EveryAILaw.comDoes Iowa Conversational AI Services Act (SF 2417) require Risk Assessment?
Iowa • enacted
Yes — 2 provisions
Requirements at a glance
This regulation imposes 6 specific requirements for Risk Assessment across 2 provisions:
- No variable-reward engagement mechanics — Do not provide a minor user with points or similar rewards at unpredictable intervals with the intent to encourage increased engagement with the service (§ 554J.2(2))
- Reasonable measures against sexual depictions — Institute reasonable measures to prevent the service from producing visual depictions of sexually explicit material for minor account holders (§ 554J.2(3)(a))
- Reasonable measures against solicitation — Institute reasonable measures to prevent the service from stating that a minor account holder should engage in sexually explicit conduct (§ 554J.2(3)(b))
- Reasonable measures against objectification — Institute reasonable measures to prevent the service from sexually objectifying a minor account holder (§ 554J.2(3)(c))
- Adopt a protocol — Adopt protocols for the conversational AI service for responding to user prompts regarding suicidal ideation or self-harm (§ 554J.4)
- Crisis referral — The protocol must include making reasonable efforts to refer the user to crisis service providers such as a suicide hotline, crisis text line, or other appropriate crisis service (§ 554J.4)
Minor Engagement and Sexual Content Safeguards #
The variable-reward bar in § 554J.2(2) is the first US AI statute to regulate an engagement mechanic rather than an output. It borrows the language of intermittent reinforcement — "points or similar rewards at unpredictable intervals" — and is gated on intent to encourage increased engagement, which makes internal growth documents the natural evidence. Note the drafting asymmetry: § 554J.2(2) reaches a "minor user" while § 554J.2(3) reaches a "minor account holder", so the reward bar plausibly applies without an account.
Requirements
| Requirement | Details |
|---|---|
| No variable-reward engagement mechanics | Do not provide a minor user with points or similar rewards at unpredictable intervals with the intent to encourage increased engagement with the service (§ 554J.2(2)) |
| Reasonable measures against sexual depictions | Institute reasonable measures to prevent the service from producing visual depictions of sexually explicit material for minor account holders (§ 554J.2(3)(a)) |
| Reasonable measures against solicitation | Institute reasonable measures to prevent the service from stating that a minor account holder should engage in sexually explicit conduct (§ 554J.2(3)(b)) |
| Reasonable measures against objectification | Institute reasonable measures to prevent the service from sexually objectifying a minor account holder (§ 554J.2(3)(c)) |
Penalties
| Violation | Fine |
|---|---|
| Any violation of chapter 554J | Injunction plus the greater of actual damages or a civil penalty of $1,000 per violation, capped at $500,000 per operator (§ 554J.6(1)) |
| Enforcement | Attorney General only; no private right of action (§ 554J.6(2), § 554J.6(4)) |
Suicide and Self-Harm Response Protocol #
Compare California SB 243 § 22602(b), which makes the protocol a precondition on operating at all and requires publication on the operator's website. Iowa requires only that the protocol be adopted: no gate, no publication, no annual reporting to a public-health body. The floor is lower, and there is no plaintiff-facing document — the Attorney General would have to ask for the protocol to see it.
Requirements
| Requirement | Details |
|---|---|
| Adopt a protocol | Adopt protocols for the conversational AI service for responding to user prompts regarding suicidal ideation or self-harm (§ 554J.4) |
| Crisis referral | The protocol must include making reasonable efforts to refer the user to crisis service providers such as a suicide hotline, crisis text line, or other appropriate crisis service (§ 554J.4) |
Penalties
| Violation | Fine |
|---|---|
| Any violation of chapter 554J | Injunction plus the greater of actual damages or a civil penalty of $1,000 per violation, capped at $500,000 per operator (§ 554J.6(1)) |
| Enforcement | Attorney General only; no private right of action (§ 554J.6(2), § 554J.6(4)) |