Iowa — AI Duty Profile (Synthetic Media SF 2243 + HF 2240; IID Bulletin 24-04; AI Utilization-Review Limits, Iowa Code §§ 514F.8(2A), 514F.8A): AI Compliance Requirements

If your AI system can generate images, video, or audio content: implement and document a content safety policy prohibiting the generation of sexual content depicting minors (explicitly covered by SF 2243) and non-consensual intimate imagery (HF 2240). This applies to any AI image/video/audio generator accessible to Iowa users.

Iowa enacted a binding statutory limit on AI in utilization review in 2026 — this is law, not guidance, and it is already in force. House File 2635 (2026 Iowa Acts ch. 1087) added a new subsection 2A to Iowa Code § 514F.8, transcribed verbatim from the enrolled text: "A utilization review organization may use an artificial intelligence-based algorithm or system to provide an initial review of a request for prior authorization, except that, for a prior authorization request for a health care service based on medical necessity, a utilization review organization shall not use an artificial intelligence-based algorithm or system as the sole basis for the utilization review organization's decision to deny, delay, or downgrade the prior authorization request." Read the permission and the bar together. AI-assisted INITIAL review is expressly allowed, so this is not a prohibition on automation; what is barred is AI as the SOLE basis for an adverse outcome on a MEDICAL-NECESSITY request. The barred outcomes are three, not one — "deny, delay, or downgrade" — and delay is the one most often overlooked, so an automated pend-and-requeue that an algorithm triggers unaided is within the bar. "Downgrade" was newly defined by the same act at § 514F.8(1)(0b): "a decision by a utilization review organization to change an expedited or urgent request for prior authorization to a standard determination, or otherwise modify a health care service that is the subject of a request for prior authorization to a lower-level health care service." Compliance evidence is the practical burden: an organization must be able to show, per adverse decision, what the human contribution to it actually was.

Iowa Code § 514F.8A, created by the same 2026 act, is what gives § 514F.8(2A) its teeth: it makes the human decision-maker identifiable, credentialled and accountable in writing. From 1 January 2027 a utilization review organization "shall not deny or downgrade a request for prior authorization unless all of the following requirements are met". First, the decision must be made by a "qualified reviewer" where the requesting provider is a physician, or a "clinical peer" where the requesting provider is not. A "qualified reviewer" is a physician (defined as "a doctor of medicine and surgery, or a doctor of osteopathic medicine and surgery, licensed under chapter 148") who practises in the same or a similar specialty as the requesting provider, has the training and expertise to treat the specific condition "including sufficient knowledge to determine whether the health care service that is the subject of the request is medically necessary or clinically appropriate", and is employed by or contracted with the utilization review organization. A "clinical peer" is the equivalent non-physician health care professional. Second, the organization must provide the requesting provider: (1) a written statement citing the specific reasons for the denial or downgrade "including any coverage criteria or limits, or clinical criteria, that the utilization review organization considered or that was the basis for the denial or downgrade", which "must be signed by" the very qualified reviewer or clinical peer who made the determination; (2) a written explanation of the appeals process, which must also go to the covered person; and (3) a written attestation that the reviewer practised in the same or similar specialty and had the requisite training and expertise, and which "shall include the qualified reviewer's board certifications, specialty expertise, and educational background, excluding any personal identifiable information". Third, on the requesting provider's request the organization must convene a consultation between that provider and the qualified reviewer or clinical peer "no later than seven business days after the date that the utilization review organization notifies the requesting health care provider of the denial". Fourth, any appeal must itself be conducted by a qualified reviewer or clinical peer, and — the separation rule — "[a] qualified reviewer or clinical peer involved in the initial denial or downgrade determination of a request for prior authorization that is the subject of an appeal shall not conduct the appeal"; on appeal the reviewer "shall consider the known clinical aspects of the health care services under review, including but not limited to medical records relevant to the covered person's medical condition ... and any relevant medical literature submitted by the health care provider as part of the appeal."

AI content platforms serving Iowa users should implement: (1) Technical controls preventing generation of prohibited AI content. (2) Detection systems to identify and remove prohibited synthetic media. (3) A reporting mechanism for users to flag prohibited content. (4) Clear user terms of service prohibiting creation of prohibited content. Document these procedures for law enforcement cooperation if required.

Iowa adopted the NAIC model AI bulletin as Commissioner's Bulletin 24-04 on 7 November 2024. Section IV states the expectation in terms: "all Insurers authorized to do business in Iowa are expected to develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that make, or support, decisions related to regulated insurance practices," and "[t]he AIS Program should be designed to mitigate the risk of Adverse Consumer Outcomes, including, at a minimum, the statutory provisions set forth in Section II of this Bulletin." The Section V general guidelines set the programme's shape: § 1.2 it should address "governance, risk management controls, and internal audit functions"; § 1.3 it should vest responsibility for development, implementation, monitoring and oversight, and for setting AI strategy, "with senior management accountable to the board or an appropriate committee of the board"; § 1.5 it "may be independent of or part of the Insurer's existing Enterprise Risk Management (ERM) program" and may adopt a third-party framework, naming "the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework, Version 1.0"; § 1.6 it should cover the whole insurance life cycle — "product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, and fraud detection"; § 1.7 it should cover all life-cycle phases "including design, development, validation, implementation (both systems and business), use, on-going monitoring, updating, and retirement"; and § 1.8 it reaches AI Systems "whether developed by the Insurer or a third-party vendor". § 1.9 is the consumer-facing duty and is easy to miss: the programme "should include processes and procedures providing notice to impacted consumers that AI Systems are in use and provide access to appropriate levels of information based on the phase of the insurance life cycle in which the AI Systems are being used."

Bulletin 24-04 Section V group 2 (Governance) expects the AIS Program to "include a governance framework for the oversight of AI Systems used by the Insurer" that prioritises "transparency, fairness, and accountability in the design and implementation of the AI Systems, recognizing that proprietary and trade secret information must be protected". An insurer "may consider adopting new internal governance structures or rely on the Insurer's existing governance structures", but in developing a new framework should address four items. § 2.1: the policies, processes and procedures — "including risk management and internal controls" — to be followed at each stage of an AI System life cycle, "from proposed development to retirement". § 2.2: the requirements adopted to document compliance with the AIS Program's policies, processes, procedures and standards, expressly noting that "[d]ocumentation requirements should be developed with Section VI, Regulatory Oversight and Examination Considerations, in mind" — that is, authored in advance so the examination production list can actually be answered. § 2.3: the internal AI System governance accountability structure, itemised as (a) "[t]he formation of centralized, federated, or otherwise constituted committees comprised of representatives from appropriate disciplines and units within the Insurer, such as business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance, and legal"; (b) "[s]cope of responsibility and authority, chains of command, and decisional hierarchies"; (c) "[t]he independence of decision-makers and lines of defense at successive stages of the AI System life cycle"; (d) "[m]onitoring, auditing, escalation, and reporting protocols and requirements"; and (e) "[d]evelopment and implementation of ongoing training and supervision of personnel". § 2.4 adds a predictive-model-specific governance duty: "the Insurer's processes and procedures for designing, developing, verifying, deploying, using, updating, and monitoring Predictive Models, including a description of methods used to detect and address errors, performance issues, outliers, or unfair discrimination in the insurance practices resulting from the use of the Predictive Model."

Bulletin 24-04 Section V group 3 (Risk Management and Internal Controls) expects the AIS Program to "document the Insurer's risk identification, mitigation, and management framework and internal controls for AI Systems generally and at each stage of the AI System life cycle", addressing seven items. § 3.1: "[t]he oversight and approval process for the development, adoption, or acquisition of AI Systems, as well as the identification of constraints and controls on automation and design to align and balance function with risk." § 3.2: "[d]ata practices and accountability procedures, including data currency, lineage, quality, integrity, bias analysis and minimization, and suitability." § 3.3: management and oversight of predictive models (including the algorithms used in them), comprising (a) "[i]nventories and descriptions of Predictive Models", (b) "[d]etailed documentation of the development and use of the Predictive Models", and (c) assessments "such as interpretability, repeatability, robustness, regulator tuning, reproducibility, traceability, model drift, and the auditability of these measurements where appropriate". § 3.4: "[v]alidating, testing, and retesting as necessary to assess the generalization of AI System outputs upon implementation, including the suitability of the data used to develop, train, validate and audit the model", with the accepted method spelled out — "[v]alidation can take the form of comparing model performance on unseen data available at the time of model development to the performance observed on data post-implementation, measuring performance against expert review, or other methods." § 3.5: protection of non-public information, particularly consumer information, "including unauthorized access to the Predictive Models themselves". § 3.6: "[d]ata and record retention." § 3.7: for predictive models specifically, "a narrative description of the model's intended goals and objectives and how the model is developed and validated to ensure that the AI Systems that rely on such models correctly and efficiently predict or implement those goals and objectives."

Bulletin 24-04 Section V group 4 (Third-Party AI Systems and Data) expects each programme to address the insurer's process for acquiring, using or relying on "a) third-party data to develop AI Systems; b) AI Systems developed by a third party", through standards, policies, procedures and protocols covering three items. § 4.1: "[d]ue diligence and the methods employed by the Insurer to assess the third party and its data or AI Systems acquired from the third party to ensure that decisions made or supported from such AI Systems that could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the Insurer itself" — the operative principle being that buying the model does not move the legal standard off the insurer. § 4.2: "[w]here appropriate and available, the inclusion of terms in contracts with third parties that: a) Provide audit rights and/or entitle the Insurer to receive audit reports by qualified auditing entities. b) Require the third party to cooperate with the Insurer with regard to regulatory inquiries and investigations related to the Insurer's use of the third party's product or services." § 4.3: actually exercising those rights — "[t]he performance of contractual rights regarding audits or other activities to confirm the third party's compliance with contractual and, where applicable, regulatory requirements." § 4.3 is what makes an unexercised audit right a gap rather than a control: negotiating the clause and never invoking it does not satisfy the group.

Bulletin 24-04 Section VI tells insurers what the Division will ask for, and its opening sentence carries the sting: "Regardless of the existence or scope of a written AIS Program, in the context of an investigation or market conduct action an Insurer can expect to be asked about its development, deployment, and use of AI Systems, or any specific Predictive Model, AI System or application and its outcomes (including Adverse Consumer Outcomes), as well as any other information or documentation deemed relevant by the Division." Having no programme is therefore no shelter. Group 1 (governance, risk management and use protocols) lists, at § 1.1: (a) "[t]he written AIS Program"; (b) documentation evidencing its adoption; (c) "[t]he scope of the Insurer's AIS Program, including any AI Systems and technologies not included in or addressed by the AIS Program"; (d) how the programme is tailored and proportionate to use, to the risk of Adverse Consumer Outcomes and to the Degree of Potential Harm to Consumers; and (e) the policies, procedures, guidance and training materials, itemised into (i) development/adoption/acquisition processes including data governance, lineage, quality, integrity, bias analysis and minimisation and Data Currency, (ii) predictive-model management processes "including measurements, standards, or thresholds adopted or used by the Insurer in the development, validation, and oversight of models and AI Systems", and (iii) protection of non-public information. § 1.2 covers "pre-acquisition/pre-use diligence, monitoring, oversight, and auditing of data or AI Systems developed by a third party". § 1.3 covers implementation and compliance evidence, including (a) formation and ongoing operation of coordinating bodies, (b) data-practice documentation, (c) model management — "[t]he Insurer's inventories and descriptions of Predictive Models, and AI Systems used by the Insurer to make or support decisions that can result in Adverse Consumer Outcomes", and for any model under investigation, compliance documentation, data provenance information and "[i]nformation related to the techniques, measurements, thresholds, and similar controls used by the Insurer" — and (d) "[d]ocumentation related to validation, testing, and auditing, including evaluation of Model Drift". Group 2 adds, for third-party components, § 2.1 diligence records, § 2.2 the vendor contracts, § 2.3 audits or confirmation processes performed, and § 2.4 validation/testing/auditing documentation "including evaluation of Model Drift".