HB 452: Artificial Intelligence Amendments - Utah

Amended 2/27/2025 21:02:124 → Substitute #1 · 8 edits

MODERATE

This bill adds new regulations for mental health chatbots using artificial intelligence in Utah. It requires these chatbots to clearly disclose they are AI, prohibits sharing user data with third parties, and establishes enforcement powers with the Division of Consumer Protection. The bill also creates an affirmative defense for suppliers who follow specific safety and privacy policies.

Scope change

The bill expands the Division of Consumer Protection's authority to enforce new regulations specifically for AI-based mental health chatbots, adding Chapter 72a to the Utah Code.

DEFINITION

New definitions for 'mental health chatbot', 'generative artificial intelligence', 'Utah user', and related terms specific to AI therapy tools.

REQUIREMENT

Chatbots must clearly and conspicuously disclose to users that they are artificial intelligence, not human therapists, before access and at the start of each new session.

Suppliers cannot sell or share user data or health information with third parties, with limited exceptions for direct healthcare provider requests or user consent.

Chatbots cannot use user conversations to display advertisements or customize marketing to users.

Suppliers must create written policies for safety, testing, and privacy compliance, file them with the Division, and can use them as an affirmative defense against liability.

ENFORCEMENT

Division of Consumer Protection can impose administrative fines up to $2,500 per violation and seek court injunctions.

TIMELINE

Bill takes effect on May 7, 2025.

TECHNICAL

Reformatted the list of chapters under the Division of Consumer Protection, removing some chapters and adding the new AI mental health chapter.

Amended Excerpts 2/27/2025 21:02:124 → Amended 2/27/2025 21:02:124 · 5 edits

MODERATE

This bill adds Chapter 72a to the Utah Code to regulate artificial intelligence applications used for mental health. It establishes definitions for AI technology, sets requirements for how mental health chatbots handle user data, and grants enforcement authority to the Division of Consumer Protection. The changes expand consumer protections for users of AI mental health tools while clarifying how personal and health information can be shared.

Scope change

The bill adds a new chapter (Chapter 72a) specifically regulating artificial intelligence applications relating to mental health, expanding the Division of Consumer Protection's regulatory authority to include this new area.

SCOPE

Added Chapter 72a to the Utah Code establishing a new regulatory framework for AI applications used in mental health contexts.

DEFINITION

Added new definitions for 'Artificial intelligence', 'Artificial intelligence technology', 'Confidential communications', and 'Covered entity' to provide clarity on regulated terms.

REQUIREMENT

Established requirements for mental health chatbots regarding user disclosures, data handling, and policy creation and maintenance.

ENFORCEMENT

Granted enforcement authority to the Division of Consumer Protection to oversee compliance with the new mental health AI regulations.

Modified Section 13-2-1 to add Chapter 72a to the list of chapters administered and enforced by the Division of Consumer Protection.

Enrolled → Amended Excerpts 2/27/2025 21:02:124 · 6 edits

MODERATE

This bill adds new regulations for AI mental health chatbots in Utah, requiring suppliers to protect user data, disclose that the chatbot is AI, and implement safety policies. The House amendments refine definitions of generative AI and add exceptions for sharing personal data in the ordinary course of business, while maintaining strict rules against selling user health information.

Scope change

The bill applies to any supplier of mental health chatbots in Utah, regardless of whether the chatbot is developed in-state or out-of-state, as long as Utah users access it.

DEFINITION

Refined the definition of 'generative artificial intelligence' to clarify that it must simulate human conversation through text, audio, or visual communication, with limited or no human oversight.

REQUIREMENT

Added an exception allowing suppliers to share personal data with associated third parties in the ordinary course of business, provided they comply with federal privacy and security standards.

Maintained strict prohibitions on selling or sharing individually identifiable health information and user input with third parties, with limited exceptions for healthcare providers and health plans with user consent.

Added requirements for suppliers to file written policies with the Division of Consumer Protection, including documentation of foundation models, training data, and ongoing safety efforts.

ENFORCEMENT

Established enforcement authority for the Division of Consumer Protection, including administrative fines up to $2,500 per violation and court penalties up to $5,000 per violation.

TIMELINE

Set the effective date of the bill as May 7, 2025.

Substitute #1 → Substitute #2 · 4 edits

MODERATE

This bill was revised to update the Senate sponsor name, remove several previously listed chapters from the Division of Consumer Protection's enforcement authority, and add a new definition for 'covered entity' to align with federal privacy regulations. The core policy provisions regarding mental health chatbot regulation remain substantively unchanged.

Scope change

The bill's scope was slightly narrowed by removing six chapters from the list of laws the Division of Consumer Protection administers, while adding a new definition to clarify compliance with federal health privacy standards.

TECHNICAL

Updated Senate Sponsor name from 'LONG TITLE' to 'Kirk A. Cullimore'.

Minor formatting adjustments including page breaks and line numbering in the document layout.

ENFORCEMENT

Removed six chapters from the Division of Consumer Protection's enforcement list: Utah Social Media Regulation Act, Vehicle Value Protection Agreement Act, Utah Commercial Email Act, Online Dating Safety Act, Lawyer Referral Consultants Registration Act, and Automatic Renewal Contracts Act.

DEFINITION

Added a new definition for 'covered entity' referencing 45 C.F.R. Sec. 160.103 to clarify compliance obligations with federal health privacy regulations.

Introduced → Enrolled · 8 edits · Mar 26, 2025

MODERATE

This bill enacts new regulations for mental health chatbots using artificial intelligence in Utah. It establishes definitions for AI chatbots, prohibits sharing user health data with third parties, requires clear disclosure that users are interacting with AI, and creates a new Division of Consumer Protection chapter to enforce these rules. The bill also provides legal protections for suppliers who follow specific safety and policy requirements.

Scope change

New chapter 72a is added to Utah Code specifically regulating artificial intelligence applications relating to mental health, expanding the Division of Consumer Protection's enforcement authority to include this new area.

DEFINITION

New definitions for 'mental health chatbot', 'generative artificial intelligence', 'Utah user', and 'user input' to clarify what the law covers.

REQUIREMENT

Suppliers must clearly disclose that the chatbot is AI and not a human before users access features, at the start of interactions after seven days, and when users ask about AI usage.

Suppliers are prohibited from selling or sharing user health information or user inputs with third parties, with limited exceptions for research, healthcare providers, or user requests.

Suppliers cannot use user input to determine or customize advertisements shown during mental health chatbot conversations.

Suppliers must create written policies describing chatbot purposes, limitations, safety testing, and user safety protocols, with documentation of foundation models and training data.

ENFORCEMENT

Division of Consumer Protection gains authority to impose administrative fines up to $2,500 per violation and pursue civil penalties up to $5,000 per violation.

ELIGIBILITY

Suppliers who comply with policy requirements receive rebuttable presumptions that they did not engage in unlawful or unprofessional conduct and were not negligent.

TECHNICAL

Senate sponsor name changed from 'LONG TITLE' to 'Kirk A. Cullimore' in the enrolled copy.

Artificial Intelligence Amendments

What changed between versions

How they voted

Actions timeline

Sponsors