Utah's AI disclosure law: what a dental office has to do

If your dental office has a chatbot on its website, or an AI assistant answering the phone or replying to messages, Utah's Artificial Intelligence Policy Act applies to you. The fix is small. The risk of ignoring it is not. This post explains what the law asks of a dental practice in plain English, with the details a lawyer would want you to know.

The law in one paragraph

Utah's AI Policy Act (SB 149) took effect on May 1, 2024 and was narrowed by amendments effective May 7, 2025. It says that a supplier using generative AI with a person in a consumer transaction must say so when the person clearly asks. People in licensed occupations have a stricter rule: when AI in their services is a "high-risk" interaction, which includes collecting health, financial or biometric data and giving personal financial, legal, medical or mental health advice, the disclosure must be prominent and come at the start. Our Utah AI Policy Act page tracks the text, the dates and the sources.

The disclosure rules now sit in Utah Code chapter 13-77, which has no repeal date. The July 1, 2027 repeal date you may have seen applies to chapter 13-72, which sets up the state's AI office and learning lab.

When a dental office is in the strict tier

It takes two things together:

• Dentistry is a regulated occupation. The stricter rule applies to occupations licensed or certified through the Utah Department of Commerce.
• The chat is high-risk. That means it collects health data or gives personal medical advice a patient could rely on. A chatbot that answers "does this hurt" or asks about symptoms is there. One that only tells patients your hours may not be.

In practice most dental chatbots get close to that line, so plan for the strict rule: the notice is there, prominently, at the start. There is also a safe harbor. A clear notice at the outset and throughout the chat protects you from enforcement under these rules.

What the notice has to say

The law asks for a clear and conspicuous statement that the person is interacting with generative AI and not a human. It does not prescribe wording. Two lines that meet it, from our disclosure examples:

You're chatting with an AI assistant, not a person. Ask for a member of our team at any time.

Hi! I'm [Practice]'s AI assistant. I'm not a person, but I can answer questions and connect you with our front desk.

Prominent means the patient can't miss it. Beside the chat window when it opens is the usual place. A line buried in a privacy policy is not prominent.

When it has to appear

For a dental office under the strict rule, out loud at the start of a spoken interaction and in writing before a written one. In practice that means:

• Website chat: the notice shows when the chat opens, before the patient types anything.
• AI on the phone: the assistant says it in its greeting.
• Text and email replies written by AI: say so in the message.
• When a patient asks "am I talking to a real person?" the bot must answer truthfully, every time. This is where practices get caught. Some chatbots are set up to sound human and will deflect the question. Put a line in the bot's instructions that tells it to say it is AI.

If a person on your team takes over the chat, tell the patient that too, and again if the AI comes back.

What happens if you don't

The Utah Division of Consumer Protection enforces the Act. Administrative fines run up to $2,500 per violation, plus court-ordered remedies, and up to $5,000 per violation for breaking an administrative or court order. There is no private right of action, so patients can't sue under this law directly, but a complaint to the Division is easy to file and a practice's marketing, website and chat logs are all evidence.

"Per violation" is the phrase to notice. A chatbot with no notice may not stop at one violation. It could be counted once per conversation.

Keeping proof

Here is the part most practices miss. A complaint arrives in March about a conversation in September. The question is not "do you have a notice today," it's "was the notice shown to that patient on that day." A screenshot taken after the fact proves little, and the website has probably changed since.

That is what a disclosure record is for: an entry each time the notice is displayed, with the time, the page and an anonymous visitor fingerprint, kept in a form that shows if anyone has changed it. Our page on how the disclosure record works explains what is stored, why it holds no patient data, and how a complaint is matched to it.

A checklist for this week

1. List every place AI talks to patients: website chat, phone, texts, email replies, appointment tools.
2. Put a clear notice at the start of each one, using the wording above or your own.
3. Tell your chatbot to say it is AI whenever a patient asks.
4. Decide how you'll prove the notice was there: a record, not a memory.
5. Check whether other states' laws reach you too. Our AI disclosure laws by state index is the quickest way, and the free website scan shows what your site looks like to a visitor today.

Frequently asked questions

Our chatbot is only for booking appointments. Does the law still apply?

It can. A bot that only picks a time is a weak fit for high-risk. A bot that asks why the patient is coming in collects health data, and that puts a licensed practice in the strict tier. The patient can also ask whether it is AI, and it must answer truthfully either way.

The chat tool is provided by a vendor. Isn't the disclosure their job?

The duty sits with the supplier using the AI with its customers and with the licensed person providing the service. Your vendor may give you the tools to show a notice, but the obligation is yours.

Do we need a notice if the patient can obviously tell it's a bot?

Yes, when the strict rule applies. The law asks for a prominent disclosure, not for the patient to work it out. Obvious to you is not obvious to an anxious patient at 11 pm.

What about patients from other states?

Utah's law protects Utah consumers. If your website serves patients across state lines, Maine, California and others have their own rules. The state index lists them.

Not legal advice. This post summarises the law as of its date; effective dates and penalties change. Utah Code chapter 13-77 is the authority.