Regulon.AI — IA-SF-2414 · IA SF 2414 (Employer Automated Decision Systems)

Summary

Iowa SF 2414 regulates employer use of automated decision systems (ADS) in making employment-related decisions such as discipline, termination, hiring, scheduling, and performance evaluation. Employers must provide advance written notice to employees (or applicants for hiring decisions) describing the ADS in use, categories of data collected, key parameters, and employee rights. When an employer primarily relies on ADS output for discipline, termination, or deactivation, a human reviewer must review the output alongside other relevant information, and a post-decision written notice must be provided. Employers are prohibited from using ADS to infer protected status, retaliate against employees exercising legal rights, or collect undisclosed data. Enforcement is by the Department of Inspections, Appeals, and Licensing with a $500 civil penalty per violation, and affected persons have a private right of action for injunctive relief, punitive damages, and attorney fees.

Enforcement & Penalties

Enforcement Authority

The Department of Inspections, Appeals, and Licensing enforces the chapter. Enforcement may include investigating alleged violations, ordering temporary relief, issuing citations, conducting contested case hearings, and bringing civil actions in district court. Private right of action is also available: a person subject to a violation may bring an action in district court, and the department may bring such an action on the person's behalf with the person's consent.

Penalties

Civil penalty of $500 per violation, collectible by the department. Private plaintiffs may seek temporary or preliminary injunctive relief, punitive damages, and reasonable attorney fees and court costs. Statutory damages do not require proof of actual monetary harm.

Who Is Covered

"Employer" means any person who directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment of any employee in this state. "Employer" includes a person who contracts for labor on behalf of an employer.

What Is Covered

"Automated decision system" means any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decision making and materially impacts natural persons. "Automated decision system" does not include a spam electronic mail filter, firewall, antivirus software, identity and access management tool, calculator, database, dataset, or other compilation of data.

Compliance Obligations 11 obligations · click obligation ID to open requirement page

H-01 Human Oversight of Automated Decisions · H-01.3 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.2(1)-(3)

Plain Language

Employers must provide a plain-language, stand-alone written notice to any employee (or their authorized representative) who will foreseeably be directly affected by an automated decision system used for non-hiring employment decisions. The notice must be provided at least 30 days before first deploying an ADS, by January 1, 2027 for systems already in use, or within 30 days of hiring a new employee. The notice must describe the types of decisions affected, the data categories and sources used, key parameters that disproportionately affect output, the ADS vendor, any quotas, the employee's right to access and correct their data, and the employer's anti-retaliation obligations. The notice must be delivered in the same language used for routine workplace communications.

Statutory Text

1. An employer shall provide a written notice that an automated decision system is in use for the purpose of making employment-related decisions, other than hiring decisions, at the workplace to an employee who will foreseeably be directly affected by the automated decision system, or the employee's authorized representative. The employer shall provide the notice by the following dates: a. At least thirty days before an automated decision system is first deployed by the employer. b. If the employer is using an automated decision system to assist in making employment-related decisions as of the effective date of this Act, no later than January 1, 2027. c. To a new employee within thirty days of hiring the employee. 2. A notice provided pursuant to subsection 1 shall contain all of the following information: a. The type of employment-related decisions potentially affected by the automated decision system. b. A general description of the categories of employee-input data the automated decision system will use, the sources of employee input data, and how employee input data will be collected. c. Any key parameters known to disproportionately affect the output of the automated decision system. d. The individuals, vendors, or entities that created the automated decision system. e. If applicable, a description of each quota set or measured by an automated decision system to which the employee is subject, including the quantified number of tasks to be performed or products to be produced, and any potential adverse employment action that could result from failure to meet the quota, as well as whether those quotas are subject to change and if any notice is given of changes in quotas. f. A description of the employee's right to access and correct the employee's data used by the automated decision system. g. That the employer is prohibited from retaliating against employees for exercising the rights provided in this chapter. 3. A written notice required by subsection 1 shall be written in plain language as a separate, stand-alone communication. The notice shall be in the language in which routine communications and other information are provided to employees. The notice shall be provided via a simple and easy-to-use method, including but not limited to an email, electronic link, or other written format.

H-01 Human Oversight of Automated Decisions · H-01.3 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.2(4)

Plain Language

When an employer uses an ADS in hiring, it must notify each applicant upon receiving their application that an ADS is part of the hiring process. This notice may be provided via an automatic reply to the application or disclosed in the job posting itself. Unlike the more detailed advance notice required for current employees under § 91F.2(1)-(3), the applicant notification is simpler — it need only disclose that an ADS is used in hiring decisions.

Statutory Text

4. If an employer will use an automated decision system in making hiring decisions for a position, the employer shall notify an applicant for the position, upon receiving the application, that the employer utilizes an automated decision system when making hiring decisions. The employer may make the notification using an automatic reply mechanism or on a job posting.

G-01 AI Governance Program & Documentation · G-01.3 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.2(5)

Plain Language

Employers must maintain a current inventory of all automated decision systems they use. This is a recordkeeping obligation designed to support compliance with the notice requirements — the list must be kept up to date as systems are deployed or retired. There is no explicit requirement to publish the list or submit it to a regulator, but it must exist and be current.

Statutory Text

5. An employer shall maintain an updated list of all automated decision systems currently in use by the employer to facilitate implementation of this section.

S-02 Prohibited Conduct & Output Restrictions · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.3(1)(a)-(c)

Plain Language

Employers are categorically prohibited from using an ADS in three ways: (1) to prevent compliance with or violate any federal, state, or local labor, employment, occupational safety, or civil rights law; (2) to infer an employee's protected status under Iowa's Civil Rights Act (chapter 216, covering race, sex, age, disability, etc.); and (3) to identify, profile, predict, or take adverse action against an employee for exercising legal rights under state or federal employment and labor laws. The prohibition on inferring protected status functions as a proxy-variable restriction — the ADS may not be designed or used to derive protected characteristics.

Statutory Text

1. An employer shall not use an automated decision system to do any of the following: a. Prevent compliance with or violate any federal, state, or local labor, occupational health and safety, employment, or civil rights laws or regulations. b. Infer an employee's protected status under chapter 216. c. Identify, profile, predict, or take adverse action against an employee for exercising the employee's legal rights, including but not limited to rights guaranteed by state and federal employment and labor laws.

D-01 Automated Processing Rights & Data Controls · D-01.4 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.3(1)(d)

Plain Language

Employers may not use an ADS to collect employee data for any purpose not already disclosed in the advance written notice required under § 91F.2. This functions as a purpose limitation — the employer's data collection through the ADS is constrained to the purposes described in the notice. Any new data collection purpose would require an updated notice before collection can begin.

Statutory Text

d. Collect employee data for a purpose that is not disclosed pursuant to the notice requirements in section 91F.2.

H-01 Human Oversight of Automated Decisions · H-01.6 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.3(1)(e), (2)

Plain Language

Employers may never rely solely on an ADS for discipline, termination, or deactivation decisions — a human must always be involved. When the ADS output is the primary basis for such a decision, the employer must use a human reviewer who reviews both the ADS output and any other relevant information, which may include supervisory evaluations, personnel files, employee work product, peer reviews, and witness interviews (including online customer reviews). The human reviewer must affirmatively compile and review this supplementary information, not merely rubber-stamp the ADS output.

Statutory Text

e. Rely solely on an automated decision system when making a discipline, termination, or deactivation decision. 2. When an employer relies primarily on output from an automated decision system to make a discipline, termination, or deactivation decision, the employer shall use a human reviewer to review the automated decision system output and compile and review other information that is relevant to the decision, if any. For purposes of this subsection, "other information" may include but is not limited to any of the following: a. Supervisory or managerial evaluations. b. Personnel files. c. Work product of employees. d. Peer reviews. e. Witness interviews, which may include relevant online customer reviews.

Other · EmploymentAutomated Decisionmaking

Iowa Code § 91F.3(3)

Plain Language

Employers are prohibited from feeding customer ratings as the sole or primary input into an ADS used for any employment-related decision. Customer ratings may still be one input among several, but they cannot be the dominant or exclusive data source driving ADS-assisted employment outcomes. This addresses concerns about unreliable or biased customer feedback being amplified through algorithmic systems in contexts like gig economy worker management.

Statutory Text

3. An employer shall not use customer ratings as the only or primary input data for an automated decision system to make employment-related decisions.

H-01 Human Oversight of Automated Decisions · H-01.1 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.4(1)-(3)

Plain Language

When an employer primarily relies on ADS output to make a discipline, termination, or deactivation decision, it must provide the affected employee with a written notice at the time the decision is communicated. The notice must identify a contact person, state that an ADS was used, inform the employee of their right to request a copy of their data, and state that retaliation for exercising rights under the chapter is prohibited. The notice must be a separate, stand-alone plain-language communication delivered in the employee's routine communication language via an accessible method such as email.

Statutory Text

1. An employer that primarily relied on an automated decision system to make a discipline, termination, or deactivation decision shall provide the affected employee with a written notice at the time the employer informs the employee of the decision. 2. A notice provided pursuant to subsection 1 shall contain all of the following information: a. The individual to contact for more information about the decision. b. That the employer used an automated decision system to assist the employer in one or more discipline, termination, or deactivation decisions with respect to the employee. c. That the employee has the right to request a copy of the employee's data used by the automated decision system. d. That the employer is prohibited from retaliating against the employee for exercising the rights provided in this chapter. 3. A written notice required by subsection 1 shall be written in plain language as a separate, stand-alone communication. The notice shall be in the language in which routine communications and other information are provided to employees. The notice shall be provided via a simple and easy-to-use method, including but not limited to an email, electronic link, or other written format.

D-01 Automated Processing Rights & Data Controls · D-01.1 D-01.2 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.5

Plain Language

Employees have the right to request a copy of their own data that was primarily used by an ADS in a discipline, termination, or deactivation decision, covering the most recent 12-month period. Employers must fulfill the request. The right is limited to one request per 12-month period. This is a data access right — it enables employees to understand what data drove adverse automated decisions about them, supporting their ability to challenge or correct that data.

Statutory Text

An employee has the right to request a copy of the most recent twelve months of the employee's own data primarily used by an automated decision system to make a discipline, termination, or deactivation decision. An employer shall provide a copy upon request. An employee is limited to one such request every twelve months.

D-01 Automated Processing Rights & Data Controls · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.6

Plain Language

Whenever an employer provides employee data under this chapter (e.g., in response to a data access request under § 91F.5), it must anonymize the personal information of any third party — including customers, other employees, and other individuals — contained in that data. This privacy safeguard ensures that fulfilling one employee's data access request does not compromise the privacy of others whose data may appear in the same dataset.

Statutory Text

For purposes of safeguarding the privacy rights of consumers, employees, and individuals, when an employer is required to provide employee data pursuant to this chapter, the employer shall provide the data in a manner that anonymizes the personal information of any customer, employee, or other individual.

G-03 Whistleblower & Anti-Retaliation Protections · G-03.3 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.7

Plain Language

Employers are prohibited from retaliating against employees in any form — discharge, threats, demotion, suspension, discrimination, or any other adverse action — for exercising their rights under the chapter, filing a complaint with the department, cooperating in an investigation or prosecution, or assisting in enforcement. This is a broad anti-retaliation provision covering all protected activities related to the chapter, including both formal complaints and informal attempts to exercise rights.

Statutory Text

An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any employee for using or attempting to exercise the employee's rights under this chapter, filing a complaint with the department alleging a violation of this chapter, cooperating in an investigation or prosecution of an alleged violation of this chapter, or taking any action to invoke or assist in any manner the enforcement of this chapter.