Utah Digital Content Provenance Standards Act: What to Know

AI-generated images, videos, and audio can move across platforms in seconds. But once someone downloads, edits, or shares that content, how can another person determine where it came from?

Utah’s Digital Content Provenance Standards Act tackles that challenge by establishing requirements for certain online platforms, generative AI providers, and capture device manufacturers.

Enacted through House Bill 276 in 2026, the law focuses on preserving and communicating information about digital content’s origin, authenticity, and modification history.

The law takes effect January 1, 2027, although certain requirements for capture devices apply to devices produced for sale in Utah beginning January 1, 2028.

For organizations that develop generative AI systems or distribute digital media, the central challenge is practical: Can users access reliable provenance information as content moves through different tools, devices, and platforms?

Meeting the law’s requirements calls for technical provenance controls, clear system ownership, and an understanding of how AI-generated content flows across an organization’s technology environment.

This guide explains what Utah requires, who must comply, where technical feasibility matters, and how AI governance and enterprise data intelligence support a broader responsible AI strategy.

What Is the Utah Digital Content Provenance Standards Act?

The Utah Digital Content Provenance Standards Act is a state law establishing standards for how certain digital media services and devices handle information about the origin and authenticity of content.

Utah enacted the Act as Title 13, Chapter 72c of the Utah Code through H.B. 276 in 2026.

It focuses on provenance data, which the law defines as information embedded in digital content or included in its metadata to help verify the content’s authenticity, origin, or modification history.

The law does not require every company that uses AI to label every document, chatbot response, or internal workflow.

Instead, it establishes distinct obligations for defined categories of organizations and technologies.

Those obligations include:

• Detecting qualifying provenance information in content distributed through large online platforms.
• Giving platform users accessible ways to inspect available compliant system provenance data.
• Preserving qualifying provenance information and digital signatures where technically feasible.
• Including latent disclosures in certain AI-generated or substantially modified media.
• Including provenance-related disclosures in qualifying content captured by certain devices.

The Act forms part of a broader H.B. 276 legislative package that also addresses nonconsensual counterfeit intimate images through a separate chapter. This article focuses on the Digital Content Provenance Standards Act in Chapter 72c.

When Does Utah’s Digital Content Provenance Law Take Effect?

The Act takes effect January 1, 2027.

However, the capture device provision applies to devices that manufacturers produce for sale in Utah on or after January 1, 2028.

Who Must Comply With Utah’s Digital Content Provenance Standards Act?

Utah defines three primary categories of regulated entities. The applicable obligations depend on which category an organization meets.

Large Online Platforms

The statutory definition covers certain public-facing social media platforms, mass messaging platforms, and standalone search engines that distribute content to users who did not create or collaborate in creating that content.

These platforms must also exceed the statutory threshold of 2 million unique monthly users during the preceding 12 months.

The definition excludes broadband internet access services and telecommunications services as specified in the Act.

Covered Generative AI Providers

A covered provider creates, codes, or otherwise produces a generative AI system that:

• Has more than 1 million monthly visitors or users.
• Is publicly accessible within Utah.

The law excludes providers whose systems operate exclusively for internal business operations and do not offer public access.

Organizations should assess actual product functionality, usage, and availability rather than assuming every enterprise AI deployment falls within scope.

Capture Device Manufacturers

The law also addresses manufacturers that produce capture devices for sale in Utah, including devices that record photographs, video, or audio.

The manufacturer provision applies to devices produced for sale in Utah on or after January 1, 2028, and includes specific technical feasibility and standards-based conditions.

What Is Digital Content Provenance?

Digital content provenance provides information about a digital asset’s origin, authenticity, or modification history.

For example, provenance information may indicate that a system generated or altered an image, identify a relevant device or service, or provide a digital signature that supports verification.

Utah distinguishes between general provenance data and system provenance data.

Under the statute, system provenance data must not be reasonably capable of association with a particular user. It contains information about the device, system, or service involved in content generation or information relevant to authenticity.

This distinction matters because provenance can support authenticity without necessarily identifying the individual who created or shared the content.

What Is the Difference Between Latent and Visible Disclosure?

Utah uses the term latent to describe information that is present but not directly perceptible to a person.

That differs from a visible label or warning that users can immediately see.

A latent disclosure may use compatible metadata or other standards-based technical mechanisms, depending on the system and the statutory requirements.

The law does not universally require a visible “Made with AI” label on every generated asset.

What Must Large Online Platforms Do?

Utah Code Section 13-72c-201 establishes three core requirements for qualifying large online platforms.

1. Detect Compliant Provenance Data

Platforms must detect whether compliant system provenance data appears within or accompanies content distributed through the platform.

This requires the platform to recognize provenance information that follows widely adopted specifications from an established standards-setting body.

2. Give Users Access to Provenance Information

Platforms must disclose the availability of system provenance data through a user interface and allow users to inspect all available compliant system provenance data in an easily accessible manner.

The statute permits different methods, including:

• Displaying provenance data through the platform’s interface.
• Allowing users to download the compliant system provenance data.
• Providing a link to provenance information hosted on a website or another application.

3. Avoid Knowingly Stripping Qualifying Provenance Data

To the extent technically feasible, a large online platform may not knowingly strip compliant system provenance data or digital signatures from content uploaded or distributed through the platform.

This requirement makes content-processing workflows particularly important.

Resizing, transcoding, compression, file conversion, and content moderation pipelines can affect metadata. Organizations should test whether their systems preserve relevant provenance information across supported workflows.

What Must Covered Generative AI Providers Disclose?

Under Utah Code Section 13-72c-203, covered providers must include a latent disclosure in qualifying image, video, or audio content that their generative AI systems create or substantially modify.

The requirement also covers combinations of those media types.

To the extent technically feasible and reasonable, the disclosure must communicate specified information directly or through a link to a permanent website, including:

• The time and date of the content’s creation or alteration.
• Either the capture device manufacturer’s name or digital signatures sufficient to establish whether a generative AI system created or substantially altered the content.

The disclosure must also align with widely accepted industry standards.

Although the statutory definition of generative AI includes systems that produce text, the specific provider disclosure requirement in Section 13-72c-203 addresses image, video, and audio content.

Organizations should not interpret that section as a blanket provenance requirement for every AI-generated text response.

What Does the Law Require From Capture Device Manufacturers?

Utah Code Section 13-72c-202 addresses provenance disclosures for qualifying capture devices.

The required latent disclosure must communicate:

• The capture device manufacturer’s name or qualifying digital signature information.
• The time and date of the content’s creation or alteration.

The statute allows manufacturers to offer users an option to disable the latent disclosure.

Manufacturers must comply only to the extent technically feasible and consistent with widely adopted specifications from an established standards-setting body.

These requirements apply to devices that manufacturers produce for sale in Utah on or after January 1, 2028.

Does Utah Require C2PA Content Credentials?

Utah’s statute refers to widely adopted specifications from established standards-setting bodies rather than universally mandating one named technical standard.

C2PA, the Coalition for Content Provenance and Authenticity, develops an open technical specification for content provenance and authenticity.

C2PA-based Content Credentials can help systems attach and verify provenance information through supported technical workflows.

However, organizations should evaluate whether a particular implementation satisfies Utah’s statutory requirements instead of assuming that use of a C2PA-compatible tool automatically establishes compliance.

Provenance also has limits. A valid signature can help verify information about content origin or handling, but it does not independently establish that every claim within the content is accurate.

Why Utah’s Law Creates an AI Governance Challenge

Provenance standards focus on the media that systems create and distribute.

Enterprise AI governance addresses the systems, data, access paths, and policies behind those experiences.

Organizations operating generative AI services may need to understand:

• Which AI systems generate or modify images, audio, or video.
• Which applications expose those systems to the public.
• Which service providers handle generated content.
• Where metadata or provenance information may disappear during processing.
• Whether AI systems access sensitive or restricted enterprise data.
• Who owns the technical controls, testing, and remediation processes.

The provenance law does not impose a universal enterprise AI inventory requirement.

However, maintaining an accurate inventory can help organizations determine which systems fall within scope and where they need technical controls.

Similarly, the law’s provenance requirements do not replace separate obligations concerning sensitive data discovery and classification, privacy, or access governance.

Five Operational Gaps Organizations Should Address

How Will Utah Enforce the Digital Content Provenance Standards Act?

The Utah Division of Consumer Protection administers and enforces the Act’s provenance requirements.

Under Utah Code Section 13-72c-301, the division director may impose an administrative fine of up to $2,500 per violation.

The division may also bring a court action. Available court remedies include injunctions, disgorgement, and fines of up to $2,500 per violation, subject to the statute.

A court may impose an additional civil penalty of up to $5,000 for each violation of an administrative or court order issued under the chapter.

These are distinct penalty provisions. The $5,000 figure concerns violations of enforcement orders, not an automatic fine for every initial provenance violation.

Eight Steps to Prepare for Utah’s Digital Content Provenance Requirements

Organizations should start with statutory scope and then connect legal requirements to technical implementation and governance evidence.

How BigID Helps Organizations Prepare for Utah’s Digital Content Provenance Requirements

Utah’s Digital Content Provenance Standards Act puts new attention on the origin and authenticity of digital media. But organizations preparing for the law also need to understand the AI systems, data sources, and access permissions behind their content workflows.

That’s where BigID’s AI governance capabilities can play an important supporting role.

Specialized provenance technologies address the law’s technical requirements for content disclosures, compatible metadata, and preservation of provenance information. BigID addresses a complementary challenge: helping organizations identify sensitive data, understand AI-related exposure, and govern the enterprise information that AI systems access and use.

For security, privacy, and AI governance teams, this distinction matters. Knowing where digital content came from does not necessarily tell you whether the AI system that created it had appropriate access to sensitive data.

1. Identify the AI Systems and Data That Need Governance

Before an organization can assess its obligations under Utah’s law, it needs to understand which systems generate, modify, or distribute digital media and whether those systems fall within the statute’s definitions.

Legal and product teams must determine which applications qualify as covered generative AI systems or large online platforms. But those assessments become more difficult when organizations lack visibility into their AI environments.

BigID helps organizations build a clearer picture of relevant AI assets and the enterprise data associated with them.

With AI governance and data discovery and classification capabilities, teams can investigate questions such as:

• Which AI-related systems and assets operate across supported enterprise environments?
• What sensitive information do those systems access or use?
• Which enterprise data sources contribute to AI workflows?
• Where might unapproved AI use create additional data exposure?
• Which teams need to assess the resulting governance risks?

Why this matters for Utah readiness: Better visibility helps organizations prioritize AI system assessments and identify the data governance issues surrounding relevant content-generation workflows.

BigID does not independently determine whether an organization meets Utah’s statutory user thresholds or whether a particular product qualifies as a covered provider.

2. Address the Sensitive Data Risks That Provenance Metadata Cannot Solve

A provenance credential may help verify information about where a digital asset came from or how a system modified it.

But it cannot, by itself, determine whether an AI system had permission to access the information that influenced its output.

Consider an AI-powered media application that retrieves sensitive customer records or internal business information while generating content.

The application might attach technically valid provenance information to the resulting media while still creating a separate data security or privacy concern.

BigID helps organizations investigate those underlying risks by:

• Discovering and classifying sensitive data across supported enterprise sources.
• Providing AI risk context associated with sensitive information and its use.
• Supporting AI access governance to help teams assess access to sensitive enterprise data.
• Supporting privacy workflows that address relevant personal data obligations.
• Supporting data retention governance so organizations can review unnecessary or over-retained information.

Why this matters for Utah readiness: Content provenance controls and sensitive data governance address separate concerns. Organizations that assess both can make more informed decisions about the AI systems and information involved in digital content production.

Utah’s Digital Content Provenance Standards Act does not itself impose every data governance control listed above. Other laws, internal policies, and business risks may create the need for those controls.

3. Connect AI Risk Visibility With Governance Accountability

AI governance requires more than identifying a system once and recording its owner.

As organizations introduce new models, applications, integrations, and AI agents, the data those systems can access may change.

BigID supports ongoing data and AI governance by helping teams connect relevant AI risks with information about sensitive data, exposure, and access.

That context can help security, privacy, data, and AI governance teams:

• Prioritize reviews of AI systems that interact with sensitive enterprise information.
• Identify data access and exposure concerns that require investigation.
• Support risk assessment and remediation workflows.
• Coordinate governance decisions across responsible teams.
• Review data risks as AI environments change.

Why this matters for Utah readiness: Organizations can use this governance context alongside provenance-specific testing and documentation to support clearer operational accountability.

Engineering teams must still implement and validate the technical provenance controls that the law requires.

4. Build a More Complete AI Governance Program

Utah’s provenance requirements address an important question: Can people access reliable information about the origin and handling of digital content?

BigID helps organizations address a different, equally important question: Do we understand the sensitive enterprise data our AI systems can access and the risks associated with that access?

Organizations need both perspectives when they build responsible AI programs.

By connecting AI governance, sensitive data discovery, AI access governance, and privacy operations, BigID helps teams strengthen oversight of the data and AI systems behind their business processes.

Specialized provenance solutions remain necessary to address the law’s content-level requirements, including qualifying latent disclosures, provenance data preservation, and user-facing inspection mechanisms.

Why Utah’s Provenance Law Matters Beyond Utah

Utah’s law reflects a broader shift toward technical accountability for AI-generated and digitally modified content.

Organizations increasingly need to understand both sides of the AI equation:

• Content authenticity: Can a user inspect reliable information about where digital media came from or how a system modified it?
• Data and AI governance: Can the organization identify the systems, information, permissions, and risks behind the AI experience?

These disciplines complement each other, but they solve different problems.

A content credential does not establish that an AI system had permission to access sensitive enterprise data. Similarly, a data governance platform does not automatically create provenance metadata for every generated image or video.

Organizations that connect both disciplines can establish clearer accountability across AI development, content production, and distribution.

Utah Digital Content Provenance Standards Act: Frequently Asked Questions

What is the Utah Digital Content Provenance Standards Act?

It is a 2026 Utah law, enacted through H.B. 276 as Chapter 352, that establishes digital content provenance requirements for qualifying large online platforms, generative AI providers, and capture device manufacturers.

When does Utah’s Digital Content Provenance Standards Act take effect?

The Act takes effect January 1, 2027. Its capture device provision applies to qualifying devices produced for sale in Utah on or after January 1, 2028.

Which online platforms does the law cover?

The law covers defined public-facing social media, mass messaging, and standalone search platforms that exceeded 2 million unique monthly users during the preceding 12 months, subject to statutory conditions and exclusions.

Which generative AI providers must comply?

A covered provider creates or produces a generative AI system with more than 1 million monthly visitors or users that is publicly accessible in Utah. The definition excludes systems used exclusively for internal business operations without public access.

Does the law require every AI-generated text response to carry a disclosure?

No. The covered provider disclosure provision specifically addresses qualifying image, video, and audio content, including combinations of those media types.

Does Utah mandate C2PA?

The statute refers to widely adopted or accepted industry specifications rather than naming C2PA as the sole required standard. Organizations should evaluate the technical and legal suitability of their chosen implementation.

What must large online platforms do with provenance data?

Covered large online platforms must detect compliant system provenance data, provide users with accessible ways to inspect available compliant data, and avoid knowingly stripping qualifying provenance data or signatures to the extent technically feasible.

What penalties can Utah impose?

The Utah Division of Consumer Protection may impose administrative fines of up to $2,500 per violation. Courts may also impose remedies under the statute, including penalties of up to $5,000 for each violation of an administrative or court order issued under the chapter.

How does BigID help with Utah provenance readiness?

BigID helps organizations prepare for the broader data and AI governance challenges surrounding Utah’s Digital Content Provenance Standards Act. Its capabilities support visibility into AI-related assets, sensitive data discovery and classification, AI risk context, access governance, and privacy workflows. These capabilities help teams understand the enterprise data and AI systems behind content generation and distribution. Organizations still need specialized provenance technology to implement the law’s technical disclosure, metadata preservation, and content inspection requirements.

Sources and Further Reading

• Utah Legislature: Digital Content Provenance Standards Act, Utah Code Title 13, Chapter 72c
• Utah Legislature: H.B. 276, Enrolled Legislation
• Coalition for Content Provenance and Authenticity
• BigID AI Governance
• BigID Data Discovery and Classification

This article provides general educational information and does not constitute legal advice. Organizations should consult qualified legal counsel and technical experts when assessing Utah’s digital content provenance requirements.