Technology

HB 42 establishes minimum cybersecurity standards for Utah's public schools (local education agencies) and expands the Utah Cyber Center's role to provide dedicated security services to schools. It requires schools to implement specific measures like multi-factor authentication, patch management, and endpoint detection systems, while mandating incident reporting to the Cyber Center. The law also directs the State Board of Education to develop implementation guidelines and creates new reporting requirements for cybersecurity breaches in educational settings. These changes directly affect all Utah public schools and their cybersecurity practices, aiming to strengthen protection for student and school data. The bill contains no new funding and amends several existing Utah Code sections related to education and cybersecurity.

SB 38 reorganizes Utah's consumer protection laws by renaming and renumbering existing chapters, such as moving the Health Spa Services Act to "Fitness Center Services," and adds a new Chapter 77 specifically requiring generative AI service providers to disclose certain information to consumers. It updates registration and reporting rules for businesses, clarifies the Division of Consumer Protection's enforcement authority, and specifies when the division may deny or revoke business registrations. The bill directly affects businesses operating in regulated sectors like credit services, charitable solicitations, fitness centers, and now AI service providers. Key changes include mandatory AI disclosures, updated surety bond requirements, and streamlined processes for maintaining registration with the division.