Colorado Chatbot Safety Act (HB 26-1263) Compliance Guide

Image: Unsplash, used under the Unsplash License.

TL;DR: Colorado Governor Jared Polis signed HB 26-1263 on May 29, 2026. From January 1, 2027, operators of public-facing conversational AI services must tell every user they are talking to AI, run a suicide and self-harm protocol that refers users to crisis services, and never present output as coming from a licensed health, legal, or mental health professional or a dietitian. Operators that know a user is under 18 owe more, including blocks on sexual content and on responses that simulate emotional dependence. Customer-support, business-productivity, and internal bots are excluded. Annual reports to the Attorney General start July 1, 2027. Penalties run up to $20,000 per violation under the Colorado Consumer Protection Act.

Updated October 8, 2026. We re-read the final bill text and the Attorney General's rulemaking page. The earlier version of this page said customer support bots were covered, that the statute left disclosure timing and the crisis protocol to rulemaking, and that parental controls applied only to children under 13. All three were wrong, and they are corrected below. The page also now covers the Attorney General's October 6 interim draft rules and the October 26 hearing.

Correction, October 22, 2026: the checklist told operators to count crisis referrals for calendar year 2027 for the July 1, 2027 report. The statute asks for referrals "in the preceding calendar year" and does not say which year the first report covers; the item now says so. We also added the section number the Attorney General's draft rules use (6-1-1710) and the October 21 regulatory analysis.

The Colorado Attorney General's office calls HB 26-1263 the "Chatbot Safety Act". The bill adds its duties to Part 17 of the Colorado Consumer Protection Act, the same part that holds the state's automated decision-making law, as a new section numbered 6-1-1708. SB 26-189 also uses 6-1-1708 for a different section, and the Attorney General's interim draft rules cite the chatbot section as 6-1-1710, so check both numbers when you search the statutes. The House passed it on April 21, 2026, the Senate on May 11, the House concurred in the Senate amendments on May 12, and the Governor signed it on May 29. The prime sponsors were Representatives Camacho and Mabrey and Senators Carson and Jodeh.

Who the law covers, and who it leaves out

A "conversational artificial intelligence service" is an AI system "that is accessible to the general public and that primarily simulates human conversation and interaction through adaptive textual, visual, or aural communications." An operator is anyone who develops and makes such a service publicly available, or offers one to a consumer. App stores and search engines are not operators just because they give access to a chatbot.

The exclusions matter more than the definition. The law does not cover a service that:

So the law is aimed at general-purpose and companion chatbots open to the public. A support bot on your checkout page is out. A general assistant your app offers to the public, or a companion or "friend" product, is in.

Duties toward every user

Three duties apply to all users from January 1, 2027.

Tell users it is AI, on a schedule. The disclosure must be clear and conspicuous. The statute sets the timing: at the start of a user's first interaction each day, at least once every three hours in a continuous interaction or as a persistent visible notice, and whenever a user asks whether the service is AI and not human.

Run a suicide and self-harm protocol. When a prompt concerns suicidal ideation or self-harm, the protocol must include a referral to a crisis service provider, "such as a suicide hotline, a crisis text line, or another appropriate crisis service, but not including a law enforcement agency," and escalation procedures for repeated or severe crisis indicators.

Do not claim professional standing. The advertising, interface, and outputs must not say that output is provided by, endorsed by, or equivalent to services from four groups: licensed health-care professionals, licensed legal professionals, licensed, certified, or registered mental health professionals, and qualified dietitians. Financial advisers are not on the list.

Extra duties when the user is a minor

Image: Pexels, used under the Pexels License.

A minor is anyone under 18. Operators must use "commercially reasonable methods or generally accepted methods" to estimate the age of account holders and users, and must not willfully disregard clear and convincing information that someone is a minor. An estimated age counts as knowledge of age. From January 1, 2027, when an operator knows a user is a minor, it must:

1. Disclose AI status with a persistent visible notice on screens, an intermittent audio notice on devices without screens, or a notice at the start of each interaction and at least every three hours.
2. Not hand out points or similar rewards at unpredictable intervals with the intent to increase engagement. The text targets variable rewards. It does not mention streaks.
3. Block sexual content with technically feasible measures: no depictions of explicit sexual conduct, no intimate digital depictions, no statements that the minor should engage in explicit sexual conduct, and no erotic or sexually explicit interactions.
4. Guard against emotional dependence. Reasonable measures must stop responses that simulate "emotional dependence or isolation from real-world supports", including an explicit claim that the service is human or sentient, statements that simulate romantic companionship, and role-play of an adult-minor romantic relationship.
5. Run two sexual-conduct protocols: one that prohibits the service from engaging in explicit sexual conduct with a minor, and one that makes it stop engaging when a prompt concerns explicit sexual conduct with a minor.
6. Comply with Part 13 of the same article on protecting a minor's privacy and data.
7. Offer privacy and account tools to the minor, including control over whether the service remembers prior sessions to personalize future ones and whether the minor's personal data is used for training, and offer tools for a parent or guardian to manage those settings. This applies to all minors, not only children under 13.

Denver7 report from May 6, 2026, while HB 26-1263 was still in the Senate: Colorado parents said the bill did not go far enough.

Image: Pexels, used under the Pexels License.

Annual reporting from July 1, 2027

On and after July 1, 2027, operators must report each year to the Attorney General's office:

• the number of crisis service referral notifications issued in the preceding calendar year;
• the protocols used to detect, remove, and respond to suicidal ideation or self-harm;
• the protocols used to prevent responses about suicidal ideation or self-harm actions; and
• any additional metrics the Attorney General decides are needed to judge whether the safeguards work.

Reports must not include user identifiers or personal information, must use evidence-based methods to measure suicidal ideation or self-harm, and the Attorney General will post the report data on its public website. Plan for that: data from your report will be public.

Enforcement: deceptive trade practice, up to $20,000 per violation

HB 26-1263 sits inside Part 17, and Part 17's enforcement section, as rewritten by SB 26-189, says "a violation of this part 17 is a deceptive trade practice" under the Colorado Consumer Protection Act and that the Attorney General enforces the part. The Consumer Protection Act allows a civil penalty of "not more than twenty thousand dollars for each such violation", and "a violation of any provision shall constitute a separate violation with respect to each consumer or transaction involved."

That per-consumer rule is what makes the number large. A missing AI disclosure is not one $20,000 problem if thousands of Colorado users saw the screen.

Two limits on exposure:

• Part 17 states that it creates no new private right of action.
• Part 17 has a 60-day notice-and-cure step before enforcement, repealed on January 1, 2030. It is written for "a developer or deployer", the terms used by the automated decision-making rules. Whether the Attorney General will extend it to chatbot operators is not stated in either bill. Do not plan on a cure period.

Attorney General rulemaking: what happens on October 26

HB 26-1263 does not require rules, but the Attorney General's office says it "believes rulemaking would help ensure compliance obligations, including the content of the annual report, are clear." The timeline so far, from the office's rulemaking page:

The rules are joint rules for SB 26-189 and HB 26-1263. The interim draft would add to the annual report: it asks for the distribution of users by age category and a general description of the age-estimation methods, and it lets an operator reuse a report written for another jurisdiction if it is reasonably similar, with an appendix for anything missing. That is a draft, not a rule. If you want a say on the content of the annual report, the October 26 deadline is the one that counts. Our Colorado ADMT comment letter template covers the filing.

Image: Pexels, used under the Pexels License.

Compliance checklist for chatbot operators

1. Check the exclusions first. Walk your product against the exclusions in the table above (the bill lists 12; the table groups game and theme-park characters). Write down which one applies, or that none does. Customer support, shopping, internal, and business productivity bots will usually be out.

2. Build the AI disclosure to the statutory schedule. First interaction each day, every three hours or persistent, and on request. A line in your terms of service does not meet "clear and conspicuous".

3. Write the crisis protocol. Referral to a crisis line or crisis text line, not to police, plus escalation steps for repeated or severe signals. Log every referral: the count goes into the annual report, and the Attorney General posts report data publicly.

4. Remove professional framing. Search prompts, marketing copy, and UI for anything that presents output as from a doctor, lawyer, therapist or other mental health professional, or dietitian.

5. Decide your age-estimation method. It must be commercially reasonable or generally accepted. Record why you chose it, and how you act on clear signs that a user is a minor.

6. Build minor mode. Variable rewards off, sexual-content blocks on, emotional-dependence guardrails (no claims of being human or sentient, no romantic companionship), the two sexual-conduct protocols, memory and training controls for the minor, and parent or guardian controls.

7. Prepare the July 1, 2027 report. Decide who owns the referral count and the protocol descriptions, and start counting referrals on January 1, 2027. The statute asks for referrals "in the preceding calendar year" without saying which year the first report covers, and the interim draft rules don't settle it clearly; that is a fair question for the hearing.

8. Read the October 6 interim draft rules and comment by October 26 if the annual report metrics would be hard to produce.

Our take

Based on the bill text and the Attorney General's page cited here, HB 26-1263 is narrower than early coverage suggested and stricter where it applies. Narrower, because customer support, shopping, internal, and productivity bots are carved out. Stricter, because the statute already spells out the disclosure schedule, the crisis referral, and the four professions, so there is little to wait for from rulemaking except the report metrics. If you run a public general-purpose assistant or a companion product, treat January 1, 2027 as a hard date and the July 2027 report as public.

How we checked this

On October 8, 2026 we read the final act of HB 26-1263 (the signed act on the legislature's site is a scanned image, so we used the text of the final act), the bill page's summary and history, the Part 17 enforcement section in the SB 26-189 final act, Colorado Revised Statutes 6-1-112 on civil penalties, and the Attorney General's ADMT and Chatbot Safety rulemaking page. On October 22 we re-read all of them, matched every quote again, and read the annual report and definitions parts of the October 6 interim draft (a redline; we have not read the ADMT rules in it in full) and the notice of the October 21 regulatory analysis. The Attorney General's page still says the bill "was signed into law on July 1, 2026"; the legislature's bill history records "Governor Signed" on May 29, 2026 (the signed act is posted June 1), and we use the legislature's date. We have not seen the section number in the published Colorado Revised Statutes. We looked for a Reddit discussion of HB 26-1263 to quote and found none (r/Colorado searches for "AI chatbot" on October 8 and "chatbot" on October 22 returned no posts), so this page has no community quotes.

Last reviewed: October 22, 2026.

Related Reading

• Texas Sues OpenAI and Sam Altman: What the Suit Demands
• Florida Safe Screens Act: AI Chatbot Rules for Minors
• NYC Chatbot Doom Loop Rule: Customer Service Checklist
• Colorado ADMT Comment Letter Template
• AI Policy Week Sep 21-27: UN Briefing, Colorado ADMT, 3 Actions
• Colorado AI Act compliance: what SB 26-189 requires in 2027
• Multi-State AI Compliance Strategy 2026
• Illinois SB 315: The Toughest State AI Safety Law Yet
• Connecticut AI Law 2026 Compliance Checklist
• AI Bias Audit Requirements by State 2026
• AI Acceptable Use Policy Template for Small Teams
• Italy Fines Character.AI €158K for Child Safety Failures: What the Garante Ordered
• California Adam's Law SB 1119: 3 Chatbot Compliance Deadlines Starting July 2027
• State AG AI chatbot lawsuits tracker: Florida v. OpenAI update