Utah Pro-Human AI Executive Order

Overview

Executive Order 2026-08 establishes Utah’s pro-human approach to artificial intelligence in state government. Governor Spencer J. Cox signed it on October 6, 2026, and Lieutenant Governor Deidre M. Henderson attested it. The order takes effect immediately and continues until modified, amended, rescinded, or superseded. It is an executive directive, not legislation enacted by the legislature. Its mandatory responsibilities apply to covered executive-branch agencies, the Department of Government Operations (DGO), and the Division of Technology Services (DTS). Its central objective is better government services while preserving human judgment, responsibility, privacy, and control.

Section 1 identifies five purposes: evaluate government AI tools against Utah’s Pro-Human AI Initiative principles; establish DGO leadership over AI-driven process improvements; invest in workforce training and upskilling; support citizen-facing tools with protections for state data; and establish agency responsibilities for transparency, training, and responsible process optimization. Section 3 requires agencies to avoid technologies that do not adhere strictly to the initiative’s foundational principles. The order combines innovation with institutional safeguards; it neither creates a generally applicable licensing regime for private AI developers nor requires every agency to deploy a particular product.

Definitions and Scope

Section 2 defines “Agency” as a department, division, office, bureau, or other organization within the state executive branch, including the State Tax Commission, National Guard, and Board of Pardons and Parole. It excludes institutions of higher education, the Utah Board of Higher Education, the State Board of Education, independent entities defined in Utah Code § 63E-1-102, the Attorney General’s Office, State Auditor’s Office, State Treasurer’s Office, Legislative Branch, and Judicial Branch. These exclusions govern the reach of agency duties; membership in Utah government alone does not establish coverage.

Section 3 describes two foundational principles. “Human-Guided” means AI should protect human dignity, preserve human agency, and keep individuals in control of tools shaping their work and lives. Systems should be understandable, accountable in impact, and adaptable to human needs. “Human-Enhancing” means AI should amplify human potential through a value-based ecosystem that is pioneering, empowering, and connective. The order supplies neither a technical definition of AI nor a formal risk-classification system. It describes the State-Endorsed Digital Identity (SEDI) Framework as privacy-preserving, individually controlled, and cryptographically verifiable digital identity and credentials, without prescribing a particular cryptographic implementation.

Governance and Institutional Responsibilities

Section 4 assigns DGO leadership over statewide AI-driven process improvements that increase efficiency, improve quality, and enhance decision-making for Utahns while adhering to pro-human principles. DGO must establish guardrails and technical safeguards protecting state information technology assets, systems, and data against cyberattacks, malicious actors, and unauthorized or rogue AI agents. It must provide agencies with guidance, resources, and technical support for equivalent protections. DGO must assist with responsible opportunities to reduce wait times, expand public-service access, and improve operational outcomes, and with tool evaluation. Its assistance must ensure human-in-the-loop review for determinations affecting individual rights.

Sections 5 and 6 distribute implementation duties across agencies and DTS. Agencies coordinate with DTS, ensure applicable employees complete prescribed training, evaluate improvements, document public-impacting AI integration, and collaborate across government. DTS coordinates workforce training with the Division of Human Resource Management (DHRM) and develops specialized instruction for designated agency leads accountable for evaluating and executing AI-assisted improvements. It also coordinates uniform implementation standards and evaluates cybersecurity solutions. Section 7 assigns recurring reporting to the Commissioner of DGO, who reports to the Governor. The order creates no new independent regulator, licensing authority, or adjudicatory body.

Human Control, Transparency, and Digital Trust

The substantive priorities are human control, workforce development, service improvement, transparency, and secure digital trust. Covered agencies must avoid AI technologies inconsistent with the foundational principles; the principles are not optional aspirations. Section 4(b)(i) requires human-in-the-loop review for determinations affecting individual rights when DGO assists with service improvements. Section 5(d) separately requires documentation of AI systems’ inputs, outputs, and roles in decision-making within processes impacting the public. This is an express documentation duty, not a universal public AI-labeling requirement or a requirement to publish every input and output. The order does not prescribe a detailed human-review procedure.

Cybersecurity and identity assurance are operational duties. Section 4(a) covers state assets, systems, and data, including threats from unauthorized or rogue AI agents. Section 4(c) requires DGO to develop and utilize SEDI, where applicable, as strategic trust infrastructure for AI. Its functions include cryptographically verifiable identities, credentials, and data that protect privacy and prevent identity fraud, impersonation, unauthorized agent activity, and fraudulent digital content. Section 6(e) requires DTS to evaluate next-generation AI solutions for detecting and protecting against cybersecurity threats at scale. These provisions mandate neither universal SEDI enrollment nor a particular vendor.

Implementation and Workforce Training

Section 5 requires each covered agency, in coordination with DTS and consistently with pro-human principles, to undertake five actions: ensure all applicable employees complete AI literacy training prescribed by DTS and DHRM; evaluate cost-effective opportunities to optimize and transform government business functions; actively investigate and propose improvements to citizen-facing processes and automated workflows; document AI integration in public-impacting processes; and share resources, best practices, and findings with other agencies. Evaluation and investigation are mandatory, but deployment is not automatic. The order does not direct agencies to replace human staff or abandon established decision-making safeguards.

Section 6 requires DTS and DHRM to establish and implement a comprehensive literacy strategy covering foundational AI concepts, practical and beneficial uses of approved state AI tools, and ethical and pro-human principles. DTS must develop specialized AI systems-analysis training for designated agency leads, evaluate scalable training platforms and content providers while prioritizing Utah-based entities, and coordinate development and publication of uniform implementation standards. DGO must support equivalent agency security protections and evaluate suitable tools. No completion date, minimum training hours, procurement budget, or obligation to select a Utah-based provider regardless of suitability is specified. The order does not identify the future standards’ title, version, publication date, or technical content.

Monitoring and Evaluation

Section 7(a) requires the Commissioner of DGO to provide a progress report to the Governor by July 1, 2027, and each July 1 thereafter. This is the express recurring reporting mechanism and provides executive-level oversight. The order prescribes no report template, required performance indicators, mandatory public publication, or separate agency reporting deadline. Agency documentation of public-impacting AI integration and interagency sharing support ongoing understanding of deployment. These duties do not create monthly reporting, annual external audits, or registration of every AI system in a public database.

Continuing evaluation also follows from institutional responsibilities. DGO assists with assessing tools against pro-human principles; agencies evaluate cost-effective transformation opportunities; designated agency leads evaluate and execute AI-assisted improvements; and DTS evaluates training delivery options and next-generation cybersecurity solutions. No standardized scoring methodology is prescribed. Training records, workflow descriptions, safeguard documentation, and implementation findings may help demonstrate progress, but the order does not explicitly require those particular record formats. It sets no numerical targets for efficiency gains, training completion rates, or cybersecurity performance.

Penalties, Liability, and Appeals

The order creates no administrative fines, criminal offenses, monetary penalties, damages remedy, or dedicated appeals procedure. Its directions operate through responsibilities assigned to executive institutions and officials. It specifies no penalty per untrained employee, AI system, or documentation omission. The absence of a penalty schedule does not make mandatory duties voluntary: directions that agencies, DGO, or DTS “shall” act remain executive instructions within the order’s scope. The instrument establishes no specific disciplinary sanction, separate enforcement office, or private right of action.

Section 7(b) preserves existing state and federal legal obligations, including records, privacy, and civil-rights requirements. AI use does not excuse compliance with law governing the underlying activity. Remedies and review routes for particular agency determinations arise under applicable law, not a new mechanism created by this order. Human-in-the-loop review is a safeguard rather than a new appellate tribunal. The order provides no special immunity for agencies, employees, or vendors and makes no allocation of contractual liability between an agency and an AI supplier.

Relationship to Other Instruments

The order operationalizes the Pro-Human AI Initiative established in December 2025. Its recitals express a commitment to human-guided and human-enhancing technology, and Section 3 makes those principles the standard for covered agency AI use. It also builds on the established SEDI Framework by directing DGO to develop and utilize it where applicable as strategic trust infrastructure. It does not reproduce a complete SEDI specification, establish a separate digital-identity statute, or require digital credentials for every government interaction. The initiative and framework provide policy and technical context; the order assigns institutional responsibilities.

Section 7(b) expressly preserves agency obligations under the Government Records Access and Management Act (GRAMA) and the Government Data Privacy Act (GDPA), alongside other existing state and federal law. It does not amend these statutes, create a records-access exemption, or authorize otherwise unlawful processing of personal information. Utah Code § 63E-1-102 is referenced specifically to define excluded independent entities. Uniform AI implementation standards must be developed and published through DTS coordination, but their future content is not established by the order.

National and Federal Alignment

This is a Utah executive-branch instrument, not a federal AI regulation or nationwide rule for developers and deployers. Section 7(b) states that nothing in the order limits or alters agency obligations under existing federal law, including applicable federal privacy and civil-rights law. Agencies must satisfy the pro-human framework alongside existing federal obligations. The order identifies no particular federal AI executive order, requires no federal certification, and does not declare compliance with a named federal technical standard. It does not formally adopt such an instrument.

The state approach combines centralized operational leadership, distributed agency duties, workforce literacy, documentation, human review, and privacy-preserving identity infrastructure. It addresses responsible government deployment rather than a general market-access system for commercial AI. Excluded Utah institutions remain outside its agency definition, and federal entities are not covered agencies. Compliance with federal privacy or civil-rights requirements depends on the activity and applicable law; adherence to this order alone does not establish federal compliance. The order neither displaces federal requirements nor creates an exemption from them.

Implementation Timeline

Sources and References