REAL STATE LAW AND A REAL EXECUTIVE ORDER · UTAH CODE TITLE 13 AND EXECUTIVE ORDER 2026-08 · NOT AN AFFILIATION, COMPLIANCE, OR LEGAL-ADVICE CLAIM

Utah’s AI Policy Act, Executive Order 2026-08, and SEDI

On October 6, 2026, Governor Spencer J. Cox signed Executive Order 2026-08, Establishing Utah’s Pro-Human Approach to Artificial Intelligence in State Government. It names Utah’s State-Endorsed Digital Identity (SEDI) Framework as the state’s trust infrastructure for AI. This page reads the order next to the Utah Artificial Intelligence Policy Act, including its safe harbor, and maps both onto c=US’s agent identity and authorization controls. For each requirement it says whether c=US demonstrates it, only proposes it, or does not address it.

What the executive order says

The order directs the Department of Government Operations (DGO), which also runs SEDI, to:

Four other provisions bear directly on agent identity and accountability:

• Rogue agents. DGO must establish safeguards protecting state systems and data from “cyberattacks, malicious actors, and unauthorized or rogue AI agents,” and help agencies put equivalent protections in place (§ 4(a)).
• Human in the loop. Agencies deploying AI must ensure “human-in-the-loop review for determinations affecting individual rights” (§ 4(b)(i)).
• Transparency. Each agency must document “how AI systems, including their inputs, outputs, and roles in decision-making, are integrated into Agency processes that impact the public” (§ 5(d)).
• Existing law still governs. The order does not limit or alter obligations under GRAMA, the Government Data Privacy Act, or federal privacy and civil-rights law (§ 7(b)).

Its preamble describes SEDI as a framework that prevents “identity fraud, impersonation, unauthorized AI agent activity, and fraudulent digital content,” and it calls for privacy-preserving ways to verify “individuals, organizations, AI agents, and digital information.” DGO’s first progress report is due July 1, 2027.

What the order does not say

• It does not say state AI agents will rely on SEDI person information. It tells DGO to use SEDI “where applicable” as trust infrastructure. Which state agents would consume a person’s SEDI presentation, and for what purposes, is left to DGO and to future agency standards.
• It does not make an AI agent a SEDI holder. The SEDI statute defines “individual” as “a human being” (Utah Code § 63A-20-201(14)). The order’s talk of verifying AI agents has to work through the humans and organizations accountable for them, or through some mechanism not yet defined. That is the same constraint the SEDI walkthrough builds on.
• It does not mention the AI Policy Act. The order governs executive-branch agencies. The Act governs suppliers and licensed professionals. They are separate instruments.
• It does not cover every state body. The definition of “agency” excludes higher education, the State Board of Education, the Attorney General’s, State Auditor’s and State Treasurer’s offices, independent entities, and the legislative and judicial branches (§ 2(a)(ii)).

The AI Policy Act as it stands

The Utah Artificial Intelligence Policy Act (S.B. 149) took effect May 1, 2024. Several 2025 bills reshaped it. S.B. 226 replaced the original disclosure rule with a new chapter, now codified as Utah Code Title 13, Chapter 77, Generative Artificial Intelligence — Consumer Disclosures and Enforcement. S.B. 332 extended the repeal date of Title 13, Chapter 72, the Artificial Intelligence Policy Act itself (the Office of Artificial Intelligence Policy and its programs), to July 1, 2027. The Chapter 77 disclosure rules and safe harbor carry no such date. H.B. 452 added separate rules for mental-health chatbots.

• Disclosure on request. A supplier using generative AI in a consumer transaction must disclose that the person is dealing with AI, not a human, if the person makes “a clear and unambiguous request” to find out (§ 13-77-103(1)).
• Prominent disclosure in high-risk interactions. A licensed or state-certified professional must disclose generative AI use up front when the interaction is high-risk: it collects health, financial, or biometric data, or gives personalized financial, legal, medical, or mental-health advice that could be relied on for significant personal decisions (§§ 13-77-101(5), 13-77-103(2)–(3)). The disclosure is spoken at the start of a voice interaction and written before a written one.
• No “the AI did it” defense. It is not a defense to a consumer-protection violation that generative AI made the statement, took the act, or was used to commit it (§ 13-77-102).
• The Office of Artificial Intelligence Policy (Chapter 72), in the Department of Commerce, runs a learning laboratory and can enter regulatory mitigation agreements. These are time-limited arrangements that can provide a cure period and reduced penalties while a participant tests an AI technology.

The safe harbor

The safe harbor covers only the disclosure duties in § 13-77-103. It is not a defense to any other consumer-protection violation, and § 13-77-102 says the AI’s involvement never is. The Division of Consumer Protection may adopt rules specifying which forms of disclosure do and do not qualify (§ 13-77-104(2)).

How the requirements map to c=US

How a state agent could rely on SEDI person information

This is a design interpretation, not something the order prescribes. It assumes a future state service in which an AI agent acts for an agency and needs to know who it is serving.

1. The resident presents, the agent does not hold. The resident shares a SEDI presentation from their own wallet, under notice that explains why the information is requested. The agent never becomes a SEDI holder, and it holds no copy of the person’s identifier beyond what the stated purpose needs.
2. The agency verifies as a relying party. The agency checks issuer trust, the presentation binding, and non-revocation. Utah GovOps feedback recorded on the SEDI walkthrough says one organization commonly does both verification and reliance, and that a legal name is not automatically needed.
3. The agent proves what it is, separately. The agent authenticates with its own certificate, and the gateway checks its grant. This is the machine-readable side of “is not human”, and it is how § 4(a) of the order’s “unauthorized AI agent activity” gets refused.
4. A person makes determinations that affect rights. The agent’s scope stops at proposing. Any determination affecting individual rights goes to a human reviewer, as § 4(b)(i) requires, and the proposal, the evidence, and the reviewer’s decision are logged.
5. Purpose limits follow the data. SEDI’s duty of loyalty and primary-purpose rules (§§ 63A-20-701–702), GRAMA, and the Government Data Privacy Act still govern what the agency may keep or reuse. A verified presentation is not blanket consent.

Where this is honestly incomplete