What does Utah SB 226 (2025) say about AI in banking?

What are the key points of Utah SB 226 (2025)?

• Section 13-77-101 (enacted as 13-75-101 in the enrolled bill): generative AI is an AI technology system that is trained on data, is designed to simulate human conversation with a consumer through text, audio or visual communication, and generates non-scripted outputs similar to a human's with limited or no human oversight; a 'high-risk artificial intelligence interaction' involves collection of health, financial or biometric data, or personalized advice that could reasonably be relied on for significant personal decisions, including financial advice or services, or other applications defined by division rule.
• Section 13-77-102: it is not a defense to the violation of any statute administered and enforced by the Division of Consumer Protection that generative AI made the violative statement, undertook the violative act, or was used in furtherance of it.
• Section 13-77-103(1): a supplier that uses generative AI to interact with an individual in connection with a consumer transaction shall disclose that the individual is interacting with generative AI and not a human if the individual asks or otherwise prompts the supplier; the request must be clear and unambiguous.
• Section 13-77-103(2)–(3): an individual providing services in a regulated occupation shall prominently disclose a generative AI interaction when it is a high-risk interaction, verbally at the start of a verbal interaction and in writing before a written interaction, and must still meet all requirements of the occupation.
• Section 13-77-104: a person is not subject to enforcement for violating Section 13-77-103 if the generative AI clearly and conspicuously discloses at the outset of the interaction, and throughout it, that it is generative AI, is not human, or is an AI assistant; the Division, in consultation with the Office of Artificial Intelligence Policy, may make rules on disclosure forms that do or do not satisfy the safe harbor.
• Section 13-77-105: a violation is a violation of Section 13-11-4(1), the Consumer Sales Practices Act's deceptive-act provision; the Division director may fine up to $2,500 per violation, a court may declare, enjoin, order disgorgement and fine up to $2,500, and violation of an order carries a civil penalty of up to $5,000 per violation. The Attorney General acts as counsel to the Division.
• Section 13-77-106 preserves other remedies under Utah and federal law. SB 226 repealed original Section 13-2-12 and amended Section 63I-2-213, but the repeal-date list in that section names only Title 13, Chapter 72, the AI Policy Act, not the disclosure chapter.
• SB 332 (Artificial Intelligence Revisions), signed March 25, 2025, amended Section 63I-2-213 to repeal Chapter 72 on July 1, 2027 instead of May 1, 2025; in 2026 HB 320 (signed March 18, 2026, effective May 6, 2026) amended Chapter 72's learning-laboratory provisions, and a 2026 amendment (2026 General Session, Chapter 95, effective May 6, 2026) updated cross-references in Section 13-77-101.

What did Utah SB 226 (2025) change for banks?

SB 226 narrowed Utah's 2024 disclosure rule: it is no longer enough that a person used generative AI in any act the Division administers, because the proactive duty now applies only to licensed professionals in high-risk interactions and other disclosure happens only when a consumer clearly asks. It added a safe harbor and a 'high-risk' definition that names financial data and financial advice, which are the bank-relevant cases. The no-defense principle and the penalties carried over, and SB 332 kept the Office's regulatory sandbox alive until July 1, 2027.

What does Utah SB 226 require of banks that use generative AI with customers?

Utah S.B. 226, effective May 7, 2025 and codified in Title 13, Chapter 77, requires a supplier that uses generative AI with a consumer to say so only when the consumer clearly and unambiguously asks whether they are dealing with a human or AI (Section 13-77-103(1)); it does not require an unprompted notice. It also provides that using generative AI is no defense to any consumer-protection violation (Section 13-77-102), so a bank answers for what its chatbot says. A bank gets a safe harbor if its generative AI clearly and conspicuously discloses at the outset and throughout the interaction that it is generative AI or not human (Section 13-77-104). The stricter proactive duty applies to individuals in occupations regulated by the Department of Commerce when the interaction is high-risk, which includes collection of financial data and financial advice. The Division of Consumer Protection can fine up to $2,500 per violation.

SB 149's disclosure section applied to any act the Division administers. SB 226 reduced the default to a disclosure on request, added a bright-line safe harbor that rewards proactive disclosure, and confined the unprompted duty to licensed occupations in a high-risk setting. A bank's chatbot that is clearly labelled as an AI assistant throughout the conversation is within the Section 13-77-104 safe harbor and need not parse each customer question.

The principal exposure for a bank is Section 13-77-102 read with Section 13-11-4(1). Because a violation of the AI chapter is a deceptive act under the Consumer Sales Practices Act, and because AI is no defense, an inaccurate or misleading chatbot statement about a product is attributed to the bank. Utah's Consumer Sales Practices Act excludes the credit terms of a transaction otherwise subject to it (Section 13-11-22(1)(d)), which limits its reach for loan pricing but not for other statements in a transaction. There is no Utah credit-underwriting AI rule; fair-lending exposure remains federal.

Beyond the disclosure rule, SB 226 and its companions show the direction: Utah chose enforcement through its consumer-protection division and a sandbox, rather than an impact-assessment regime. The Division may write rules on disclosure forms and on additional high-risk applications, and the Office of Artificial Intelligence Policy remains available for regulatory mitigation agreements until Chapter 72's scheduled repeal on July 1, 2027.

WHAT THIS MEANS IN PRACTICE

• Label customer-facing generative AI as an AI assistant at the start of every session and keep the label visible throughout; that is the Section 13-77-104 safe harbor and removes the need to judge whether a customer's question was clear and unambiguous.
• Make sure a human-handoff or 'are you a human?' intent is handled honestly by the bot; a clear request must get a truthful answer.
• Treat chatbot statements as the bank's own for deception purposes under Section 13-77-102; apply product-claim review and monitoring to AI-generated responses.
• If advisers in Utah-licensed occupations (individuals in occupations licensed by the Department of Commerce) use generative AI in high-risk interactions, build the verbal and written disclosure steps in Section 13-77-103(3).
• Watch for Division rules on disclosure form (Section 13-77-104(2)) and on additional high-risk interactions (Section 13-77-101(5)(c)); either could add specifics for financial services.