Source: Utah Code 13-72a-203 from le.utah.gov, rendered and cropped by us on November 8, 2026.
Say your nine-person startup ships a "feel better" chat feature, and a user in Salt Lake City types "I think I'm depressed." That is our illustration, not a case. If the bot answers like a therapist, Utah has had rules for it since May 7, 2025.
I read the enrolled copy of HB 452 (10 pages) and the current Utah Code chapter 72a (4 pages), plus the licensing section the bill added, 58-60-118. The headline version is "Utah regulates AI therapy bots." The text is narrower on who is covered and gives less protection than the word "safe harbor" suggests.
Does it cover your product?
The definition in 13-72a-101(10) has two parts, and both must be true. The bot uses generative AI to hold conversations "similar to the confidential communications that an individual would have with a licensed mental health therapist". And a supplier "represents, or a reasonable person would believe" it can or will provide mental health therapy or help a user manage or treat a mental health condition.
Source: Utah Code 13-72a-101, from le.utah.gov, rendered and cropped by us on November 8, 2026.
Two things are out. A tool that "only" gives scripted output, such as guided meditations, and a tool that "only" analyses what you type to connect you with a human therapist. In my reading, the "reasonable person would believe" limb means your marketing page and your bot's own greeting count, not just your legal copy. The law covers a "Utah user", anyone located in the state when they use it, so being based elsewhere does not take you out.
The three duties that have no defense attached
These sit in sections 201 to 203. I found no safe harbor for any of them in the text I read.
- Say it is AI. 13-72a-203 requires a clear and conspicuous statement that the chatbot is AI and not a human. It must come at three moments: before the user can use the features, at the start of any interaction after seven days without use, and any time the user asks or prompts about whether AI is being used.
- Keep ads out of the chat. 13-72a-202 lets you advertise a specific product in the conversation only if the ad is clearly labelled and any sponsorship, affiliation or promotion deal is disclosed. You may not use a user's input to decide whether to show an ad (unless the ad is for the chatbot itself), to choose the product or category, or to shape how it is presented. The chatbot-itself exception covers only that first decision: choosing a product or category, and customising the presentation, still may not use the user's input. Recommending that a user see a licensed professional, even a named one, is allowed.
- Do not sell or share what users tell it. 13-72a-201 bars selling or sharing, with any third party, a Utah user's individually identifiable health information or their input. Three exceptions: a health care provider asks with the user's consent; a health plan gets it at the user's request; or the data goes to a contracted party that is needed for the bot to work. In the last case both sides must follow the HIPAA privacy and security rules "as if the supplier were a covered entity". Under 45 CFR 160.103, a covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in a covered transaction. In my reading, a chat app is none of these on its own, which is why the statute borrows the rules by name.
The penalties are in 13-72a-204. The Division of Consumer Protection's director may impose an administrative fine of up to $2,500 for each violation. In court the division can ask for a declaration, an injunction, disgorgement, a fine of up to $2,500 per violation, or other relief, and the court must award its attorney fees, costs and investigative fees. A court may add up to $5,000 for each violation of an order. I do not know how "each violation" is counted, for example per user or per conversation.
What the policy filing really buys
This is the part I would not skim. Section 58-60-118 gives a supplier an "affirmative defense", provided it wrote and follows a policy that meets the 15 points below, keeps five kinds of documentation, and files the policy with the Division. Subsection (6) limits where that defense works.
Source: Utah Code 58-60-118, from le.utah.gov, rendered and cropped by us on November 8, 2026.
It "applies only in an administrative or civil action alleging a violation of" 58-1-501(1) or (2). Those are the licensing statute's lists of unlawful conduct and unprofessional conduct, and the first item in (1) is practicing, or representing yourself as practicing, a licensed profession without a licence. Chapter 72a is not on that list. So in my reading, a filed policy answers a "you acted as an unlicensed therapist" claim and does nothing for a disclosure, advertising or data-sale claim under 13-72a-204. Subsection (7) also says the section does not "recognize a mental health chatbot as a licensed mental health therapist".
There is a smaller oddity. The bill's own summary says it "creates rebuttable presumptions for suppliers who comply with policy requirements".
Source: HB 452 enrolled copy from le.utah.gov, page 1, cropped by us on November 8, 2026.
The enacted text says "affirmative defense", and I found no "presumption" in it. An affirmative defense is something you must raise and prove. A presumption would shift the burden. I would plan around the text, not the summary.
Utah's 15-point policy, in plain words
Subsection (3) says the written policy must state the chatbot's intended purposes and its abilities and limitations, and then describe procedures for these 15 things:
- Involving licensed mental health therapists in development and review.
- Developing and monitoring the bot consistently with clinical best practices.
- Testing before launch and regularly after, so its output poses no greater risk than therapy with a licensed therapist.
- Identifying foreseeable adverse outcomes and harmful interactions.
- Letting a user report a potentially harmful interaction.
- Assessing and responding to risk of harm to users or others.
- Detailing the actions taken to prevent or reduce those outcomes.
- Responding in real time to acute risk of physical harm.
- Regular, objective reviews of safety, accuracy and efficacy, which may be internal or external audits.
- Giving users any instructions needed for safe use.
- Making sure users understand they are talking to AI.
- Making sure users understand the bot's purpose, capabilities and limits.
- Putting user mental health and safety ahead of engagement metrics or profit.
- Preventing discriminatory treatment of users.
- Meeting the HIPAA privacy and security rules as if you were a covered entity, plus Utah's consumer protection rules, including 13-72a-201 to 203.
Separately, subsection (2)(b) wants documentation on five topics: the foundation models used, the training data, compliance with federal health privacy rules, user data collection and sharing, and ongoing work on accuracy, reliability, fairness and safety. Filing means giving the Division the supplier's name and address, the chatbot's name, the written policy and a fee. The fee is "set in accordance with Section 63J-1-504", and the Division may also charge an annual filing fee. I did not find the amount.
How I would use this
This is the desk's judgment, not legal advice. Ask counsel who knows Utah licensing law.
- Decide whether you are in. Read your landing page, app-store text and the bot's first message against the two-part definition. Log: product, claims found, date, who decided.
- Ship the three duties before anything else. Put the AI statement at the three moments, strip ad targeting that reads chat input, and list every vendor that receives chat data. Log: where each is implemented, date.
- Check vendor contracts for the HIPAA-style terms. The exception for sharing needed for functionality depends on them. Log: vendor, clause, date.
- Then decide on the filing. It is optional in the text. It helps only against unlicensed-practice claims, and it makes you follow your own written policy at the time of any alleged violation. Log: decision, reason.
- If you file, write the policy from the 15 points and keep the five kinds of documents. Do not promise a process you do not run. Log: document, owner, review date.
What this does not cover, and what I could not confirm
This is one state's law for one product type, and it does not replace HIPAA or Utah's other AI rules. I could not load the Division of Consumer Protection's site from this machine, so I do not know how to file, what the fee is, whether anyone has filed, or whether the Division has brought a case under chapter 72a. I did not find any court decision applying it. The code page I read shows chapter 72a "Amended by Chapter 95, 2026 General Session" in sections 101 and 204. Comparing it with the 2025 enrolled bill, the duties and the $2,500 figure look the same, but the attorney-general subsections of 204 are gone and the cross-references changed. I did not read the 2026 bill itself. The version of 58-1-501 I read is marked effective May 6, 2026 and superseded July 1, 2026, and I could not load the later one. I did not research whether 58-60-118 has been used in any licensing action.
