HF 2715 (LSB 5402HV (2) 91)

HOUSE FILE 2715

BY  COMMITTEE ON ECONOMIC GROWTH AND TECHNOLOGY

(SUCCESSOR TO HSB 647)

A BILL FOR

An Act relating to chatbots, including deployer requirements and interactions with minors.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  NEW SECTION.  554J.1  Definitions.
   1.  “AI companion” means a public-facing chatbot designed to simulate a human-like romantic or emotional bond.
   2.  “Artificial intelligence” means a machine-based system that, for any explicit or implicit objective, infers from the input the system receives to generate output that can influence physical or virtual environments.
   3.  a.  “Chatbot” means artificial intelligence that is described by all of the following:
   (1)  The artificial intelligence accepts open-ended, natural-language, or multimodal user input and produces adaptive or context-responsive output.
   (2)  The artificial intelligence produces new expressive content or responses that were not fully predetermined by the person who created or who operates the artificial intelligence.
   b.  “Chatbot” does not include a service limited to internal business operations or a service requiring user authentication through an employer, an educational institution, or a similar organization.
   4.  “Commercially reasonable” means a practice that is consistent with prevailing industry standards and proportionate to the size, resources, and technical capabilities of the person employing the practice.
   5.  “Deployer” means a person that makes an AI companion, a public-facing chatbot, or a therapeutic chatbot available to users in this state.
   6.  “Minor” means an individual who is under eighteen years of age.
   7.  “Output” means new content an artificial intelligence generates based on a user’s input in relation to the data used to train the artificial intelligence. “Output” includes but is not limited to audio-visual media, images, predictions, recommendations, and text.
   8.  a.  “Public-facing chatbot” means a chatbot intentionally made available to the general public or marketed directly to consumers for independent use without the ongoing supervision of the deployer or an institutional consumer.
   b.  “Public-facing chatbot” does not include any of the following:
   (1)  Software designed primarily for internal business operations.
   (2)  Enterprise software licensed to a specific business, nonprofit organization, or governmental entity.
   (3)  Chatbots used solely within the context of an existing customer relationship.
   (4)  Systems requiring authentication through an employer, educational institution, health care provider, or similar organization prior to use.
   9.  “Therapeutic chatbot” means a public-facing chatbot that is designed for the primary purpose of providing mental health support, counseling, or therapy by diagnosing, treating, mitigating, or preventing a mental health condition.
    Sec. 2.  NEW SECTION.  554J.2  Public-facing chatbots —— general deployer requirements.
   1.  A deployer of a public-facing chatbot shall do all of the following:
   a.  Implement and maintain protocols meant to detect, respond to, report, and mitigate harm the public-facing chatbot may cause a user in a manner that takes commercially reasonable steps to protect the safety and well-being of users.
   b.  Limit the collection and storage of user information collected by the public-facing chatbot to what is necessary to fulfill the deployer’s purpose for making the public-facing chatbot publicly available.
   c.  Clearly and conspicuously disclose each time the deployer’s public-facing chatbot begins an interaction with a user that the public-facing chatbot is artificial intelligence and is not licensed as a medical, legal, financial, or mental health professional.
   d.  At each three-hour interval of the deployer’s public-facing chatbot continuously interacting with a user, clearly and conspicuously disclose the public-facing chatbot is artificial intelligence and is not licensed as a medical, legal, financial, or mental health professional.
   e.  Implement protocols for the deployer’s public-facing chatbot for responding to user prompts indicating the user has suicidal ideations or the intent to cause self-harm. Protocols shall include but are not limited to making reasonable efforts to refer the user to crisis service providers such as a suicide hotline, crisis text line, or other appropriate service.
   2.  A deployer shall not knowingly or recklessly design or make a public-facing chatbot available that does any of the following:
   a.  Misleads a reasonable user into believing the public-facing chatbot is a specific human being.
   b.  Misleads a reasonable user into believing the public-facing chatbot is licensed by the state.
   c.  Encourages, promotes, or coerces a user to commit suicide, perform acts of self-harm, or engage in sexual or physical violence against a human or an animal.
    Sec. 3.  NEW SECTION.  554J.3  Chatbot interactions with minors.
   1.  a.  A deployer of an AI companion or a therapeutic chatbot shall implement commercially reasonable measures to determine whether a user is a minor. The measures must use a risk-based approach appropriate with the nature of the public-facing chatbot and the reasonably foreseeable harm that may come from using the public-facing chatbot.
   b.  Reasonable measures to determine whether a user is a minor may include self-attestation, technical measures, or other commercially reasonable approaches.
   c.  This section shall not be construed to require a deployer to verify a user’s age using government-issued identification.
   2.  A deployer of an AI companion or a therapeutic chatbot shall implement protocols for sending a notification to a minor user’s parent, legal guardian, or legal custodian when the minor user enters a prompt indicating the minor user has suicidal ideations or the intent to cause self-harm.
   3.  A deployer shall only make a therapeutic chatbot available for a minor’s use or purchase if all of the following apply:
   a.  The therapeutic chatbot was recommended for the minor’s use by an individual licensed under chapter 154B or 154D after performing an evaluation of the minor.
   b.  The therapeutic chatbot’s developer has significant documentation of how the public-facing chatbot was tested.
   c.  Peer-reviewed clinical trial data exists demonstrating the therapeutic chatbot would be a safe, effective tool for the minor’s diagnosis, treatment, mitigation, or prevention of a mental health condition.
   d.  The therapeutic chatbot’s deployer provided clear disclosures of the therapeutic chatbot’s functions, limitations, and data privacy policies to the individual recommending the therapeutic chatbot under paragraph “a”, and to the minor’s parents, guardians, or custodians.
   e.  The therapeutic chatbot’s deployer developed and implemented protocols for testing the therapeutic chatbot for risks to users, identifying possible risks the therapeutic chatbot poses to users, mitigating risks the therapeutic chatbot poses to users, and quickly rectifying harm the therapeutic chatbot may have caused a user.
   4.  A deployer shall not be liable for a user’s misrepresentation of age if the deployer has made commercially reasonable efforts to comply with this section.
    Sec. 4.  NEW SECTION.  554J.4  Enforcement.
   1.  The attorney general may bring an action on behalf of the state to enforce the provisions of this chapter and may seek an injunction for violations of this chapter.
   2.  a.  A court may issue a civil penalty of not more than two thousand five hundred dollars for each violation of this chapter, or seven thousand five hundred dollars if a person violates an injunction issued under this chapter.
   b.  Penalties assessed under this subsection shall be deposited into the general fund of the state.
   3.  a.  Prior to initiating a proceeding to obtain a civil penalty, the attorney general shall notify a person in violation of this chapter of the violation and give the person thirty calendar days from the date the attorney general notified the person to cure the violation.
   b.  This subsection shall not apply if a violation will cause imminent harm to a minor.
    Sec. 5.  NEW SECTION.  554J.5  Safe harbor.
   A deployer that makes commercially reasonable efforts to comply with this chapter shall not be subject to liability for unforeseeable or emergent outputs generated by the deployer’s public-facing chatbot.
    Sec. 6.  NEW SECTION.  554J.6  Construction.
   This chapter shall be narrowly interpreted to apply only to consumer-facing artificial intelligence. This chapter shall not be construed to regulate internal business technologies.
    Sec. 7.  LEGISLATIVE INTENT.  It is the intent of the general assembly to support innovation in artificial intelligence while establishing reasonable consumer protections for systems designed for independent public use.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill relates to public-facing chatbots (public chatbots).
   The bill defines “AI companion” as a chatbot designed to simulate human-like romantic or emotional bonds.
   The bill defines “deployer” as a person that makes an AI companion, a public chatbot, or a therapeutic chatbot available to users in this state.
   The bill defines “public-facing chatbot” as a chatbot intentionally made available to the general public or marketed directly to consumers for independent use without the ongoing supervision of the deployer or an institutional consumer.
   The bill defines “therapeutic chatbot” as a public chatbot that is designed for the primary purpose of providing mental health support, counseling, or therapy by diagnosing, treating, mitigating, or preventing a mental health condition.
   The bill also defines “artificial intelligence” (AI), “chatbot”, “commercially reasonable”, “minor”, and “output”.
   The bill requires a deployer to implement and maintain protocols meant to detect, respond to, report, and mitigate harm the deployer’s public chatbot may cause a user in a manner that takes commercially reasonable steps to protect the well-being of users; limit the collection and storage of user information collected by a public chatbot to what is necessary to fulfill the deployer’s purpose for making the public chatbot publicly available; clearly and conspicuously disclose the public chatbot is AI and not a licensed medical, legal, financial, or mental health professional at the beginning of the public chatbot’s interaction with a user and at three-hour intervals of continuous interaction with the user; and implement protocols to respond to user prompts indicating the user has suicidal ideations or the intent to cause self-harm.
   The bill prohibits deployers from knowingly or recklessly designing or making a public chatbot available if the public chatbot misleads a reasonable user into believing the public chatbot is a specific human being; misleads a reasonable user into believing the public chatbot is licensed by the state; or encourages, promotes, or coerces a user to commit suicide, perform acts of self-harm, or engage in sexual or physical violence against a human or an animal.
   The bill requires a deployer of an AI companion or a therapeutic chatbot to implement commercially reasonable measures to determine whether a user is a minor. The measures must use a risk-based approach appropriate with the nature of the public chatbot and the reasonably foreseeable harm that may come from using the public chatbot. Reasonable measures may include self-attestation, technical measures, or other commercially reasonable approaches, but the bill is not to be construed to require a deployer to verify a user’s age using government-issued identification.
   The bill requires a deployer of an AI companion or a therapeutic chatbot to implement protocols for sending a notification to a minor user’s parent, legal guardian, or legal custodian when the minor user enters a prompt indicating the minor user has suicidal ideations or the intent to cause self-harm.
   The bill prohibits a deployer from making a therapeutic chatbot available for a minor’s use or purchase unless the deployer meets requirements related to therapeutic chatbot use and safety as detailed in the bill.
   The bill provides that a deployer is not liable for a user’s misrepresentation of age if the deployer has made commercially reasonable efforts to comply with the bill.
   The bill authorizes the attorney general to bring actions on behalf of the state to enforce the bill and seek injunctions for violations of the bill.
   The bill allows a court to issue a civil penalty of not more than $2,500 for each violation of the bill, or $7,500 if the person violated an injunction issued under the bill. Civil penalties assessed under the bill shall be deposited into the general fund of the state.
   The bill requires the attorney general to notify a person in violation of the bill of the person’s violation and give the person 30 calendar days from the date the attorney general notified the person to cure the violation prior to the attorney general initiating a proceeding to obtain a civil penalty. However, the requirement to notify a person shall not apply if a violation will cause imminent harm to a minor.
   The bill provides that a deployer who makes commercially reasonable efforts to comply with the bill shall not be subject to liability for unforeseeable or emergent outputs generated by the deployer’s public chatbot.
   The bill shall be narrowly interpreted to apply only to consumer-facing AI. The bill shall not be construed to regulate internal business technologies.
   The bill states the legislative intent of the general assembly to support innovation in AI while establishing reasonable consumer protections for systems designed for independent public use.