The Colorado Attorney General heads the Colorado Department of Law and is the sole enforcement authority for Part 17 of article 1 of title 6 of the Colorado Revised Statutes, the part of the Colorado Consumer Protection Act that carries the state's AI statutes. The office holder since 2019 is Phil Weiser. Within the department, the Consumer Protection Section drafts and administers the AI rules. Because Colorado's AI statutes create no private right of action, the office is the only body that can bring an enforcement action under them, which makes its rulemaking and interpretive positions the operative content of the law for regulated parties.
Enforcement authority
The 2024 Colorado AI Act (SB 24-205) designated the Attorney General as exclusive enforcement authority. SB 26-189, signed May 14, 2026, repealed and reenacted Part 17 and preserved that design: violations are deceptive trade practices under the Colorado Consumer Protection Act, enforceable solely by the Attorney General, with a 60-day right to cure that may be denied for knowing or repeated violations and that sunsets January 1, 2030. Beginning in January 2028 the office must report annually on the number of actions brought, actions completed, and cure periods offered, met, and not met (Colorado SB 26-189 (Signed Act, May 14 2026)).
HB 26-1263, the Chatbot Safety Act signed May 29, 2026, adds a supervisory function alongside enforcement: from July 1, 2027 operators of conversational artificial intelligence services must file an annual report with the office covering crisis-referral counts and their suicide and self-harm protocols, and the office is directed to post data from those reports on its public website (Colorado HB 26-1263 (Chatbot Safety Act, Enrolled Act)).
Rulemaking
The Attorney General's rulemaking authority over Part 17 comes from four provisions: C.R.S. § 6-1-108(1), authorizing rules necessary to administer the Colorado Consumer Protection Act; § 6-1-1707, giving rulemaking authority to implement and enforce Part 17; § 6-1-1706(5), giving discretionary authority over the whole of Part 17; and §§ 6-1-1704(4) and 6-1-1705(3), which require rules clarifying post-adverse-outcome disclosures and consumer rights respectively — the only mandatory rulemakings in the set.
The Department ran a pre-rulemaking phase that published a considerations paper in June 2026 and collected informal comment through July 13, 2026. On August 11, 2026 the Consumer Protection Section filed the proposed Automated Decision-Making Technology & Conversational Artificial Intelligence Service Rules (4 CCR 904-6) with the Secretary of State, together with a notice of rulemaking hearing and a statement of basis, specific statutory authority, and purpose. The package implements SB 26-189 and HB 26-1263 in a single fourteen-rule instrument (Colorado 4 CCR 904-6 — ADMT and Conversational AI Service Proposed Rules (2026)). Formal written comments run from August 11 through October 26, 2026, with comments intended to inform revisions presented at the hearing requested by October 5, 2026; under C.R.S. § 24-4-103(2.5) any person may request a cost-benefit analysis within five days of publication in the Colorado Register (Source: coag.gov).
The proposed rules repeatedly frame their tests as what "the Department will consider" on a totality of the circumstances, rather than as bright lines — an approach the statement of basis attributes to a rapidly evolving technical landscape, and one that concentrates interpretive discretion in the office (Colorado 4 CCR 904-6 — ADMT and Conversational AI Service Proposed Rules (2026)).
Litigation
The office is the defendant in xAI v. Weiser (D. Colo. No. 1:26-cv-01515), filed April 9, 2026, a constitutional challenge to the 2024 Colorado AI Act pleading First Amendment, Dormant Commerce Clause, Due Process, and Equal Protection claims (xAI LLC v. Weiser — Complaint (D. Colo. 1:26-cv-01515)). The Department of Justice intervened on April 24, 2026.
Relationships
- regulated-by: Colorado SB 26-189 (2026 — replaces 2024 Colorado AI Act) — the statute conferring enforcement authority and most rulemaking power
- regulated-by: Colorado HB 26-1263 (Chatbot Safety Act) — the statute conferring the annual-report supervisory function
- depends-on: Colorado 4 CCR 904-6 — ADMT and Conversational AI Service Proposed Rules (2026) — the office's proposed implementing rules
- related: Phil Weiser — the office holder since 2019
- litigates: xAI LLC v. Weiser (challenging the Colorado AI Act) — defendant in the constitutional challenge to the 2024 act
- related: Colorado AI Act (SB 24-205) — the predecessor statute repealed and reenacted by SB 26-189
- instance-of: State-Level AI Regulation — a state regulator operating in the absence of federal preemption
Sources
- Colorado 4 CCR 904-6 — ADMT and Conversational AI Service Proposed Rules (2026) — proposed 4 CCR 904-6 rules and the statement of basis: authority chain, rule-by-rule content, pre-rulemaking history
- Colorado SB 26-189 (Signed Act, May 14 2026) — enforcement design, right to cure, annual AG reporting from 2028
- Colorado HB 26-1263 (Chatbot Safety Act, Enrolled Act) — operator annual-report duty and the public-posting direction
- xAI LLC v. Weiser — Complaint (D. Colo. 1:26-cv-01515) — the constitutional challenge naming the office holder
- (Source: coag.gov) — Colorado Attorney General AI rulemaking page: filing date, comment window, cost-benefit-analysis procedure