USA – UTAH Trends and Developments Contributed by: Clifford Blair, Kirton McConkie
ture enacted complementary provisions addressing mental health chatbots and expanded protections against unauthorised AI-generated impersonations. These changes tailor Utah’s AI regulatory environment towards more specific consumer protection contexts while maintaining an innovation-friendly posture. Strengthened oversight of government agencies House Bill 444 strengthened privacy oversight within state government. It increased the authority of the Utah Privacy Commission and clarified rules govern - ing how agencies collect and use personal data. For example, government websites must include plain- language privacy notices. Agencies must also iden - tify high-risk data practices, such as facial recognition and automated profiling. Contractors working with state agencies must comply with similar standards. Organisations that provide services to the government should review contractual privacy provisions carefully and ensure alignment with statutory expectations. Utah’s 2026 General Session is ongoing, and several introduced measures would materially affect cyber - security co-ordination and AI oversight. Because bills may be amended during the session, organisations should track both the substance and the direction of travel: the proposals collectively signal continued leg - islative interest in technology governance, account - ability and risk controls. State-endorsed digital identity programme (SB 275) The 2026 Legislative Session: Ongoing Developments (as of 20 February 2026) Senate Bill 275 would create a state-endorsed digital identity programme and, notably, would establish a statutory digital identity bill of rights. The bill’s text frames core principles around individual control, vol - untariness (including a right not to be compelled by the state to use a digital identity in place of a physical credential), transparency in design and operation, and protections against surveillance or persistent monitor - ing except as authorised by law. The proposal would also set out requirements and responsibilities for multiple participants in the eco - system (including governmental entities and private- sector participants, such as digital wallet providers,
verifiers and relying parties), and includes enforce - ment and complaint pathways. In practice, if enacted, Senate Bill 275 could become a key “plumbing” stat - ute for identity-related privacy in Utah, with down - stream implications for authentication, attribute shar - ing and data-handling expectations across services that choose to recognise state-endorsed credentials. AI transparency amendments (HB 286) House Bill 286 would enact an AI Transparency Act aimed at “frontier” AI models. The bill would require developers of certain covered models to create and publish public safety and child protection plans, pub - lish summaries of risk assessments, and report certain safety incidents to the Office of Artificial Intelligence Policy. The proposal also includes civil penalties and employee whistle-blower protections tied to reporting safety concerns. AI amendments (HB 438) House Bill 438 would enact an AI Companion Chat - bot Safety Act to regulate AI companion chatbots and protect consumers. The bill’s highlighted provisions include requiring suppliers to implement safety proto - cols (and assess their efficacy), facilitate independent evaluation, and publicly report on safety protocols and related metrics. It would also give the Office of Artifi - cial Intelligence Policy authority to establish disclosure standards and monitor compliance, and it proposes restrictions that are directly privacy-adjacent, includ - ing limits on selling or sharing highly sensitive infor - mation and additional protections involving minors. As drafted, HB 438 reflects Utah’s continued pattern of regulating AI at specific consumer-risk touchpoints rather than attempting to impose a single, omnibus AI framework. Government cybersecurity amendments (SB 123) Senate Bill 123 would affect government cybersecu - rity by modifying provisions related to the Utah Cyber Center. The highlighted provisions include expanding the Cyber Center’s duties to include local education agencies, adjusting deadlines for statewide strategic cybersecurity planning, making changes to the com - position of the Cybersecurity Commission, and creat - ing a restricted account for the Cyber Center.
625 CHAMBERS.COM
Powered by FlippingBook