Regulon — IA-HSB-294 · IA HSB 294 (AI Elections & High-Risk AI Systems)

WHAT THIS BILL REGULATES · 8 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney general has exclusive authority to enforce Division II (Chapter 554I). Prior to initiating any enforcement action, the attorney general must issue a notice of violation with a description of the alleged violation and required cure actions. The attorney general may bring an action only if the violation is not cured within 90 days. Prior to initiating any action, the attorney general must consult with the Department of Health and Human Services to determine whether a complaint has been filed on the same act or omission, and may not initiate an action if such a complaint is pending. Division I (election materials) violations are serious misdemeanors enforceable under existing Iowa Code § 68A.405. Division II violations are unlawful practices under Iowa Code § 714.16.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

Division I: Willful violations are serious misdemeanors punishable by confinement for up to one year and a fine of $430–$2,560. Division II: Violations are unlawful practices under Iowa Code § 714.16, which provides for injunctive relief, disgorgement of moneys or property, and civil penalties not to exceed $40,000 per violation. The bill explicitly does not provide a basis for a private right of action.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

Iowa Code § 68A.405(5)

AI-generated election material disclosure

Publisher

5(a) 1 Published material generated through the use of artificial intelligence and designed to expressly advocate the nomination, election, or defeat of a candidate for public office or the passage or defeat of a ballot issue must contain a disclosure on the published material that the published material was generated using artificial intelligence. The disclosure must include the words "this material was generated using artificial intelligence".

5(b) For purposes of this subsection, "artificial intelligence" means a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments.

5(c) The board shall adopt rules for the implementation of this subsection.

5(d) A disclosure made in compliance with this subsection does not preclude a private right of action arising out of the publication of published material generated through the use of artificial intelligence.

This section creates a new subsection within Iowa's campaign finance law requiring that any published material generated through the use of artificial intelligence and designed to expressly advocate the nomination, election, or defeat of a candidate or the passage or defeat of a ballot issue must include a disclosure that it was generated using AI. The mandated disclosure language is prescribed verbatim: "this material was generated using artificial intelligence." The section includes its own definition of artificial intelligence, delegates rulemaking authority to the Iowa Ethics and Campaign Disclosure Board, and clarifies that compliance with the disclosure requirement does not preclude private rights of action arising from the publication itself.

Compliance actions 1 item

Any person who publishes AI-generated material designed to expressly advocate the nomination, election, or defeat of a candidate or the passage or defeat of a ballot issue must include a disclosure on the material stating this material was generated using artificial intelligence.

CP-01.6

Iowa Code § 554I.1

Definitions

As used in this chapter: 1. a. "Algorithmic discrimination" means any use of an artificial intelligence system that results in unfavorable treatment due to an individual or group of individuals' actual or perceived age, race, creed, color, sex, sexual orientation, national origin, religion, or disability. b. "Algorithmic discrimination" does not include the offer, license, or use of an artificial intelligence system for the sole purpose of performing any of the following: (1) Testing to identify, mitigate, or prevent discrimination or otherwise ensure compliance with state or federal law. (2) Expanding an applicant, customer, or participant pool to increase diversity or redress historic discrimination. (3) Any act or omission by or on behalf of a private club or other establishment not in fact open to the public, as established in the federal Civil Rights Act of 1964, Pub. L. No. 88-352, as amended. 2. "Artificial intelligence system" means any machine-based system that, for any explicit or implicit objective, infers from the inputs the system receives to generate outputs, including content, decisions, predictions, or recommendations, that can influence physical or virtual environments. 3. "Consequential decision" means any decision that has a material legal or similarly significant effect on the provision or denial of any of the following to an individual: a. A pardon, parole, probation, or release. b. Enrollment in education or an educational opportunity. c. Employment. d. A financial or lending service. e. An essential government service. f. A health care service, as health care is defined in section 144B.1. g. Insurance. h. A legal service. 4. "Deployer" means a person doing business in this state that uses a high-risk artificial intelligence system. 5. "Developer" means a person doing business in this state that develops or intentionally and substantially modifies a high-risk artificial intelligence system. 6. a. "High-risk artificial intelligence system" means any artificial intelligence system that makes, or is a factor that would likely alter the outcome of, a consequential decision. b. "High-risk artificial intelligence system" does not include any of the following: (1) An artificial intelligence system that is only intended to do any of the following: (a) Perform a narrow procedural task. (b) Improve the result of a previously completed human activity. (c) Perform a preparatory task relevant to a consequential decision. (d) Detect any decision-making pattern or any deviation from a preexisting decision-making pattern. (2) Antifraud technology. (3) Antimalware technology. (4) Antivirus technology. (5) Calculators. (6) Cybersecurity technology. (7) Databases. (8) Data storage technology. (9) Firewalls. (10) Internet domain registration technology. (11) Internet website loading technology. (12) Networking. (13) Search engine or similar technology. (14) Spam and robocall filtering technology. (15) Spellchecking. (16) Spreadsheets. (17) Web caching technology. (18) Web hosting technology. (19) Any technology that communicates in natural language for the purpose of providing users with information, making referrals or recommendations, answering questions, or generating other content, and that is subject to an accepted use policy that prohibits generating content that is unlawful. 7. "Intentional and substantial modification" or "intentionally and substantially modifies" means a deliberate change made to an artificial intelligence system that materially increases the risk of algorithmic discrimination. 8. "Trade secret" means the same as defined in section 550.2.

Section 554I.1 establishes the defined terms used throughout Chapter 554I. Key definitions include algorithmic discrimination (unfavorable treatment based on protected characteristics, with carve-outs for compliance testing, diversity expansion, and private clubs), artificial intelligence system (a broad machine-based inference system), consequential decision (decisions with material legal or similarly significant effect on eight enumerated domains), deployer, developer, and high-risk artificial intelligence system (any AI system that makes or substantially contributes to a consequential decision, with an extensive exclusion list for routine technologies and chatbots subject to acceptable use policies).

Iowa Code § 554I.2

Algorithmic discrimination prohibited — developer duties

Developer

1 2 1. a. A developer shall use reasonable care to protect individuals from any known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of the developer's high-risk artificial intelligence system. b. There is a rebuttable presumption that a developer used reasonable care as required under this section if the developer complied with subsections 2 through 8 and any additional requirements established in rules adopted by the attorney general pursuant to section 554I.7.

2 3 2. A developer shall make all of the following available to a deployer or other developer that uses or intends to use the developer's high-risk artificial intelligence system: a. A general statement describing the reasonably foreseeable uses and known harmful or inappropriate uses of the high-risk artificial intelligence system. b. Documentation for all of the following: (1) Summaries of the types of data used to train the high-risk artificial intelligence system. (2) The known or reasonably foreseeable limitations of the high-risk artificial intelligence system including but not limited to the known or reasonably foreseeable risks of algorithmic discrimination arising from the intended use of the high-risk artificial intelligence system. (3) The purpose and intended uses of the high-risk artificial intelligence system. (4) The intended outputs of the high-risk artificial intelligence system and how to understand the outputs. (5) The intended benefits of the high-risk artificial intelligence system. (6) How the high-risk artificial intelligence system was evaluated for performance and mitigation of algorithmic discrimination before the high-risk artificial intelligence system was sold, leased, licensed, given, or otherwise made available to the deployer or other developer. (7) The actions or processes the deployer implemented to ensure the quality and consistency of training datasets, the measures used to examine the suitability of data sources, the measures used to evaluate possible biases in the training datasets and data sources, and the measures used to mitigate possible biases in training datasets and data sources. (8) The measures the developer took to mitigate any known or reasonably foreseeable risks of algorithmic discrimination that may arise from using the high-risk artificial intelligence system. (9) How the high-risk artificial intelligence system should be used, should not be used, and should be monitored when the high-risk artificial intelligence system is used to make, or is a factor that would likely alter the outcome of, a consequential decision. (10) Instructions that are reasonably necessary to assist a deployer in monitoring the performance of the high-risk artificial intelligence system for any risk of algorithmic discrimination.

3 4 3. a. A developer that offers, sells, leases, licenses, gives, or otherwise makes a high-risk artificial intelligence system available to a deployer shall provide documentation and information to the deployer necessary for the deployer to complete an impact assessment under section 554I.3. Materials and data include but are not limited to model cards, dataset cards, and other impact assessments. b. This subsection shall not apply if the deployer is affiliated with the developer that is providing the high-risk artificial intelligence system.

4–5 5 4. A developer shall make a statement available in a manner that is clear and readily available on the developer's internet site or in a public use case inventory that includes a summary of all of the following: a. The types of high-risk artificial intelligence systems the developer has developed or intentionally and substantially modified and is currently making generally available to deployers. b. How the developer manages known or reasonably foreseeable risks of algorithmic discrimination arising from development or intentional and substantial modification of the types of high-risk artificial intelligence systems described in paragraph "a". 5. Each developer shall update the statement described in subsection 4 as necessary to ensure that the statement remains accurate, but no later than ninety days after the developer develops or intentionally and substantially modifies a high-risk artificial intelligence system.

6 6 6. a. A developer shall disclose to the attorney general and to all known deployers or other developers of the high-risk artificial intelligence system any known or foreseeable risks of algorithmic discrimination arising from the intended uses of the high-risk artificial intelligence system. b. A disclosure under paragraph "a" shall be given to the attorney general no later than ninety days after the earliest of any of the following occurs: (1) The developer discovers through the developer's ongoing testing and analysis that the developer's high-risk artificial intelligence system has been used and has caused or is reasonably likely to have caused algorithmic discrimination. (2) The developer receives from a deployer a credible report that the high-risk artificial intelligence system has been used and has caused algorithmic discrimination.

7–8 7 7. Subsections 2 through 6 do not require a developer to disclose a trade secret, information protected under state or federal law, or other confidential or proprietary information. 8. a. The attorney general may require that a developer disclose to the attorney general any statement or documentation described in subsection 2 if the statement or documentation is relevant to an investigation conducted by the attorney general regarding a violation of this chapter. b. To the extent that a statement or documentation requested by the attorney general pursuant to paragraph "a" includes proprietary information or a trade secret, the statement or documentation is exempt from disclosure. The developer may designate the statement or documentation as including proprietary information or a trade secret. c. To the extent that a statement or documentation requested by the attorney general pursuant to paragraph "a" includes information subject to attorney-client privilege or work-product protection, the disclosure does not constitute a waiver of the privilege or protection.

Section 554I.2 establishes the core developer obligations. Developers must exercise reasonable care to protect individuals from known or reasonably foreseeable risks of algorithmic discrimination arising from intended and contracted uses of their high-risk AI systems. Compliance with the section's enumerated sub-requirements and any attorney general rules creates a rebuttable presumption of reasonable care. The section requires developers to provide deployers with extensive documentation covering foreseeable uses, training data summaries, known limitations, discrimination risks, bias evaluation methods, mitigation measures, and deployment monitoring instructions. Developers must also publish a public use-case inventory summarizing their high-risk AI systems and discrimination risk management, update it within 90 days of new development or modification, and disclose discrimination risks to the attorney general and known deployers within 90 days of discovery. Trade secret and privilege protections apply.

Compliance actions 6 items

Developers must use reasonable care to protect individuals from known or reasonably foreseeable risks of algorithmic discrimination arising from the intended and contracted uses of their high-risk AI systems. Compliance with the statute's enumerated requirements and attorney general rules creates a rebuttable presumption of reasonable care.

H-02.1

Developers must make available to deployers documentation covering: foreseeable and harmful uses, training data summaries, known limitations and discrimination risks, purpose and intended uses, intended outputs, intended benefits, bias evaluation and mitigation measures, recommended use and monitoring guidance, and deployer monitoring instructions.

T-03.3

Developers must provide deployers with documentation and information necessary for the deployer to complete an impact assessment, including model cards, dataset cards, and other impact assessments. This requirement does not apply where the deployer is affiliated with the developer.

G-02.1

Developers must publish and maintain on their website or in a public use-case inventory a summary of: (1) the types of high-risk AI systems they currently make available to deployers, and (2) how they manage known or reasonably foreseeable risks of algorithmic discrimination. The statement must be updated within 90 days after developing or intentionally and substantially modifying a high-risk AI system.

G-02.4

Developers must disclose to the attorney general and all known deployers any known or foreseeable risks of algorithmic discrimination arising from intended uses of the high-risk AI system, no later than 90 days after discovering through testing that the system has caused or is reasonably likely to have caused algorithmic discrimination, or receiving a credible report from a deployer that the system has caused algorithmic discrimination.

R-01.3

Developers must produce to the attorney general any statement or documentation required under the deployer-disclosure provisions when requested in connection with an investigation, subject to trade secret, proprietary information, and attorney-client privilege protections. Disclosure to the attorney general does not waive privilege or work-product protection.

R-02.2

Iowa Code § 554I.3

Impact assessments — deployer duties

Deployer

1 8 1. A deployer shall use reasonable care to protect individuals from any known or reasonably foreseeable risks of algorithmic discrimination. In any enforcement action brought by the attorney general, there is a rebuttable presumption that a deployer used reasonable care as required under this section if the deployer complied with subsections 2 through 7 and any additional requirements established in rules adopted by the attorney general pursuant to section 554I.7.

2 9 2. a. A deployer shall implement a risk management policy and program to govern the deployer's use of high-risk artificial intelligence systems. b. The risk management policy and program shall specify and incorporate the principles, processes, and personnel that the deployer uses to identify, document, and mitigate known or reasonably foreseeable risks of algorithmic discrimination. c. The risk management program shall be an iterative process that is planned, implemented, and regularly and systematically reviewed and updated for the duration of the deployer's use of high-risk artificial intelligence systems. d. Each risk management policy and program shall consider all of the following: (1) The guidance and standards established by all of the following: (a) Standards established in the most recent version of the artificial intelligence risk management framework published by the national institute of standards and technology of the United States department of commerce. (b) Standard ISO/IEC 42001 of the international organization for standardization. (c) A nationally or internationally recognized risk management framework for artificial intelligence systems. (d) Standards designated by the attorney general. (2) The size and complexity of the deployer. (3) The nature and scope of the high-risk artificial intelligence system used by the deployer, including but not limited to the intended uses of the high-risk artificial intelligence system. (4) The sensitivity and volume of data processed in connection with the high-risk artificial intelligence systems used by the deployer. 3. A risk management policy and program implemented pursuant to this section may cover more than one high-risk artificial intelligence system.

4 10 4. a. A deployer, or a third party contracted by the deployer to use a high-risk artificial intelligence system, shall complete an impact assessment for the high-risk artificial intelligence system. b. The impact assessment shall be completed no later than ninety days after a high-risk artificial intelligence system or an intentional and substantial modification of a high-risk artificial intelligence system is available for use. c. Each impact assessment shall, at a minimum, include all of the following to the extent reasonably known by or available to the deployer: (1) A statement disclosing all of the following: (a) The purpose for using the high-risk artificial intelligence system. (b) The context for using the high-risk artificial intelligence system. (c) The benefits afforded by using the high-risk artificial intelligence system. (2) An analysis of whether the use of the high-risk artificial intelligence system poses any known or foreseeable risk of algorithmic discrimination and, if so, the nature of the algorithmic discrimination and the steps that have been taken to mitigate the risks. (3) A description of the categories of data the high-risk artificial intelligence system processes as inputs and the outputs the high-risk artificial intelligence system produces. (4) Any metrics used to evaluate the performance and known limitations of the high-risk artificial intelligence system. (5) A description of any transparency measures taken concerning the high-risk artificial intelligence system, such as measures taken to disclose to individuals that the high-risk artificial intelligence system is in use. (6) A description of the post-use monitoring and user safeguards provided concerning the high-risk artificial intelligence system, such as the oversight process established by the deployer to address issues arising from using the high-risk artificial intelligence system. (7) If the impact statement is being made subsequent to an intentional and substantial modification to a high-risk artificial intelligence system, a statement disclosing the extent to which the high-risk artificial intelligence system was used in a manner that was consistent with or varied from the developer's intended uses of the high-risk artificial intelligence system. d. A single impact statement may address a comparable set of high-risk artificial intelligence systems used by a deployer. 5. An impact assessment completed for the purpose of complying with another applicable law or regulation shall satisfy the requirements of this section if the impact assessment is reasonably similar in scope and effect to an impact assessment that would otherwise be completed pursuant to this section.

6 11 6. A deployer shall maintain the most recently completed impact assessment for a high-risk artificial intelligence system as required under this section and relevant records supporting the impact assessment for a period of at least three years following the final use of the high-risk artificial intelligence system.

7 12 7. A deployer shall review, at least annually, the deployment of each high-risk artificial intelligence system used by the deployer to ensure that the high-risk artificial intelligence system is not causing algorithmic discrimination.

Section 554I.3 imposes the core deployer obligations. Deployers must exercise reasonable care to protect individuals from algorithmic discrimination, with a rebuttable presumption of compliance available if they implement a risk management program and complete impact assessments as required. The risk management program must be iterative, referencing NIST AI RMF, ISO/IEC 42001, or attorney-general-designated frameworks. Deployers (or their contracted third parties) must complete an impact assessment within 90 days of each high-risk AI system becoming available, covering purpose, benefits, discrimination risk analysis, data categories, performance metrics, transparency measures, and post-deployment monitoring. Impact assessments must be retained for at least three years following final use. Deployers must conduct at least annual reviews of each deployed system to verify it is not causing algorithmic discrimination.

Compliance actions 5 items

Deployers must use reasonable care to protect individuals from known or reasonably foreseeable risks of algorithmic discrimination. Compliance with the statute's risk management, impact assessment, and annual review requirements and any attorney general rules creates a rebuttable presumption of reasonable care.

H-02.3

Deployers must implement an iterative risk management policy and program governing their use of high-risk AI systems, specifying the principles, processes, and personnel used to identify, document, and mitigate algorithmic discrimination risks. The program must consider NIST AI RMF, ISO/IEC 42001, or other recognized frameworks and attorney general-designated standards, and must be regularly and systematically reviewed and updated for the duration of the deployer's use of high-risk AI systems.

G-01.1

Deployers (or their contracted third parties) must complete an impact assessment for each high-risk AI system within 90 days of deployment or intentional and substantial modification, covering: purpose, context, and benefits; discrimination risk analysis and mitigation steps; data input categories and outputs; performance metrics and limitations; transparency measures; post-deployment monitoring and safeguards; and, for modifications, consistency with the developer's intended uses.

H-02.3

Deployers must retain the most recently completed impact assessment and supporting records for at least three years following the final use of each high-risk AI system.

H-02.10

Deployers must review, at least annually, the deployment of each high-risk AI system to ensure the system is not causing algorithmic discrimination.

H-02.8

Iowa Code § 554I.4

Disclosures of artificial intelligence system

DeployerDeveloper

1 13 1. A deployer shall disclose to each individual that interacts with the artificial intelligence system that the individual is interacting with an artificial intelligence system. Developers who make a high-risk artificial intelligence system available in this state shall cooperate with deployers to allow deployers to fulfill the requirements of this subsection.

2 13 2. A disclosure under subsection 1 is not required in circumstances in which it would be obvious to a reasonable individual that the individual is interacting with an artificial intelligence system.

Section 554I.4 requires deployers to disclose to each individual who interacts with an artificial intelligence system that the individual is interacting with an AI system. Developers who make a high-risk AI system available in Iowa must cooperate with deployers to facilitate this disclosure. The disclosure requirement does not apply where it would be obvious to a reasonable person that they are interacting with an AI system.

Compliance actions 1 item

Deployers must disclose to each individual interacting with an AI system that the individual is interacting with an artificial intelligence system, unless it would be obvious to a reasonable person. Developers must cooperate with deployers to enable this disclosure.

T-01.1

Iowa Code § 554I.5

Exclusions

1–4 1. This chapter shall not be construed to restrict a developer's, deployer's, or other person's ability to do any of the following: a. Comply with federal, state, or municipal law. b. Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, municipal, or other governmental authority. c. Cooperate with a law enforcement agency concerning conduct or activity that a developer, deployer, or other person reasonably and in good faith believes may violate federal, state, or municipal law. d. Investigate, establish, exercise, prepare for, or defend legal claims. e. Take immediate steps to protect an interest that is essential for the life or physical safety of an individual. f. Engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is conducted in accordance with 45 C.F.R. pt. 46, as amended, or other relevant requirements established by the federal food and drug administration. g. Conduct research, testing, and development activities regarding an artificial intelligence system, other than testing conducted under real-world conditions, before the artificial intelligence system is placed on the market, used, or otherwise put into service. h. Effectuate a product recall. i. Identify and repair technical errors that impair existing or intended functionality in a computer system or an artificial intelligence system. j. Assist another developer, deployer, or person with any of the requirements of this chapter. 2. This chapter does not apply to a developer, deployer, or other person if the circumstances in which the high-risk artificial intelligence system was developed, used, or intentionally and substantially modified are described by any of the following: a. The high-risk artificial intelligence system has been approved, authorized, certified, cleared, developed, or granted by a federal agency and the deployer, developer, or other person is described by any of the following: (1) The person is acting under the authority of the federal agency that approved, authorized, certified, cleared, developed, or granted the high-risk artificial intelligence system. (2) The person is in compliance with standards established by a federal agency for use of high-risk artificial intelligence systems if the requirements imposed by those standards are substantially similar or more restrictive than the requirements of this chapter. b. The developer, deployer, or other person is conducting research to support an application for approval or certification from a federal agency. c. The developer, deployer, or other person is performing work under or in connection with a contract with the United States department of commerce, the United States department of defense, or the national aeronautics and space administration, unless the developer, deployer, or other person is performing work on a high-risk artificial intelligence system that is used to make, or is a factor that would likely alter the outcome of, a decision concerning employment or housing. d. The developer, deployer, or other person is a covered entity within the meaning of the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, as amended, and is providing health care recommendations that are generated by an artificial intelligence system, require a health care provider to take action to implement the recommendations, and are not likely to alter the outcome of a consequential decision. 3. This chapter does not apply to any artificial intelligence system that is acquired by or for the federal government, a federal agency, or federal department unless the artificial intelligence system is a high-risk artificial intelligence system used to make, or is a factor that would likely alter the outcome of, a decision concerning employment or housing. 4. A developer, deployer, or other person shall have the burden to prove an action qualifies for an exclusion under this section.

Section 554I.5 establishes a broad set of exclusions from the chapter's coverage. Subsection 1 enumerates activities that the chapter shall not restrict, including compliance with other law, cooperation with law enforcement, legal claims, life safety, peer-reviewed research, pre-market R&D, product recalls, bug fixes, and assisting others with chapter compliance. Subsection 2 exempts persons using federally approved or certified AI systems, persons conducting research for federal agency approval, persons performing work under contracts with DoD, Commerce, or NASA (except for employment/housing decisions), and HIPAA covered entities providing AI-generated healthcare recommendations that require provider action and are not likely to alter consequential decision outcomes. Subsection 3 exempts AI systems acquired by or for the federal government (except high-risk systems used in employment or housing decisions). Subsection 4 places the burden of proving an exclusion on the developer, deployer, or other person claiming it.

Iowa Code § 554I.6

Enforcement

1–10 1. The attorney general shall have exclusive authority to enforce this chapter. 2. Prior to initiating any action for a violation of this chapter, the attorney general shall issue a notice of violation to the developer, deployer, or other person who allegedly violated the chapter. The notice shall contain all of the following: a. A specific description of the alleged violation. b. The actions the developer, deployer, or other person must take to cure the violation. 3. The attorney general may bring an action for the alleged violation if the alleged violation is not cured within ninety days of the date the developer, deployer, or other person received the notice of violation. 4. A violation of the requirements established in this chapter is an unlawful practice under section 714.16.

Section 554I.6 establishes the attorney general as the exclusive enforcement authority for Chapter 554I. The attorney general must issue a notice of violation with a specific description of the alleged violation and required cure actions before initiating any enforcement action. The attorney general may bring an action only if the violation is not cured within 90 days. Violations are unlawful practices under Iowa Code § 714.16, which makes available civil penalties up to $40,000 per violation, injunctive relief, and disgorgement. An affirmative defense is available if the person discovered and cured the violation through user feedback, adversarial testing, or internal review, and is otherwise in compliance with NIST AI RMF, ISO/IEC 42001, or an attorney-general-designated AI risk framework. The chapter does not preempt existing rights or remedies at law or in equity, but its rebuttable presumptions and affirmative defenses apply only to attorney general enforcement actions. The chapter explicitly does not provide a private right of action.

Iowa Code § 554I.7

Attorney general rulemaking authority

The attorney general shall adopt rules pursuant to chapter 17A to implement this chapter.

Section 554I.7 directs the attorney general to adopt implementing rules pursuant to Iowa's Administrative Procedure Act (Chapter 17A). This is a delegation of rulemaking authority, not an affirmative compliance obligation on regulated entities.

Iowa Code § 714.16(2)(r)

Unlawful practice — Chapter 554I violations

r It is an unlawful practice for a person to violate any of the provisions of chapter 554I.

This provision adds a new paragraph to Iowa Code § 714.16 (Consumer Frauds Act) making any violation of Chapter 554I an unlawful practice under that section. This is the enforcement hook connecting the new AI chapter to existing remedial machinery including civil penalties up to $40,000 per violation, injunctive relief, and disgorgement.

Transparency AI identity disclosure · periodic reminders

2 items

T-03.3

T-01.1

Deceptive Conduct AI-generated likeness · consent requirements

1 item

CP-01.6

Human Oversight Decision review · appeal pathways

5 items

H-02.1

H-02.3

H-02.10

Deployers must retain the most recently completed impact assessment and supporting records for at least three years following the final use of each high-risk AI system.

H-02.8

Deployers must review, at least annually, the deployment of each high-risk AI system to ensure the system is not causing algorithmic discrimination.

Governance Risk management · accountability programs

3 items

G-02.1