Law / United States / 
Iowa
Conversational AI Services Act (Senate File 2417)
Iowa Code ch. 554J (2026 Iowa Acts, ch. 1068)
An AI transparency rule binding public and private bodies.
- Enforcement body
- Iowa Attorney General
- Obligation class
- Content labelling, Design code
- Audit expectation
- none
What it requires
- Disclose clearly and conspicuously to a minor account holder that they are interacting with artificial intelligence, using a persistent visible disclaimer or a disclaimer at the start of each interaction and at least once every three hours of continuous use.NIST AI RMFMEASURE 2.8
- Disclose to any user that the service is artificial intelligence whenever a reasonable person interacting with it could otherwise believe they are talking to a human.NIST AI RMFMEASURE 2.8
- Do not give a minor user points or similar rewards at unpredictable intervals meant to increase engagement.NIST AI RMFMAP 1.6
- Take reasonable measures to prevent the service from producing sexual content involving a minor account holder, urging a minor toward sexual conduct, or sexually objectifying a minor account holder.NIST AI RMFMAP 1.6
- Take reasonable measures to prevent the service from claiming to be sentient or human, or simulating a romantic, sexual, or emotionally dependent relationship with a minor account holder.NIST AI RMFMAP 1.6
- Offer minor account holders, and the parents or guardians of minors under thirteen, tools to manage the minor's privacy and account settings.NIST AI RMFMAP 1.6
- Adopt a protocol for responding to a user's expressions of suicidal ideation or self-harm, including referral to crisis services.NIST AI RMFMEASURE 2.6
- Do not represent that the service provides licensed psychology or behavioral health services.NIST AI RMFMAP 3.3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-03Dangerous, Violent, or Hateful Content
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
An operator that violates the chapter is liable for the greater of actual damages or this per-violation civil penalty, capped in aggregate per operator. The chapter's applicability section sets as the date from which its duties apply.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 500,000
- Per violation unit
- Violation
- Per violation amount
- 1,000
What it makes you log
Logging duty
The chapter requires disclosures to users, behavioral restrictions on the conversational AI service, and a suicide and self-harm response protocol, but no section requires an operator to create, keep, or produce a log or record of an interaction, a disclosure given, or a protocol's own operation. The attorney general's rulemaking and enforcement authority is a general civil-penalty power, not a document-production or inspection clause naming a record.
- Kind
- None
- As of
What this law does
An operator of a conversational AI service accessible to the public must clearly and conspicuously disclose to a minor account holder that the minor is interacting with artificial intelligence, and must disclose to any user that the service is artificial intelligence whenever a reasonable person could otherwise believe they are interacting with a human.
An operator may not give a minor user points or similar rewards at unpredictable intervals intended to increase engagement, must take reasonable measures to prevent the service from producing sexual content involving a minor account holder, urging a minor toward sexual conduct, sexually objectifying a minor, claiming to be sentient or human, or simulating a romantic or emotionally dependent relationship with a minor.
An operator must offer minor account holders, and the parents or guardians of minors under thirteen, tools to manage privacy and account settings, must adopt a protocol for responding to suicidal ideation or self-harm, and may not represent that the service provides licensed psychology or behavioral health services.
The Act was signed into law on as 2026 Iowa Acts chapter 1068, but its own applicability section defers every duty in the chapter to , and it does not create a private right of action.
The chapter does not limit an operator to a private actor, and Iowa's general definitions statute includes a government or governmental subdivision or agency within the word person unless a chapter otherwise provides, so a government body operating a covered conversational AI service is bound in the same way as a private one.
When LexLint raises it
When your app profile says your app deploys a chatbot, generates content with AI, serves under-18s or processes voice recordings.
Back to the example · Lint your app
Page updated .