Artificial Intelligence Policy Act, effective 1 May 2024, established the Office of Artificial Intelligence Policy and the Artificial Intelligence Learning Labo - ratory Programme. The Learning Laboratory permits regulatory mitigation agreements for AI innovators operating under defined safeguards, including the possibility of limited exceptions from certain state- level regulatory requirements. Participants must dem - onstrate technical competence, financial capacity and effective risk management plans, and are required to report incidents promptly and to comply with cyber - security auditing procedures. In addition to creating this innovation-focused frame - work, Utah’s AI legislation emphasises transparency at consumer-facing touchpoints. Businesses must disclose when individuals are interacting with AI sys - tems, such as chatbots or automated service tools. Certain high-risk applications, including AI tools used in sensitive contexts such as mental health support, are subject to additional restrictions relating to adver - tising practices, data use and consent. Although the Artificial Intelligence Policy Act encour - ages innovation through regulatory mitigation, it also clarifies that existing consumer protection laws apply to AI applications. Organisations deploying AI should therefore integrate AI governance into broader privacy and compliance frameworks. Practical steps include:
• inventorying AI systems currently in use; • evaluating whether consumer disclosures are required; • implementing structured review mechanisms for higher-risk applications; and • maintaining documentation of AI-related decision- making processes. Utah’s approach reflects a dual objective: promoting responsible innovation while embedding oversight where consumer risk is most acute. The 2025 Legislative Session: Recent Legislative Developments While the Utah Consumer Privacy Act remains the foundation of Utah’s privacy framework, the Utah Legislature has continued to refine and expand the state’s approach to data governance. Since the Utah Consumer Privacy Act’s adoption in 2022, lawmak - ers have enacted and amended statutes addressing cybersecurity co-ordination, electronic data access, social media governance and AI oversight. Together, these measures create a layered regulatory environ - ment in which privacy, security and consumer protec - tion intersect. The 2025 legislative session expanded Utah’s privacy framework beyond the Utah Consumer Privacy Act, with lawmakers introducing measures that address government data governance and AI transparency. These changes reflect how Utah is increasingly treat - ing privacy as a cross-cutting issue with a broader In 2025, the Utah Legislature amended the Artificial Intelligence Policy Act to refine and extend its regula - tory framework. Under the follow-on legislation signed in the 2025 General Session, including Senate Bill 226 and Senate Bill 332, the scope and requirements of the act were narrowed and clarified, and the act’s sunset date was extended until 1 July 2027. These amendments focus the AI disclosure obligations on instances where consumers make a clear and unam - biguous request to know whether they are interacting with AI and limit proactive disclosure obligations for high-risk interactions involving sensitive personal or regulated occupational data. In addition, the legisla - view of privacy risk. Changes to AI policy
624 CHAMBERS.COM
Powered by FlippingBook