Iowa AI Laws and Regulation (2026)

Iowa regulates AI through targeted legislation rather than a single comprehensive statute. Senate File 2243 and House File 2240, both effective July 1, 2024, address AI-generated sexual imagery of an identifiable minor and non-consensual synthetic intimate images of a recognizable adult. In 2026 Iowa added Senate File 2417, its first act to regulate AI services by name, and House File 2635, which limits AI in insurance prior authorization. State agencies follow an Enterprise Generative AI Policy effective March 31, 2025.

Iowa does not have a single comprehensive artificial intelligence law. Instead, the state addresses AI through a combination of targeted legislation, executive policy, and existing consumer protection and employment statutes. As of September 2026, Iowa has enacted deepfake-specific criminal provisions, a conversational AI services act, a limit on AI in insurance prior authorization, and a statewide generative AI policy for government use.

This guide covers Iowa's enacted AI laws, the AI bills that moved through the 91st General Assembly without passing, and how federal AI policy affects Hawkeye State residents and businesses.

This article is for informational purposes only and does not constitute legal advice. Consult a licensed Iowa attorney for guidance on specific situations.

Iowa's Enacted Deepfake Laws

Iowa's first AI-related legislation targeted deepfakes. In 2024, the Iowa General Assembly passed two bills, both signed into law and effective July 1, 2024. Neither created a standalone AI crime. Each extended an existing offense so that it reaches a manipulated image of a real, recognizable person.

SF 2243: AI-Generated Sexual Content Involving Minors

Senate File 2243 added synthetic imagery to Iowa's sexual exploitation of a minor statute, Iowa Code section 728.12. The law expanded the definition of a "visual depiction of a minor" so that it includes a depiction "created, adapted, or modified to give the appearance that an identifiable minor is engaged in a prohibited sexual act."

That reach is narrower than the law is often described as being. Section 728.12(3)(f) defines an "identifiable minor" as a person who was a minor when the depiction was created, adapted, or modified, or whose image as a minor was used in creating it, and who "is recognizable as an actual person by the person's face, likeness, or other distinguishing features." Wholly synthetic imagery that is not built from a real, recognizable child does not meet that definition. Prosecutors do not have to prove the identifiable minor's actual identity, but the depiction still has to show a recognizable person.

The expanded definition is also written "for purposes of this subsection," meaning subsection 3 of section 728.12: knowingly purchasing or possessing such a depiction. A violation of subsection 3 is a class D felony for a first offense and a class C felony for a second or subsequent offense, and depictions of different minors are charged as separate offenses.

Because the definition is limited that way, it does not extend to subsection 1 of section 728.12 (causing a minor to engage in a prohibited sexual act for a visual depiction, a class B felony) or subsection 2 (knowingly promoting material depicting a live performance by a minor, a class C felony). Those subsections still turn on conduct involving an actual minor.

HF 2240: Non-Consensual Synthetic Intimate Images

House File 2240 addressed non-consensual synthetic intimate content of adults by amending Iowa's harassment statute, Iowa Code section 708.7.

Under section 708.7(1)(a)(5), a person commits harassment when, with intent to intimidate, annoy, or alarm another person, that person disseminates, publishes, distributes, or posts a visual depiction showing another person in a state of full or partial nudity or engaged in a sex act, to which the other person has not consented. HF 2240's contribution is the definition that follows: "another person" includes an individual, recognizable by the person's face, likeness, or other distinguishing features, whose image is used to create, adapt, or modify the depiction. That language is what brings deepfakes and other digital manipulations inside the statute, and it is also what leaves a fabricated image of no recognizable person outside it.

The penalty is fixed rather than scaled by severity. Any violation of section 708.7(1)(a)(5) is harassment in the first degree under section 708.7(2)(a)(2), and section 708.7(2)(b) makes harassment in the first degree an aggravated misdemeanor. A person eighteen years of age or older who violates that subparagraph is required to register as a sex offender under chapter 692A. Section 708.7(5) exempts a juvenile convicted under the same subparagraph from that registration requirement.

The statute also lists conduct that does not constitute a violation: a photograph or film involving voluntary exposure in public or commercial settings, disclosures made in the public interest such as news reporting or the reporting of unlawful conduct, and disclosures by an interactive computer service of information provided by another content provider.

Federal Deepfake Law: The TAKE IT DOWN Act

In addition to Iowa's state laws, the federal TAKE IT DOWN Act signed by President Trump makes it a federal crime to publish or threaten to share non-consensual intimate images, including AI-generated deepfakes. The law requires social media platforms to remove such content within 48 hours of being notified by a victim, adding a second layer of protection for Iowa residents.

Iowa's 2026 AI Statutes

The 91st General Assembly enacted two AI-specific measures in its 2026 session.

SF 2417: Conversational AI Services

Senate File 2417 is Iowa's first act to regulate artificial intelligence services by name. The Governor signed it on May 2, 2026. It creates a new Iowa Code chapter 554J and, by its own terms, applies beginning July 1, 2027.

The chapter covers a "conversational AI service," which it defines as an artificial intelligence available by software application, web interface, or computer program that is accessible to the general public and has the primary purpose of simulating human conversation and interaction through text, audio, or visual communication. The definition excludes tools primarily designed for research and development, features that are not primarily conversational, tools limited to a narrow and discrete topic, business customer-service tools, consumer voice assistants, and tools a business uses solely internally.

Disclosure is required. An operator must clearly and conspicuously disclose that the service is artificial intelligence, using a persistent visible disclaimer or a disclaimer that appears after every three hours of continuous interaction, whenever a reasonable individual would believe they were interacting with a human. For a minor account holder, the disclaimer must appear at the beginning of each interaction and at least once every three hours of continuous interaction.

Minor account holders get specific protections. An operator may not provide a minor with points or similar rewards at unpredictable intervals with the intent to encourage increased engagement. Operators must institute reasonable measures to prevent the service from producing visual depictions of sexually explicit material for minor account holders, telling a minor to engage in sexually explicit conduct, or sexually objectifying a minor. Operators must also take reasonable measures against output that would lead a reasonable person to believe they are talking to a human, including explicit claims of sentience, simulated emotional dependence, simulated romantic interaction or sexual innuendo, and role-playing an adult-minor romantic relationship. Operators must offer privacy and account settings tools to minor account holders, and to the parent or guardian of an account holder under thirteen.

Crisis and mental health protocols are mandatory. An operator must adopt protocols for responding to prompts regarding suicidal ideation or self-harm, including making reasonable efforts to refer the user to a suicide hotline, crisis text line, or other appropriate crisis service. An operator may not knowingly and intentionally program the service to represent that it provides professional psychology or behavioral health services requiring licensure under chapter 154B or 154D.

The attorney general enforces the chapter. A violating operator is subject to an injunction and liable for the greater of actual damages or a civil penalty of $1,000 per violation, up to a maximum of $500,000 per operator. Penalties are deposited in the state general fund. The chapter creates no private right of action, and it does not make a model developer liable solely because a third party used the developer's model to create or train a conversational AI service.

HF 2635: AI in Insurance Prior Authorization

House File 2635 limits how utilization review organizations use AI in prior authorization decisions. The Governor signed it on May 13, 2026, and it took effect July 1, 2026.

The AI provision is a new subsection 2A of Iowa Code section 514F.8. A utilization review organization may use an artificial intelligence-based algorithm or system to provide an initial review of a prior authorization request. For a request based on medical necessity, however, the organization "shall not use an artificial intelligence-based algorithm or system as the sole basis" for its decision to deny, delay, or downgrade the request. The act separately defines a "downgrade" as changing an expedited or urgent request to a standard determination, or otherwise modifying the requested service to a lower-level service, and it adds audit notice and turnaround deadlines for utilization review organizations.

Enforcement runs through the insurance code. New section 514F.8E provides that the remedy for noncompliance is the remedies authorized by chapters 505 and 507B, and that on a finding of a pattern or practice of noncompliance the commissioner of insurance may suspend a utilization review organization's authority to conduct utilization review.

This is the measure the Senate started as Senate Study Bill 3118. That study bill was renumbered Senate File 2421 on February 19, 2026. HF 2635 was substituted for SF 2421 in the Senate on March 4, 2026 and SF 2421 was withdrawn the same day, so HF 2635 is the bill that became law. SSB 3118 was never itself enacted.

Iowa's Generative AI Policy for State Government

The Iowa Department of Management issued an Enterprise Generative Artificial Intelligence Policy with an effective date of March 31, 2025. This interim policy establishes minimum requirements and prohibited uses for all state agencies and supported entities.

Key Requirements Under the Policy

The state AI policy includes several mandatory provisions for government employees and contractors.

Human review is required. Before finalizing any AI-generated output, state employees must subject it to thorough human evaluation. AI-generated content cannot be used verbatim, treated as the sole source of reference, or used as the sole basis for final business decisions.

Protected data restrictions apply. Sensitive and protected data must not be used to train an AI tool, submitted into an AI system, or utilized by an AI tool without prior written authorization from the Department of Management.

AI-generated code must be marked. If AI is used to write any portion of code for state systems, that section must be clearly marked with comments noting where AI-created code starts and stops. AI-generated code cannot be protected with intellectual property rights.

Human fallback systems are mandatory. If AI tools fail or do not meet business needs, state agencies must have human fallback systems in place to ensure continuity of services.

Prohibited Uses

The policy expressly prohibits the use of freely available AI tools by state agencies without prior written approval from the Department of Management. This means state employees cannot use consumer-facing tools like ChatGPT or Google Gemini for work purposes unless specifically authorized.

AI Bills That Did Not Become Law

Several AI bills drew attention in the 91st General Assembly without reaching the Governor's desk. They are worth knowing because they map where Iowa's next AI debate is likely to start.

HSB 294: Election AI Disclosure and Algorithmic Discrimination

House Study Bill 294 was a two-part bill addressing AI in elections and algorithmic discrimination.

Division I: Election Materials. The bill would have required that any published material generated using AI and designed to advocate for or against a candidate or ballot issue include a disclosure stating: "this material was generated using artificial intelligence." A person who willfully violated the requirement would be guilty of a serious misdemeanor.

Under Iowa law, a serious misdemeanor is punishable by up to one year in jail and a fine of between $430 and $2,560.

Division II: Algorithmic Discrimination. The bill also defined algorithmic discrimination as any use of an AI system that results in unfavorable treatment based on an individual's actual or perceived age, race, creed, color, sex, sexual orientation, national origin, religion, or disability. This provision would have created a framework for addressing bias in automated decision-making systems.

The bill defined "artificial intelligence" as a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments. The official bill history records a committee report recommending passage on March 6, 2025 and no action after that.

HSB 643 and HF 2609: Synthetic Media in Campaign Materials

House Study Bill 643, relating to the use of synthetic media in campaign materials, was renumbered House File 2609 on February 19, 2026 and passed the House 89-2 on March 12, 2026. The Senate referred it to its State Government Committee on March 16, 2026 and assigned a subcommittee the next day. The bill history records no further action, so the bill did not become law.

SSB 3014: Limiting AI in State Employment Decisions

Senate Study Bill 3014 would have restricted how state agencies use AI in employment-related decisions. The bill included several key provisions.

AI employment decisions prohibited. State agencies would have been prohibited from using AI in matters that affect an employee's employment status, bargaining rights, wages, transfers, or eligible hours.

AI inventory requirement. State agencies would have been required to establish and maintain an inventory of AI systems they use.

Public disclosure mandated. Agencies would have needed to publish a list of automated employment decision-making tools on their websites within 90 days of first using each tool.

Annual reporting. Each agency would have submitted an annual report on AI usage to the General Assembly by January 1.

A subcommittee recommended passage on January 27, 2026, and the official bill history records no action after that. Labor unions representing state employees registered in favor of the bill, while technology groups and business entities expressed interest without taking a formal position.

HSB 766: Autonomous AI in Healthcare

House Study Bill 766 would have created a licensing system for providers of autonomous AI medical services. The bill was notable because it would have allowed AI systems to operate without direct human supervision in healthcare settings.

The bill defined "fully autonomous AI" as artificial intelligence authorized to diagnose, treat, or prescribe without the need for human supervision or intervention. It would have created a new licensing category for AI-augmented and autonomous service providers.

Proponents argued that autonomous AI could help close healthcare gaps in underserved and rural areas of Iowa. The Cicero Institute, a conservative policy think tank, provided the model legislation and testified in support.

Opponents, including the Iowa Independent Physician Group, raised concerns about the lack of physician oversight and argued that existing professional licensing boards already have regulations that evolve with medical technology.

A subcommittee recommended passage on March 24, 2026, and the official bill history records no action after that.

How Existing Iowa Law Applies to AI

While Iowa lacks a comprehensive AI statute, several existing laws affect how AI systems operate within the state.

Consumer Protection

Iowa's Consumer Fraud Act (Chapter 714H) prohibits unfair and deceptive business practices. This broad prohibition applies to AI-driven business practices that mislead consumers, including deceptive AI chatbots, AI-generated fake reviews, or AI systems that make false claims about products or services.

Consumers who suffer ascertainable losses from deceptive AI practices can bring private actions under Chapter 714H to recover actual damages and attorney's fees.

Employment Discrimination

Iowa's Civil Rights Act (Chapter 216) prohibits employment discrimination based on protected characteristics. When employers use AI tools for hiring, promotion, or termination decisions, those tools must comply with existing anti-discrimination requirements.

If an AI hiring tool produces disparate impact on protected groups, the employer faces liability under the same framework that applies to human-made decisions. The Iowa Civil Rights Commission has enforcement authority over these claims.

Data Privacy

The Iowa Consumer Data Protection Act (ICDPA), which took effect January 1, 2025, gives consumers rights over their personal data. While the ICDPA does not specifically address AI, it applies to AI systems that process consumer data.

Under the ICDPA, consumers have the right to access, delete, and opt out of the sale of their personal data. AI systems that collect and process personal data must comply with these requirements, including providing clear privacy notices and honoring consumer requests.

How Federal AI Policy Affects Iowa

Federal AI policy creates additional layers of regulation that apply in Iowa alongside state law.

Executive Orders and Agency Guidance

President Biden's Executive Order 14110 on AI safety, issued in October 2023, directed federal agencies to develop AI standards and safety testing requirements. While the Trump administration has shifted federal AI policy toward a lighter regulatory approach, many of the testing and reporting requirements established under EO 14110 continue through agency-level implementation.

FTC Enforcement

The Federal Trade Commission has actively enforced against deceptive AI practices using its existing Section 5 authority. The FTC has warned companies against making unfounded claims about AI capabilities, using AI to generate fake reviews, and deploying AI in ways that cause substantial consumer harm. These federal enforcement actions apply to businesses operating in Iowa.

Sector-Specific Federal Rules

Iowa businesses in regulated industries face additional AI requirements from federal agencies. Financial institutions must comply with fair lending requirements when using AI for credit decisions. Healthcare providers using AI diagnostic tools must meet FDA clearance requirements. Employers using AI hiring tools must ensure compliance with EEOC guidance on algorithmic fairness.

Iowa AI Use in Government Operations

Beyond regulating AI, Iowa has been an early adopter of AI tools in government operations.

Legislative AI Tools

The Iowa Legislature used an AI program during its 2025 session to help lawmakers track and evaluate bills, becoming one of the first state legislatures to deploy AI for legislative analysis. The tool helped legislators and staff manage the volume of bills introduced each session.

Attorney General's Office

Iowa Attorney General Brenna Bird has been vocal about deepfake dangers, particularly regarding risks to students. The AG's office has issued consumer warnings about deepfake scams and provides guidance on how parents can protect children from AI-generated exploitation material.

Penalties Summary

Looking Ahead: Iowa's AI Regulatory Future

Iowa's approach to AI regulation is evolving. The 2026 session produced the state's first two AI-specific statutes, and the compliance date for the conversational AI chapter is still ahead: chapter 554J does not apply until July 1, 2027, which gives operators a full year to build disclosure, minor-protection, and crisis-referral systems before the attorney general can enforce it.

The bills that stalled point to the likely next round. Election disclosure has now cleared one chamber once (HF 2609 in March 2026), which usually means it returns. The state employment AI bill (SSB 3014) reflects continuing concern about AI replacing human judgment in workplace decisions, and the autonomous AI healthcare bill (HSB 766) would make Iowa one of the first states to license AI medical providers if it is reintroduced.

Iowa's Technology Association has established an AI Policy Subcommittee to guide the state's innovation future, signaling that the private sector is also preparing for increased regulation.

More Iowa Laws

• Iowa Data Privacy Laws
• Iowa Data Breach Notification Laws
• Iowa Biometric Privacy Laws
• Iowa Surveillance Camera Laws
• Iowa Background Check Laws
• Iowa Whistleblower Laws
• Iowa Sexting Laws