Regulon — IA-SF-2414 · IA SF 2414 (Employer Automated Decision Systems)

Summary

Iowa SF 2414 regulates employers' use of automated decision systems (ADS) in employment-related decisions. It requires employers to provide advance written notice to employees who will be affected by an ADS, with specific content requirements including the types of decisions affected, data categories used, key parameters, vendor identity, quota descriptions, and employee rights. Employers are prohibited from using ADS to infer protected status, retaliate against employees exercising legal rights, collect undisclosed data, or rely solely on ADS for discipline, termination, or deactivation decisions — human review is required for those decisions. Employees have a right to access the most recent 12 months of their own data used by an ADS. Enforced by the Department of Inspections, Appeals, and Licensing with a $500 civil penalty per violation, plus a private right of action with injunctive relief, punitive damages, and attorney fees.

Enforcement & Penalties

Enforcement Authority

The Department of Inspections, Appeals, and Licensing enforces this chapter. Enforcement may include investigating alleged violations, ordering temporary relief, issuing citations, conducting contested case hearings, and bringing civil actions in district court. A person subject to a violation may also bring a private action in district court. The department may bring such an action on the person's behalf with the person's consent.

Penalties

Civil penalty of $500 per violation, collectible by the department. Private plaintiffs may seek temporary or preliminary injunctive relief, punitive damages, and reasonable attorney fees and court costs.

Who Is Covered

"Employer" means any person who directly or indirectly, or through an agent or any other person, employs or exercises control over the wages, benefits, other compensation, hours, working conditions, access to work or job opportunities, or other terms or conditions of employment of any employee in this state. "Employer" includes a person who contracts for labor on behalf of an employer.

What Is Covered

"Automated decision system" means any computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decision making and materially impacts natural persons. "Automated decision system" does not include a spam electronic mail filter, firewall, antivirus software, identity and access management tool, calculator, database, dataset, or other compilation of data.

Compliance Obligations 11 obligations · click obligation ID to open requirement page

H-01 Human Oversight of Automated Decisions · H-01.3 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.2(1)-(3)

Plain Language

Employers must provide advance written notice to each employee (or their authorized representative) who will foreseeably be directly affected by an automated decision system used for employment-related decisions other than hiring. The notice must be delivered at least 30 days before a new ADS is deployed, by January 1, 2027 for systems already in use, or within 30 days of hiring a new employee. The notice must contain seven specific categories of information: the types of employment decisions affected, the data categories and sources, key parameters that disproportionately affect output, the ADS vendor, any quota details, the employee's data access and correction rights, and anti-retaliation protections. The notice must be a standalone plain-language communication delivered via a simple method such as email.

Statutory Text

1. An employer shall provide a written notice that an automated decision system is in use for the purpose of making employment-related decisions, other than hiring decisions, at the workplace to an employee who will foreseeably be directly affected by the automated decision system, or the employee's authorized representative. The employer shall provide the notice by the following dates: a. At least thirty days before an automated decision system is first deployed by the employer. b. If the employer is using an automated decision system to assist in making employment-related decisions as of the effective date of this Act, no later than January 1, 2027. c. To a new employee within thirty days of hiring the employee. 2. A notice provided pursuant to subsection 1 shall contain all of the following information: a. The type of employment-related decisions potentially affected by the automated decision system. b. A general description of the categories of employee-input data the automated decision system will use, the sources of employee input data, and how employee input data will be collected. c. Any key parameters known to disproportionately affect the output of the automated decision system. d. The individuals, vendors, or entities that created the automated decision system. e. If applicable, a description of each quota set or measured by an automated decision system to which the employee is subject, including the quantified number of tasks to be performed or products to be produced, and any potential adverse employment action that could result from failure to meet the quota, as well as whether those quotas are subject to change and if any notice is given of changes in quotas. f. A description of the employee's right to access and correct the employee's data used by the automated decision system. g. That the employer is prohibited from retaliating against employees for exercising the rights provided in this chapter. 3. A written notice required by subsection 1 shall be written in plain language as a separate, stand-alone communication. The notice shall be in the language in which routine communications and other information are provided to employees. The notice shall be provided via a simple and easy-to-use method, including but not limited to an email, electronic link, or other written format.

H-01 Human Oversight of Automated Decisions · H-01.3 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.2(4)

Plain Language

When an employer uses an ADS in hiring decisions, each applicant must be notified upon receipt of their application that the employer uses an ADS for hiring. This notification may be delivered via an automatic reply to the application or included in the job posting itself. This is a simpler notice than the detailed employee-facing notice in § 91F.2(1)-(3) — it does not require the same seven content categories and applies specifically to applicants rather than existing employees.

Statutory Text

4. If an employer will use an automated decision system in making hiring decisions for a position, the employer shall notify an applicant for the position, upon receiving the application, that the employer utilizes an automated decision system when making hiring decisions. The employer may make the notification using an automatic reply mechanism or on a job posting.

G-01 AI Governance Program & Documentation · G-01.3 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.2(5)

Plain Language

Employers must maintain a current inventory of all automated decision systems in use. This is a recordkeeping obligation designed to support compliance with the notice requirements. It does not require public disclosure or submission to regulators — it is an internal record that must be kept updated as systems are added or retired.

Statutory Text

5. An employer shall maintain an updated list of all automated decision systems currently in use by the employer to facilitate implementation of this section.

S-02 Prohibited Conduct & Output Restrictions · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.3(1)(a)-(d)

Plain Language

Employers are prohibited from using an ADS to: (a) violate or prevent compliance with any labor, employment, health/safety, or civil rights law; (b) infer an employee's protected class status under Iowa's civil rights chapter; (c) identify, profile, predict, or take adverse action against employees for exercising their legal rights (including labor and employment rights); or (d) collect employee data for undisclosed purposes. These are categorical prohibitions — there is no compliance program or safe harbor that permits these uses.

Statutory Text

1. An employer shall not use an automated decision system to do any of the following: a. Prevent compliance with or violate any federal, state, or local labor, occupational health and safety, employment, or civil rights laws or regulations. b. Infer an employee's protected status under chapter 216. c. Identify, profile, predict, or take adverse action against an employee for exercising the employee's legal rights, including but not limited to rights guaranteed by state and federal employment and labor laws. d. Collect employee data for a purpose that is not disclosed pursuant to the notice requirements in section 91F.2.

H-01 Human Oversight of Automated Decisions · H-01.6 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.3(1)(e), 91F.3(2)

Plain Language

Employers are categorically prohibited from relying solely on an ADS for discipline, termination, or deactivation decisions — human involvement is always required. When an employer relies primarily on ADS output for such decisions, a human reviewer must affirmatively review the ADS output and compile and review other relevant information, which may include supervisory evaluations, personnel files, employee work product, peer reviews, and witness interviews. This is a mandatory human-in-the-loop requirement specifically for adverse employment actions, not merely a right to request human review.

Statutory Text

1. An employer shall not use an automated decision system to do any of the following: ... e. Rely solely on an automated decision system when making a discipline, termination, or deactivation decision. 2. When an employer relies primarily on output from an automated decision system to make a discipline, termination, or deactivation decision, the employer shall use a human reviewer to review the automated decision system output and compile and review other information that is relevant to the decision, if any. For purposes of this subsection, "other information" may include but is not limited to any of the following: a. Supervisory or managerial evaluations. b. Personnel files. c. Work product of employees. d. Peer reviews. e. Witness interviews, which may include relevant online customer reviews.

Other · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.3(3)

Plain Language

Employers may not feed customer ratings as the sole or primary data source into an ADS that makes employment-related decisions. Customer ratings may still be used as a supplementary input, but they cannot be the dominant factor driving the system's output. This targets gig economy and platform work scenarios where algorithmic decisions about workers are driven primarily by customer feedback.

Statutory Text

3. An employer shall not use customer ratings as the only or primary input data for an automated decision system to make employment-related decisions.

H-01 Human Oversight of Automated Decisions · H-01.1 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.4(1)-(3)

Plain Language

When an employer has primarily relied on an ADS to make a discipline, termination, or deactivation decision, the employer must provide a written post-decision notice to the affected employee at the time the employee is informed of the decision. The notice must include: (a) a contact person for more information, (b) disclosure that an ADS was used, (c) the employee's right to request a copy of the data used, and (d) notice of anti-retaliation protections. The notice must be a standalone plain-language communication delivered via a simple method. This is a post-decision explanation obligation — it tells the employee that an ADS was involved and what rights they have, at the moment they learn of the adverse action.

Statutory Text

1. An employer that primarily relied on an automated decision system to make a discipline, termination, or deactivation decision shall provide the affected employee with a written notice at the time the employer informs the employee of the decision. 2. A notice provided pursuant to subsection 1 shall contain all of the following information: a. The individual to contact for more information about the decision. b. That the employer used an automated decision system to assist the employer in one or more discipline, termination, or deactivation decisions with respect to the employee. c. That the employee has the right to request a copy of the employee's data used by the automated decision system. d. That the employer is prohibited from retaliating against the employee for exercising the rights provided in this chapter. 3. A written notice required by subsection 1 shall be written in plain language as a separate, stand-alone communication. The notice shall be in the language in which routine communications and other information are provided to employees. The notice shall be provided via a simple and easy-to-use method, including but not limited to an email, electronic link, or other written format.

D-01 Automated Processing Rights & Data Controls · D-01.1 D-01.2 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.5

Plain Language

Employees have the right to request a copy of the most recent 12 months of their own data that was primarily used by an ADS for discipline, termination, or deactivation decisions. The employer must provide the copy upon request. This right is limited to one request per 12-month period. This is a data access right — it allows employees to see what information drove adverse automated decisions about them, which is a prerequisite to challenging or correcting that data.

Statutory Text

An employee has the right to request a copy of the most recent twelve months of the employee's own data primarily used by an automated decision system to make a discipline, termination, or deactivation decision. An employer shall provide a copy upon request. An employee is limited to one such request every twelve months.

D-01 Automated Processing Rights & Data Controls · D-01.4 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.6

Plain Language

When an employer provides employee data under this chapter (e.g., in response to a data access request), the employer must anonymize the personal information of any customer, other employee, or other individual contained in that data. This is a privacy safeguard that ensures data disclosures under this chapter do not expose third parties' personal information.

Statutory Text

For purposes of safeguarding the privacy rights of consumers, employees, and individuals, when an employer is required to provide employee data pursuant to this chapter, the employer shall provide the data in a manner that anonymizes the personal information of any customer, employee, or other individual.

G-03 Whistleblower & Anti-Retaliation Protections · G-03.3 · Deployer · EmploymentAutomated Decisionmaking

Iowa Code § 91F.7

Plain Language

Employers are prohibited from retaliating against employees in any way — including discharge, threats, demotion, suspension, or discrimination — for exercising rights under this chapter, filing complaints with the department, cooperating in investigations or prosecutions, or assisting with enforcement. This covers a broad range of protected activities and is not limited to internal reporting — it also protects employees who engage with external enforcement authorities.

Statutory Text

An employer shall not discharge, threaten to discharge, demote, suspend, or in any manner discriminate or retaliate against any employee for using or attempting to exercise the employee's rights under this chapter, filing a complaint with the department alleging a violation of this chapter, cooperating in an investigation or prosecution of an alleged violation of this chapter, or taking any action to invoke or assist in any manner the enforcement of this chapter.

Other · EmploymentAutomated Decisionmaking

Iowa Code § 91F.10

Plain Language

This savings clause clarifies that nothing in this chapter prevents employers from complying with regulatory or contractual requirements arising from providing products or services to the federal government. It creates no new obligation — it is a carve-out ensuring that federal contractor obligations are not frustrated by this state law.

Statutory Text

This chapter shall not be construed to prohibit any employer from complying with regulatory or contractual requirements in the provision of products or services to the federal government.