Utah Lets Companies Break Its Own AI Rules to Figure Out What the Rules Should Be

Utah's Office of Artificial Intelligence Policy told state lawmakers this week that it will send its first set of AI regulation recommendations to the Legislature in October and November. The recommendations will come out of a program that lets a small number of companies run AI products beyond what current state law technically permits, so regulators can watch what happens before deciding what to restrict.

Zach Boyd, the office's director since April 2024, described the arrangement at a Sept. 16 meeting of the Legislature's Business and Labor Interim Committee. The meeting was first reported on by the Salt Lake Tribune.

What the sandbox actually does

The office was created by the state's Artificial Intelligence Policy Act in 2024, at the urging of Senate Majority Leader Kirk Cullimore, R-Sandy, who has said he sees health care as an area "ripe for disruption." The act gave the office two tools: a regulatory sandbox, where companies sign agreements to test AI products under state supervision, and a learning lab, where the office studies applications with companies, industry groups and academics before anyone builds a product.

Boyd told the committee the sandbox agreements let companies "go forward and potentially beyond what current regulations specify," giving the state real usage data before lawmakers write a rule rather than after. The act was originally set to expire in July 2027, but lawmakers are moving it instead to a process of periodic legislative review, meaning it will keep operating past that date unless a future Legislature votes to end it.

• House Bill 452 (2025): requires AI mental health chatbots to disclose they are not human, restricts use of a user's health data for advertising, and lets the Division of Consumer Protection fine violators up to $2,500 in administrative penalties or $5,000 per violation in civil penalties.
• House Bill 276 (2026): created the Digital Voyeurism Prevention Act and Digital Content Provenance Standards Act, requiring platforms operating in Utah to let people report AI-generated intimate images made without consent.
• Current focus: autonomous AI agents, both generally and inside clinical settings, including systems that could gradually adjust a patient's medication dosage.

The one sandbox deal already touching patients

The office's most visible sandbox agreement is with Doctronic, a telehealth company that began renewing routine prescriptions for chronic conditions such as diabetes and high blood pressure under a one-year demonstration agreement announced in January, first reported by the Deseret News. Doctronic co-CEO Matt Pavelle said the arrangement lets "patients, pharmacists and physicians work together more efficiently, with measurable results." Cullimore, who also sponsored the legislation, described the guardrail on the deal as "doctor, not device": automation is meant to support a clinician's judgment, not replace it.

Why the office wants more, not fewer, of these deals

Boyd told the committee his office has received "dozens of applications" from companies seeking to deploy clinical AI tools in Utah. "We're trying to figure out how to prudently clear some of those," he said, "so that we can still oversee them and learn from them."

Margaret Busse, executive director of the Utah Department of Commerce, which houses the AI office, told the committee the state has three stated goals for the program: fostering innovation, protecting the public, and learning proactively about a technology growing faster than the normal legislative calendar can track. "That's, in fact, exactly what is happening right now with the healthcare and AI piece," she said.

Boyd did not give the committee any specific policy recommendations at the Sept. 16 meeting. He said those would come in October and November, meaning the actual content of Utah's next AI bills remains undecided as of this reporting.