TL;DR: Utah's AI Policy Act requires honest disclosure when a user asks if they're talking to AI. No proactive disclosure required. Penalties reach $2,500 per violation. Update your chatbot scripts and support team training now.
Utah moved first. When Governor Spencer Cox signed HB 452, the Artificial Intelligence Policy Act, on March 22, 2024, with an effective date of May 1, 2024, Utah became the first US state to enact an AI-specific consumer protection disclosure law. While it is more limited in scope than the EU AI Act or California's subsequent legislation, it created a clear compliance obligation that every company using AI in consumer-facing services in Utah needs to understand.
Two years into the law's operation, there is now enough practical experience with the disclosure trigger concept to explain what it means day to day and what companies have gotten wrong in implementation.
The core requirement in plain language
The Utah AI Policy Act prohibits companies from deceiving consumers about whether they are interacting with a human or an AI. Specifically: if a consumer sincerely asks whether they are talking to a human or to an artificial intelligence, the company must answer honestly.
That is it. The law does not require you to announce at the start of every AI interaction that you are using AI. It does not require you to label all AI-generated content. It does not require an audit or a risk assessment. It requires one thing: don't lie to consumers who ask.
The deceptive practice that the law prohibits is this: a consumer asks "Am I talking to a real person?" and your AI responds "Yes, I'm a human support agent here to help you." That is the violation the law is designed to prevent.
What "sincerely asks" means
The sincere inquiry standard is doing real work in the law. Not every question about AI identity is a sincere inquiry, and the law's scope tracks with the inquiry's nature.
A sincere inquiry is a genuine question seeking to understand the nature of the interaction. Examples:
- "Am I talking to a bot?"
- "Is this an AI or a real person?"
- "Are you a human customer service agent?"
- "Is anyone reading these messages or is this automated?"
A question that is not a sincere inquiry might be a rhetorical statement ("You sound like a robot") or a conversational exaggeration that a reasonable person would not interpret as a genuine request for information about the AI's nature.
In practice, a company's AI system should be configured to recognize the substance of an identity question and respond with accurate disclosure whenever there is any reasonable possibility the user genuinely wants to know. The risk of over-disclosing (telling someone "I'm an AI" when they already knew) is essentially zero. The risk of under-disclosing (telling someone "I'm a human" when they genuinely wanted to know) is $2,500 per violation.
Who is covered
The law applies to any company that:
- Uses generative AI in consumer-facing products or services, and
- Operates in Utah or serves Utah consumers.
There is no revenue threshold, no employee minimum, and no industry carve-out. A startup with three employees and an AI chat widget on its website is covered if it has Utah customers. A national enterprise with a customer service AI platform is covered. The scope is intentionally broad because the disclosure obligation itself is narrow.
"Generative AI" in the law's context covers AI systems that generate text, voice, or other content in response to user input in a way that could reasonably be mistaken for human communication. This covers most modern AI chatbots and support assistants. It also covers AI voice bots in phone support.
Enforcement and penalties
The Utah Division of Consumer Protection has authority to investigate violations and assess civil penalties. The penalty ceiling is $2,500 per violation. Each instance of deceptive AI identity disclosure is a separate violation.
Enforcement is complaint-driven and regulatory; there is no private right of action under the Utah AI Policy Act. Consumers cannot sue directly. They can file complaints with the Division, which then investigates.
The practical enforcement mechanism means companies are unlikely to face large penalty volumes unless they have a systemic and documented pattern of deceptive disclosure. That said, a single investigation can be costly in time, legal fees, and reputational impact even if the monetary penalty is modest.
Implementing disclosure: what to update
Compliance is not technically complex, but it requires deliberate updates to your AI systems and team procedures.
Chatbot and AI assistant configuration
Update your AI system's instructions to include a disclosure response for identity questions. The response does not need to be verbose. Something direct and honest is appropriate.
Avoid: "I'm a knowledgeable support specialist here to help." Avoid: "I'm a member of the [Company] support team." Avoid: Deflecting the question with "Let's focus on your issue."
Use: "I'm an AI assistant. I can help with [scope of support]. Would you like to continue, or would you prefer to speak with a human agent?"
The response should be honest, brief, and practical. Offering the option to reach a human is not required by Utah law but is good practice and reduces escalation friction.
Voice AI and phone bots
Voice-based AI systems have the same disclosure obligation. If a customer on a phone support line asks "Am I talking to a real person?" and the AI voice bot continues the interaction without disclosing that it is an AI, that is a violation.
Configure your voice AI system to recognize identity questions and respond with clear disclosure. In a voice context, the response should be brief and natural: "I'm an automated voice assistant. If you'd prefer to speak with a human agent, press 2 at any time."
Customer support team training
Even if your AI system is properly configured, human agents who take over escalated conversations need to understand the disclosure requirement. If a customer asks an agent who inherited a chat conversation "Was I just talking to a bot?", the agent should answer honestly, not retroactively cover for the AI.
Train support managers on the disclosure requirement, update your onboarding materials for support agents, and add a section to your AI acceptable use policy.
Documentation
Keep records showing that your AI systems are configured for accurate disclosure. If the Division of Consumer Protection investigates a complaint, your ability to demonstrate that you had proper disclosure configurations in place is important evidence. Screenshots of bot configuration, change logs, and team training records all contribute to a defensible compliance record.
Sample disclosure language
These examples can be adapted for chatbot, voice AI, and email AI assistant contexts.
Chat bot (when asked if it's a human): "I'm an AI assistant. I can answer most questions about [product/service area]. If you'd prefer to connect with a member of our team, type 'agent' at any time and we'll get someone with you."
Voice bot (at start of call or when asked): "You're connected with [Company]'s automated support system. I can help with account questions, billing, and common issues. Say 'representative' at any time to reach a human agent."
Email or messaging AI: "Just a note: this response was generated by our AI assistant. If you have a question that needs a human review, reply with 'HUMAN REVIEW' and a team member will follow up within [timeframe]."
None of these examples are verbatim requirements. The law requires honest response to sincere inquiry, not specific script language. Adapt to your brand voice while maintaining accuracy.
How Utah compares to other AI disclosure requirements
| Framework | When disclosure is required | Who must disclose | Penalty |
|---|---|---|---|
| Utah HB 452 | When user sincerely asks | Any company using generative AI in consumer-facing services in Utah | Up to $2,500 per violation |
| EU AI Act Article 50 | Proactively at start of AI interaction (for most covered contexts) | Deployers of covered AI systems with EU users | Up to 15 million EUR or 3% of global turnover |
| California SB 942 | Labeling on AI-generated content | Covered AI providers | Civil penalties |
| Colorado SB 189 | Notice before automated decision in covered contexts | Deployers of high-risk AI | Civil enforcement |
The Utah law is the least demanding of these frameworks in terms of when disclosure must occur. A company that complies with EU AI Act Article 50 (which requires proactive disclosure at the start of AI interactions) automatically satisfies the Utah requirement, because a user who has already been told they are talking to AI and then asks again gets an honest answer by design.
For companies serving both EU customers and US customers, adopting the EU proactive disclosure standard for all users is the cleanest path. It satisfies Utah's triggered disclosure requirement, eliminates the need to determine which users are in which jurisdiction, and builds the user trust that proactive transparency creates.
See EU AI Act Article 50 watermarking and deepfake disclosure for what EU proactive disclosure requires. See California SB 942 AI transparency act August 2026 compliance for California's labeling approach.
Compliance checklist
Complete this before you consider Utah compliance done.
- Identify every consumer-facing AI product or feature that Utah consumers can access
- Verify that each AI system is configured to respond accurately to identity questions (test manually with "Are you a human?" queries)
- Review voice AI systems separately and test identity question handling in the voice context
- Update customer support training materials to cover the disclosure requirement
- Add an AI identity disclosure section to your internal AI acceptable use policy
- Create a documentation record: screenshot or export current bot disclosure configurations, note the date, save to your compliance folder
- Set a calendar reminder to re-test disclosure behavior after any major AI system update or provider change
Related reading
For the EU proactive disclosure standard that often makes sense to adopt alongside Utah compliance, see EU AI Act Article 50 watermarking and deepfake disclosure. For California's content labeling requirements effective August 2026, see California SB 942 AI transparency act August 2026 compliance. Check all AI law effective dates at AI regulation deadline calendar 2026. Build a broader governance program with the AI governance checklist 2026. For employee-facing AI policies, see ChatGPT usage policy for employees and AI acceptable use policy template small teams.
Utah was the first US state AI disclosure law, but multi-state compliance is now the norm for any consumer-facing product with national reach. If your team is managing Utah disclosure requirements alongside California SB 942 and EU AI Act Article 50, see the multi-state AI compliance strategy 2026 for a framework that covers all three without duplicating effort.
