Policy Work
Utah Studies AI Before Regulating It
The Office of Artificial Intelligence Policy works with legislators and other state leaders year round. Our engagement is guided by a learning agenda: a short list of AI-related topics and questions where the technology is moving faster than the law, and recommendations for what Utah should do.
We study each topic with the people closest to it. Companies building the technology, researchers measuring it, lawyers who have to apply existing rules to it, and Utahns living with the results. Then we bring what we learn back to policymakers. Some of that work becomes law. The rest keeps lawmakers and the public informed while the picture is still forming.
Utah Code § 13-72-301(3) directs this office to periodically set a learning agenda naming the specific areas of AI policy it intends to study, and to consult state agencies, industry, Utah academic institutions, and others with relevant expertise in doing so.
Key Policy Objectives
Three commitments shape every agenda we set.
-
Observe and Learn
The technology changes faster than any legislative session can keep up with. We cannot regulate what we do not yet understand, so we prioritize learning first.
-
Protect the Public
Utahns should be safe from foreseeable harm like deception, fraud, misuse of personal data, and products that withhold crucial information from consumers.
-
Foster Innovation
Clear, current rules are a competitive advantage. Companies are more likely to build the right tools if they know what the law asks of them.
Our Learning Agenda Topics
Each topic expands to show the full entry.
2026 Current Agenda
Healthcare AI
Active
What we askedWhere can artificial intelligence safely support care in Utah, and which of the rules already governing medicine, licensing, privacy and records apply to it without anyone writing a new law?
Why it matters in UtahUtah clinics and hospitals are already using these tools to draft notes, sort scheduling, flag imaging and route patients. The rules that govern medical practice were written on the assumption that a licensed human does the work. Most of them still fit. A few do not, and providers cannot always tell which is which. That uncertainty slows down the safe uses as much as the risky ones.
Where the work standsWe are mapping which existing requirements already reach clinical and administrative AI, where a provider genuinely cannot tell what applies, and which of those gaps a written interpretation from the state could close faster than legislation would. Findings go to the Business and Labor Interim Committee this year.
Liability
Active
What we askedWhen an AI system contributes to harm, who answers for it: the developer who built it, the business that deployed it, the professional who relied on it, or the person who used it?
Why it matters in UtahThis is the question underneath every other AI question. Without a clear answer, careful companies price in the worst case and cautious professionals avoid tools that would help their clients. Utah has long-settled law on product defects, professional duty and negligence. The work is finding out how much of it already covers these systems, and being honest about where it does not.
Where the work standsWe are working through how existing Utah doctrine allocates responsibility across the chain from developer to end user, and where the answer changes depending on how much a human actually decided. Our aim is a rule that puts responsibility where the real decision was made, rather than on whoever is easiest to name.
Agentic AI
Active
What we askedWhat changes when AI stops giving advice and starts taking action, booking, purchasing, filing, negotiating and moving money on someone's behalf?
Why it matters in UtahAn agent that acts for you raises questions Utah law has answered before in other settings: who authorized the act, what the authorization covered, whether the person on the other side was entitled to rely on it, what record exists afterward, and who is bound when the agent gets it wrong. The novelty is the speed and the scale, not the legal question.
Where the work standsWe are testing how far existing agency, contract and consumer protection principles stretch before something genuinely new is required, and what a business or a consumer needs to be able to see when an agent is acting for them.
2025
Data Provenance
Complete
What we askedWhen a convincing image, voice or document can be generated in seconds, how does an ordinary person tell what is authentic, and what should the state require, or deliberately not require, to help?
Why it matters in UtahProvenance is not one problem. It shows up in elections, in fraud against older Utahns, in evidence offered to a court, in local journalism, and in the value of a person's own face and voice. The technical answers, watermarking and content credentials among them, are still being standardized, and some of them survive an ordinary screenshot while others do not. A state that mandates the wrong method locks in a false sense of security.
What came of itWe looked at which provenance methods hold up under normal use, what they can and cannot prove, and where a disclosure requirement would help a Utahn decide what to trust rather than simply adding a label nobody reads. The findings helped inform H.B. 276 (2026). The law establishes clear legal protections against non-consensual AI deepfakes and institutes digital content provenance requirements that act as a digital fingerprint to help citizens verify the authenticity of online media.
2024 First Learning Agenda
Mental Health
Complete
What we askedHow should Utah treat AI chatbots that people turn to for mental health support, when those tools are not licensed therapists and sit outside the rules that govern therapy?
Why it matters in UtahUtahns were already using these tools, at hours and at a price no clinic can match. That reach is real and worth something. But nothing required a chatbot to say plainly that it was not a person, and nothing limited what a company could do with what someone disclosed to it at their lowest moment.
What came of itOur research and stakeholder engagement helped inform H.B. 452 (2025). The law strengthens protections around personal data and targeted advertising for users of mental health chatbots, and creates a safe harbor for companies developing these tools responsibly. The office also published best-practice guidance for mental health providers.
Resources
What happens to what we learn
A learning agenda is only worth setting if the findings go somewhere. Three routes carry them.
-
Published guidance
The office may develop and publish guidance, best practices and other resources to inform Utah consumers and the businesses serving them, under Utah Code § 13-72-201(4).
-
Agreements with participants
Findings shape the terms the office negotiates in regulatory mitigation and joint interpretation agreements under § 13-72-401: what is tested, what safeguards apply, and what a participant must disclose.
-
Report to the Legislature
Each year before November 30 the office reports to the Business and Labor Interim Committee on the proposed agenda, the findings, the agreements executed, and any legislation it recommends, under Utah Code § 13-72-201(3)(d).
Participation in the AI Learning Laboratory, including signing a regulatory mitigation agreement or joint interpretation agreement, does not constitute an endorsement or approval from the state. Participants remain subject to every legal and regulatory requirement not expressly waived or clarified by their agreement. Utah Code § 13-72-401(7) and (9).
Who we hear from
An agenda set from inside a government office would only teach us what we already believe. These are the perspectives we look for on every topic.
-
Community members
Utahns who use these products, or are affected by someone else using them, and can describe what that is like.
-
Researchers and academics
Utah institutions and outside experts who can tell us what the evidence supports and what is still an open question.
-
Legal experts
Practitioners who apply existing Utah law to these tools and can point to exactly where it runs out.
-
Companies
Builders and deployers who can show us what the technology actually does today, and where a rule would land in practice.
Get involved
If you work on any of the questions above, or one you think belongs on a future agenda, we would like to hear from you. Contributing does not require a company, a law degree or a prepared position.