Iowa law sets safety and disclosure rules for conversational AI

Operators must tell minor account holders when they are interacting with AI and offer account controls. These requirements cover operators of public conversational AI services and account holders the operator knows, or is reasonably certain, are under 18. Some tools and features are excluded, including services for narrow topics, internal business use, and device voice assistants. The notice must be persistently visible, or appear at the start of each interaction and at least once every three hours of continuous interaction. Operators must offer minors tools to manage privacy and account settings. Parents or guardians must get those tools for children under 13 and, as appropriate based on relevant risks, for other minors. The requirements apply starting July 1, 2027.

Operators must take reasonable steps to prevent specified responses to minors and must not give them unpredictable rewards to increase engagement. The requirements apply to operators of covered conversational AI services and their minor account holders. The steps must address sexually explicit images, encouragement of sexual conduct, and sexual objectification of a minor. They must also address statements that make the service seem human, including simulated emotional dependence, romance, sexual innuendo, or an adult-minor romantic relationship. The requirements apply starting July 1, 2027.

Operators must disclose that a service is AI when a reasonable person would think they are interacting with a human. This applies when a reasonable person interacting with a covered conversational AI service would believe they are interacting with a human. The notice must stay visible or appear after every three hours of continuous interaction. The requirement applies starting July 1, 2027.

Operators must adopt a response plan for suicide or self-harm prompts and must not knowingly and intentionally present their service as licensed mental health care. These requirements apply to operators of covered conversational AI services and their users. The plan must include reasonable efforts to refer users to crisis services, such as a suicide hotline or crisis text line. The restriction covers claims that the service provides psychology or behavioral health services that require a professional license. The requirements apply starting July 1, 2027.

The attorney general must enforce the rules, and violations can lead to injunctions and financial liability. These enforcement rules apply to operators that violate the chapter. Liability is the greater of actual damages or a $1,000 civil penalty per violation, with civil penalties capped at $500,000 per operator. The law does not create a private right to sue under this chapter or another law. A model developer is not liable solely because a third party used its model to create or train a conversational AI service. The enforcement rules apply starting July 1, 2027.