Key point: Businesses operating generative artificial intelligence systems in Utah and Washington may be subject to new legal obligations, such as including provenance data in content created or altered using generative artificial intelligence.
In March, Utah’s Digital Content Provenance Standards Act (HB 276) was signed by Governor Spencer Cox, and Washington’s HB 1170 on regulation of AI-modified content was signed by Governor Bob Ferguson. Both laws impose certain obligations related to provenance data on covered providers that create, code, or otherwise produce a generative artificial intelligence (GenAI) system that has more than 1 million monthly users and is publicly accessible within the geographic boundaries of each state. Utah and Washington’s bills largely align with the California AI Transparency Act (CAITA) and AB 853, which obligate creators of GenAI systems, large online platforms, GenAI hosting platforms, and capture device manufacturers to fulfill certain provenance data requirements. The article below provides an overview of the California, Utah, and Washington laws and compares the obligations of covered providers under each law.
Background
California lawmakers passed CAITA during the 2024 legislative session through SB 942 with strong bipartisan support. Under CAITA, covered providers are required to provide a free and public AI detection tool, offer the user an option of including a manifest disclosure in certain GenAI-created content, include a latent disclosure in certain GenAI-created content, and add contractual obligations to licensees of their GenAI system to ensure transparency. In October 2025, AB 853 amended CAITA to extend compliance requirements to large online platforms, GenAI hosting platforms, and capture device manufacturers, to facilitate practical and impactful enforcement. CAITA’s operative date is August 2, 2026, with delayed effective dates based on the categories of covered providers.
The Utah and Washington legislatures also recognized the importance of allowing users to discern whether the content they were seeing was created or altered by GenAI to prevent misinformation and provide clarity for developers of GenAI. Utah and Washington’s laws closely mirror the transparency measures adopted by CAITA. The laws are largely based on a bipartisan federal proposal, the AI Labeling Act of 2023, and apply to the largest GenAI providers, so as to not stifle technological development in new technologies.
Comparison Summary of California, Utah, and Washington GenAI Provenance Statutes
The chart below compares the definitions, legal obligations, and enforcement mechanisms outlined in the California, Utah, and Washington laws.
| Topic | Utah * Effective 1.1.27. | Washington * Effective 2.1.27. | California * Effective 8.2.26. |
| Definition of Artificial Intelligence | A machine-based system that makes predictions, recommendations, or decisions influencing real or virtual environments. | The use of machine learning and related technologies that use data to train statistical models for the purpose of enabling computer systems to perform tasks normally associated with human intelligence or perception, such as computer vision, speech or natural language processing, and content generation. | An engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. |
| Definition of Covered Providers | A person that creates, codes, or otherwise produces a GenAI system that: (i) has more than 1 million monthly visitors or users, and (ii) is publicly accessible within the state. Excludes GenAI systems that are used exclusively for the person’s internal business operations and are not made publicly accessible. Large online platforms: public‑facing social media/mass messaging/search engine with >2 million monthly users during the previous 12 months.Capture device manufacturers: producers of capture devices for sale in Utah (excluding pure assemblers). | A person that creates, codes, or otherwise produces a GenAI system that (i) has more than 1 million monthly users, and (ii) is publicly accessible within the state to consumers for personal use. Excludes state, local, and tribal governments. Does not specify obligations based on category. Chapter does not apply to any product, service, website, or application that provides (i) exclusively video games or (ii) interactive experiences such as the sale of goods or services directly to consumers through the internet. | A person that creates, codes, or otherwise produces a GenAI system that (i) has more than 1 million monthly visitors or users, and (ii) is publicly accessible within the state. Large online platforms: public‑facing social media/file‑sharing/mass messaging/search with >2 million monthly users (excluding broadband/telecom). GenAI system hosting platforms[1]: sites/apps making downloadable source code or model weights of a GenAI system to California residents. Capture device manufacturers: producers of capture devices for sale in California (excluding pure assemblers). |
| Key Obligations – Covered Providers | – Must embed latent disclosures in AI‑created or substantially modified image, video, audio, or combined content – Disclosure must: (i) include to the extent technically feasible, time and date of creation/alteration, or device manufacturer name/digital signatures), and (ii) be consistent with widely accepted industry standards. | – Must, to the extent commercially/technically reasonable: – Include provenance data in any image, audio, video, or combined content created or materially altered by their GenAI system. – Make provenance data difficult to remove or tamper with using a widely supported technical standard. – May not be required to include any information about an identified or reasonably identifiable individual. | – Must provide a free AI detection tool that indicates whether content was created/altered by the provider’s GenAI system and outputs any system provenance data. – Include latent disclosures in image, video, audio, or combined content created/altered by their systems, conveying specified information and designed to be permanent or extremely hard to remove, to the extent technically feasible. – Disclosure must: include to the extent technically feasible, include the name of the covered provider, name and version number of the GenAI system used, time and date of creation/alteration, and a unique identifier. |
| Key Obligations – Large Online Platforms | – Must detect whether compliant system provenance data is present in content. – Must present a user interface (UI) to disclose availability of provenance and let users inspect it (via UI, downloadable data, or linked site/app). – May not knowingly strip compliant provenance data/signatures. | – No specific obligations on “large online platforms” as a separate category; focus is on covered providers (AI providers) and government agencies. – Platforms may still be covered if they meet the “covered provider” definition. | – Must detect whether any compliant provenance data is embedded/attached to distributed content. – Must provide a UI that shows (i) availability of system provenance data that reliably indicates AI generation/substantial alteration or capture by a capture device, (ii) name of the GenAI system or capture device, and (iii) whether digital signatures are available. – Must let users inspect all system provenance data (UI, download, or link). – Must not knowingly strip compliant system provenance data/signatures, to extent technically feasible. |
| Key Obligations – Capture Device Manufacturer | – For devices first produced for sale in Utah on or after January 1, 2028: – Must include a latent disclosure in captured content that conveys (i) manufacturer name or digital signatures showing device type and (ii) time and date of creation/alteration. – Duty limited to the extent technically feasible and compliant with widely adopted standards. | – No direct “capture device” requirements as a separate category. | – For devices first produced for sale in California on or after January 1, 2028: – Must give users an option to include a latent disclosure in captured content (manufacturer name, device name, version number, time and date of creation/alteration). – Must embed latent disclosures by default. – Duty limited to technical feasibility and use of widely adopted standards. |
| Enforcement Mechanisms & Penalties | – Enforced by Division of Consumer Protection. – Administrative fines up to $2,500 per violation; court‑ordered disgorgement, payments to consumers, further civil penalties, injunctive relief, attorneys’ fees/costs. – Additional civil penalty up to $5,000 per violation of administrative/court orders. | – Enforced solely by the attorney general (AG) in the name of the state or as parens patriae. – Violations are per se unfair or deceptive acts/practices. – Only the AG may bring actions; no private right of action. – Waivers of the chapter’s provisions are void. | – Public enforcement only: Civil actions by the AG, city attorneys, or county counsels. – Civil penalty of $5,000 per violation for any person who violates the chapter. – Each day of noncompliance is a separate violation. – Prevailing plaintiff entitled to civil penalties and attorneys’ fees/costs. |
| Exemptions / Limitations | – Provenance duties bound by technical feasibility and widely adopted standards. | – Chapter does not apply to: Business‑to‑business uses, sales, licensing, or distribution of GenAI systems. Products/services providing exclusively video game or interactive experiences (e.g., virtual shopping sites). Systems used solely for upscaling, noise reduction, or compression. – No requirement to disclose trade secrets or confidential/proprietary design/use information. | – Certain large online platform and capture device manufacturer’s compliance limited by technical feasibility and widely adopted standards. |
[1] GenAI hosting platforms are not further mentioned in the chart because there are no statutory counterparts in Utah’s Digital Content Provenance Standards Act and Washington’s HB 1170.