Deploys a chatbot, in Iowa

Iowa Code ch. 554G (554G.1 to 554G.4, added by 2023 Acts, ch. 63 (H.F. 553)) · Read the law's page

• This affirmative defense is available to a covered entity, a business, defined to include a financial institution and an entity organized under chapter 28E, that accesses, receives, stores, maintains, communicates, or processes personal information or restricted information in or through a system, network, or service located in or outside Iowa; a municipality is excluded from the definition of business, and the chapter creates no independent duty to adopt a cybersecurity program.
• To claim the defense against a tort claim alleging that a failure to implement reasonable information security controls resulted in a data breach of personal information or restricted information, create, maintain, and comply with a written cybersecurity program containing administrative, technical, operational, and physical safeguards, designed to continually evaluate and mitigate reasonably anticipated threats, evaluate the maximum probable loss from a data breach at least annually, and communicate to affected parties the extent of any risk and steps to reduce damages once a breach is known to have occurred.
• Fund the program at a scale and scope that is appropriate if the cost to operate it is no less than the covered entity's most recently calculated maximum probable loss value.
• Satisfy the framework requirement by reasonably conforming the program to a named industry-recognized cybersecurity framework (the NIST framework for improving critical infrastructure cybersecurity, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, or the ISO/IEC 27000 family), or, where already regulated under one, by conforming the program to the entirety of HIPAA's Security Rule, Gramm-Leach-Bliley Title V, the federal Information Security Modernization Act of 2014, HITECH, Iowa's own Insurance Data Security Act (chapter 507F), or applicable federal critical-infrastructure-protection rules, or by combining PCI Data Security Standard compliance with one of the named frameworks; conform the program to a revised framework or amended regulation within one year of its publication or effective date.
• This section creates no private right of action, including a class action, for a person's failure to comply with it: it is a defense available in litigation another statute or the common law already permits, never an independent basis to sue.

Iowa Code ch. 554J (2026 Iowa Acts, ch. 1068) · Read the law's page

• Disclose clearly and conspicuously to a minor account holder that they are interacting with artificial intelligence, using a persistent visible disclaimer or a disclaimer at the start of each interaction and at least once every three hours of continuous use.
• Disclose to any user that the service is artificial intelligence whenever a reasonable person interacting with it could otherwise believe they are talking to a human.
• Do not give a minor user points or similar rewards at unpredictable intervals meant to increase engagement.
• Take reasonable measures to prevent the service from producing sexual content involving a minor account holder, urging a minor toward sexual conduct, or sexually objectifying a minor account holder.
• Take reasonable measures to prevent the service from claiming to be sentient or human, or simulating a romantic, sexual, or emotionally dependent relationship with a minor account holder.
• Offer minor account holders, and the parents or guardians of minors under thirteen, tools to manage the minor's privacy and account settings.
• Adopt a protocol for responding to a user's expressions of suicidal ideation or self-harm, including referral to crisis services.
• Do not represent that the service provides licensed psychology or behavioral health services.