AI Agent Development Company in Salt Lake City

Ranges rather than a number, because scope moves the total more than anything else. A scoped agent proof of concept, meaning one agent, three to five tools, an evaluation suite, an action-log view, and a hosted demo behind your SSO, typically runs USD 28,000 to 65,000 over six to ten weeks. A custom production agent, such as prior-authorization drafting for a health system, dispute-investigation triage inside a sponsor bank, or a sustainment-documentation assistant for a Hill Air Force Base supplier, typically runs USD 110,000 to 300,000 including guardrails, the human approval console, observability, and the compliance documentation pack. An enterprise multi-agent platform with role-specialized agents, shared memory, custom evaluators, and integration into Epic, a core banking platform, or a PLM system runs USD 300,000 to 800,000 and up across phases. Defense work carries a premium because the enclave architecture and access controls add engineering that a commercial build does not need. We quote fixed fee against a signed statement of work.

The Artificial Intelligence Policy Act passed as SB 149, was signed March 13 2024, and took effect May 1 2024, making Utah the first state to regulate private-sector generative AI use directly. Two ideas matter. First, you cannot hide behind the model: if a generative AI system your business deploys makes a statement that would violate Utah consumer protection law, the deploying entity is answerable for it. Second, disclosure. As originally passed, any consumer-facing generative AI used in a state-regulated occupation had to disclose that the consumer was talking to AI. The 2025 amendments changed the shape of that duty and moved it. SB 226, signed March 27 2025 and effective May 7 2025, re-enacted the disclosure rules as Utah Code Title 13, Chapter 75, narrowing the general duty to cases where a consumer clearly and unambiguously asks whether they are dealing with AI, and requiring prominent proactive disclosure in a regulated occupation only where the exchange is a high-risk artificial intelligence interaction. The statute defines that term as one collecting sensitive personal information, meaning health, financial, or biometric data, or providing personalized recommendations or advice that could reasonably drive a significant personal decision, including financial, legal, medical, and mental health advice. SB 332, effective the same day, pushed the Artificial Intelligence Policy Act's repeal date out to July 1 2027, so the chapter remains live rather than sunsetting in 2025 as originally drafted. Practically, we run a disclosure scoping in discovery, build the disclosure into the agent's opening turn where it is required, log that the disclosure was rendered, and keep the log because proving disclosure happened is the part most teams cannot do after the fact.

SB 149 created the Office of Artificial Intelligence Policy inside the Utah Department of Commerce along with an Artificial Intelligence Learning Laboratory Program. The Artificial Intelligence Policy Act is codified at Utah Code Title 13, Chapter 72: the office at Section 13-72-201, the learning laboratory at Section 13-72-301, and regulatory mitigation and joint interpretation agreements at Section 13-72-401. The office exists to run a regulatory sandbox: a company can approach it, describe an AI deployment that sits awkwardly against existing Utah regulation, and negotiate an agreement that sets out scope limits, safeguards, required consumer disclosures, and reporting while the deployment runs and the state learns from it. The office audits participants for the duration, and a participant stays subject to every requirement the agreement does not expressly modify. No other state built this, and it is genuinely useful for the categories where Utah buyers keep getting stuck: mental health adjacent tools, AI in licensed professional workflows, and consumer-facing financial guidance. We are not your regulatory counsel and we say so plainly, but we do build the artifacts an application needs. That means a written system description, a documented evaluation methodology with results, a risk profile mapped to the NIST AI Risk Management Framework, a description of the human oversight design, and an incident and rollback plan. If your counsel decides to approach the office, you should not have to reconstruct any of that from Slack threads.

The Utah Consumer Privacy Act was signed March 24 2022 and took effect December 31 2023, making Utah the fourth state with a comprehensive consumer privacy statute. It is deliberately the most business-friendly of the group, and the differences matter architecturally. It applies only above a revenue threshold combined with a volume threshold, so genuinely mid-market companies often fall outside it while still owing HIPAA or GLBA duties. It gives consumers rights to access, delete, port, and opt out of sale and targeted advertising, and since an amendment to Section 13-61-201 took effect July 1 2026 it also gives a right to request correction of inaccurate personal data, which earlier write-ups of this statute say it lacks. It handles sensitive data through notice and an opportunity to opt out rather than the opt-in consent Virginia and Colorado require. It does not mandate data protection assessments, and it does not require honoring universal opt-out signals such as Global Privacy Control. Enforcement runs through the Utah Division of Consumer Protection and the Attorney General with a 30-day cure period and no private right of action. What we build against that: a per-tool data map so you can answer what the agent touches, deletion that propagates into vector indexes and conversation memory rather than only the system of record, opt-out state that the agent reads before personalizing anything, and retention schedules on agent telemetry.

Yes, inside a defined perimeter. Protected health information stays in US-region infrastructure under a signed business associate agreement, model suppliers are contractually barred from training on your data, minimum-necessary scoping limits what reaches a model context, and every inference is logged for audit. The agent patterns that hold up are prior-authorization drafting with citations back to chart documentation and payer policy, referral and scheduling coordination across Epic and external systems, lab-result routing against defined clinical rules, and encounter-note drafting for physician review. In every case an attending clinician sits on the action gate and the agent never closes a clinical decision on its own. Utah adds a specific layer worth knowing about: HB 452, signed March 25 2025 and effective May 7 2025, regulates AI mental health chatbots reachable by Utah users. It requires the chatbot to disclose clearly and conspicuously that it is AI and not a human before the user can reach its features, again at the start of any interaction where the user has not used it in the previous seven days, and any time the user asks. It bars a supplier from selling or sharing a Utah user's individually identifiable health information or user input, with narrow carve-outs for a health care provider requesting it with the user's consent, the user's own health plan on request, and contracted parties needed to run the service under HIPAA-equivalent terms. It restricts in-chat advertising, and Section 58-60-118 gives suppliers an affirmative defense where they maintain and implement a documented compliance policy. Any behavioral health adjacent agent we build for a Utah deployment ships with that policy drafted and the labeling wired in.

Utah's industrial bank charter, administered by the Utah Department of Financial Institutions and paired with FDIC deposit insurance, is why WebBank and Celtic Bank in Salt Lake City sit behind a large share of American fintech lending and card programs. That structure changes the agent build in three ways. First, examination evidence is the deliverable, not a byproduct: every decision the agent influences needs a reconstructable record showing inputs, model version, policy applied, and the human who approved it. Second, model risk governance applies. The interagency model risk management guidance, issued as Federal Reserve SR 11-7 and OCC Bulletin 2011-12 and adopted by the FDIC in 2017, expects documented development, independent validation, and ongoing monitoring, so we build the validation package alongside the agent rather than after. Third, fair lending and complaint handling constrain what the agent may do unaided. Adverse action reasons must be traceable to real factors under ECOA and Regulation B, so we keep agents in a drafting and assembly role with a human credit decision, and we instrument disparate-impact telemetry into the evaluation suite. Third-party risk expectations from the 2023 interagency guidance also reach us as your vendor, so we ship the diligence pack your bank partner will ask for.