UT HB0286

Large frontier AI developers (companies with $500M+ annual revenue training models using 10^26+ computing operations) must publish public safety plans detailing how they assess and mitigate catastrophic risks, including threats from CBRN weapons, cyberattacks, and loss of model control

Developers operating chatbots with 1M+ monthly users that minors can access must create and publish child protection plans addressing risks of AI causing death, bodily injury, or severe emotional distress to minors

Safety incidents must be reported to Utah's Office of Artificial Intelligence Policy within 15 days (or 24 hours if posing imminent risk of death), with quarterly reports on internal catastrophic risk assessments

Civil penalties up to $1M for first violations and $3M for subsequent violations, enforced by the attorney general, with penalties funding the AI Transparency Enforcement Restricted Account

Whistleblower protections prohibit retaliation against employees who report safety concerns, with remedies including reinstatement, double back pay, and attorney fees for prevailing employees