Colorado HB 26-1263 (Chatbot Safety Act)

House Bill 26-1263, titled "Conversational Artificial Intelligence Service Operator Requirements" in the Colorado General Assembly's records and named the "Chatbot Safety Act" by the Colorado Department of Law, is a Colorado act codified at C.R.S. § 6-1-1708 within Part 17 of the Colorado Consumer Protection Act. It imposes age-estimation, disclosure, minor-protection, crisis-response, and reporting duties on operators of publicly available conversational artificial intelligence services. Governor Jared Polis signed it on May 29, 2026; its operator duties apply on and after January 1, 2027 and its annual reporting duty on and after July 1, 2027. On August 11, 2026 the Department of Law filed draft implementing rules with the Secretary of State covering this act and Senate Bill 26-189 together.

Status and legislative history

The bill was introduced in the House on February 19, 2026 and assigned to the Committee on Business Affairs & Labor, which referred it as amended on March 26, 2026 by a vote of 10–3 after adopting four amendments. The House passed it on third reading on April 21, 2026 by 40–24 with one member excused, having rejected a Committee of the Whole amendment (H.001) 23–40 the previous day.

The Senate Committee on Business, Labor, & Technology referred the bill as amended 5–0 on May 5, 2026, and the Senate passed it on third reading on May 11, 2026 by 24–11. The House concurred in the Senate amendments on May 12, 2026 (48–16, one excused) and repassed the bill 42–22 with one excused. Twenty-one amendments were offered across the two chambers, of which eleven passed. The measure was signed by Speaker of the House Julie McCluskie and Senate President James Rashad Coleman, Sr. on May 28, 2026 and sent to the Governor the same day (Source: leg.colorado.gov).

The General Assembly's bill history and the Department of Law's statement of basis both record the Governor's signature on May 29, 2026 (Source: leg.colorado.gov; Colorado 4 CCR 904-6 — ADMT and Conversational AI Service Proposed Rules (2026)). The Attorney General's rulemaking webpage states instead that the act "was signed into law on July 1, 2026"; the July date is not corroborated by any other Colorado source (Source: coag.gov).

Section 3 of the act sets its effective date at 12:01 a.m. on the day following expiration of the ninety-day period after the General Assembly's final adjournment — August 12, 2026, given sine die on May 13, 2026 — and provides that a referendum petition filed under article V, section 1(3) of the state constitution would suspend the act pending approval at the November 2026 general election. The substantive operator duties are separately keyed to January 1, 2027 (Colorado HB 26-1263 (Chatbot Safety Act, Enrolled Act)). The General Assembly's session-laws table records the act as effective August 12, 2026 under Chapter 208 (Source: leg.colorado.gov).

Scope and definitions

Section 1 of the act adds seven definitions to C.R.S. § 6-1-1701. A "conversational artificial intelligence service" is an artificial intelligence system that is accessible to the general public and that primarily simulates human conversation and interaction through adaptive textual, visual, or aural communications. A "minor" is a consumer under eighteen years old. "Self-harm" is intentional self-injury, with or without the intent to cause death. "Explicit sexual conduct" takes the meaning in C.R.S. § 13-21-1502(7) and excludes evidence-based medical information and factual descriptions of reproductive health care; "intimate digital depiction" takes the meaning in § 13-21-1502(10); and "visual depiction" takes the meaning in 18 U.S.C. § 2256(5).

Section 6-1-1708(1) adds three further definitions used only within that section. An "account holder" is a consumer who has or opens an account or profile for the purpose of using a conversational artificial intelligence service; a "minor account holder" is an account holder who is a minor; and a "minor user" is a user whom the operator has knowledge is a minor through commercially reasonable or generally accepted age-estimation methods.

An "operator" is a person, partnership, corporation, or entity that either develops and makes publicly available a conversational artificial intelligence service or offers such a service to a consumer. The definition excludes a mobile application store or search engine solely because it provides access to such a service.

The definition of a conversational artificial intelligence service carries twelve exclusions, covering software that is primarily designed and marketed for developers or researchers; commerce and transactional assistance including recommendations, ordering, payments, delivery, returns, and customer support; narrow single-topic tools that cannot generate sexually explicit outputs or maintain dialogue on suicidal ideation or self-harm; software marketed for business operations, productivity, information analysis, internal research, and training or technical assistance; voice- or text-activated virtual assistants for consumer electronic devices subject to the same content limits; internal business use; video-game features limited to game dialogue; theme-park and location-based entertainment features similarly limited; services used by or on behalf of HIPAA covered entities and business associates; entities subject to the Colorado Health Care Availability Act; educational tools for instructional, administrative, accessibility, or student-support purposes that are not designed to simulate emotional companionship or encourage emotionally dependent interaction; and features embedded within another application, including a social media platform as defined in § 6-1-1601(4)(a), that are not themselves a conversational artificial intelligence service and are not designed to simulate emotional companionship (Colorado HB 26-1263 (Chatbot Safety Act, Enrolled Act)).

Key provisions

Age estimation

An operator must use commercially reasonable or generally accepted methods to estimate the age of account holders and users, and may not willfully disregard clear and convincing information that an account holder or user is a minor. The act provides that an estimated age or age range constitutes knowledge of the minor's age, which is the trigger for the minor-specific duties.

Duties toward minors

Where an operator knows an account holder or user is a minor, from January 1, 2027 it must clearly and conspicuously disclose that the user is interacting with artificial intelligence and not a human. The disclosure must be a persistent visible disclaimer on products with a screen interface, an intermittent audio disclaimer on products without one, or provided at the beginning of each interaction and at least once every three hours in a continuous interaction, and must also be given in response to user prompts asking whether the service is artificially generated.

The operator may not provide a minor with points or similar rewards at unpredictable intervals with the intent to encourage increased engagement. It must institute technically feasible measures preventing the service from producing textual, visual, or aural depictions of explicit sexual conduct, producing an intimate digital depiction, generating a statement that the minor should engage in explicit sexual conduct, or engaging in erotic or sexually explicit interactions with the minor; implement a protocol prohibiting the service from engaging in explicit sexual conduct with a minor; and implement a protocol for the service to stop engaging in response to a user prompt regarding explicit sexual conduct with a minor.

Separately, the operator must institute reasonable measures preventing the service from formulating, structuring, or optimizing a response that simulates emotional dependence or isolation from real-world supports — specifically preventing an explicit claim that the service is human or artificially sentient, a statement simulating a romantic companionship, and role-playing of an adult–minor romantic relationship.

The operator must comply with Part 13 of article 1 on minors' privacy and data, and must offer the minor tools to manage privacy and account settings — including control over whether the service retains information from prior sessions to personalize future interactions, and whether the minor's personal data is used to train the service — and equivalent tools for a parent or guardian.

General user disclosure

Independently of age, from January 1, 2027 an operator must clearly and conspicuously disclose to any user that the service is artificial intelligence. The disclosure must appear at the beginning of the user's first interaction each day, appear at least once every three hours in a continuous interaction or persist visibly, and be given in response to user prompts asking whether the service is artificially generated and not human.

Suicide and self-harm protocol

From January 1, 2027 an operator must implement a protocol for responding to user prompts regarding suicidal ideation or self-harm. The protocol must include referral to a crisis service provider such as a suicide hotline, a crisis text line, or another appropriate crisis service — expressly not a law enforcement agency — and escalation procedures for repeated or severe crisis indicators.

Professional-equivalence prohibition

From January 1, 2027 an operator may not use any term, letter, or phrase in the advertising, interface, or outputs of the service stating that output data is provided by, endorsed by, or equivalent to services provided by a licensed health-care professional, a licensed legal professional, a licensed, certified, or registered mental health professional, or a qualified dietitian as described in C.R.S. § 6-1-707(1)(b). The prohibition reaches advertising and interface elements, not only model outputs.

Annual reporting

From July 1, 2027 an operator must report annually to the Attorney General's office the number of crisis-service-provider referral notifications issued in the preceding calendar year; any protocols implemented to detect, remove, and respond to instances of user suicidal ideation or self-harm; any protocols implemented to prevent service responses about suicidal ideation or self-harm actions; and any additional metrics the Attorney General determines are necessary to assess the efficacy and reliability of the safeguards and protocols. Operators must use evidence-based methods for measuring suicidal ideation or self-harm when preparing the report. The report must not include any identifiers or personal information about a user, and the Attorney General's office is directed to post data from the submitted reports on its public website.

Savings clauses

Nothing in the section limits an individual's ability to access information and resources under section 32 of article II of the state constitution and part 4 of article 6 of title 25; requires an operator to disclose trade secrets, confidential or proprietary information, or information otherwise protected from disclosure; or authorizes content-moderation practices inconsistent with the United States Constitution (Colorado HB 26-1263 (Chatbot Safety Act, Enrolled Act)).

Enforcement

The act contains no penalty provision, no private right of action, and no severability clause. Because § 6-1-1708 sits inside Part 17 of the Colorado Consumer Protection Act, enforcement runs through the Part 17 mechanism reenacted three weeks earlier by SB 26-189, under which violations are deceptive trade practices enforceable solely by the attorney general, subject to a 60-day right to cure that sunsets January 1, 2030 (Colorado SB 26-189 (Signed Act, May 14 2026)). The act itself does not restate that mechanism.

Rulemaking

The act does not itself require rulemaking. The Attorney General nonetheless opened one, stating that rules "would help ensure compliance obligations, including the content of the annual report, are clear." The Department of Law grounds its authority in C.R.S. § 6-1-108(1), which authorizes rules necessary to administer the Colorado Consumer Protection Act, together with § 6-1-1707 and § 6-1-1706(5), which give the Attorney General rulemaking authority over the whole of Part 17.

The Department ran a pre-rulemaking phase that published a considerations paper and collected informal public comment through July 13, 2026. On August 11, 2026 it filed the Automated Decision-Making Technology & Conversational Artificial Intelligence Service rules (4 CCR 904-6) with the Secretary of State, together with the notice of rulemaking hearing and the statement of basis, specific statutory authority, and purpose. The single package implements both this act and SB 26-189, the automated-decision-making statute signed May 14, 2026 that repeals and reenacts the 2024 Colorado AI Act and takes effect on the same January 1, 2027 date.

The chatbot-specific rules are distributed across the package. Rules 2 and 8 set definitions and clarify the exemptions from the definition of a conversational artificial intelligence service; Rule 3 governs the form of disclosures to users; Rule 9 addresses age assurance; Rule 10 the scope and content of user disclosures; Rule 11 the minor-protection measures; Rule 12 the false-representation prohibition; and Rule 13 the annual report. Rule 14 incorporates two external documents by reference: the Web Content Accessibility Guidelines version 2.2 of December 12, 2024 into Rule 3.2, and ISO/IEC 27566-1:2025 on age assurance systems into Rule 9.2 (Colorado 4 CCR 904-6 — ADMT and Conversational AI Service Proposed Rules (2026)).

Several proposed rules add requirements the statute does not state. Rule 9 conditions any acceptable age-estimation method on nine cumulative criteria, among them data minimization with deletion after the minimum compliance period, testing with quantifiable accuracy rates in line with industry standard rates, re-assessment of estimates on new signals, and a prohibition on relying solely on self-declaration, terms of use, or payment methods available to minors; it further provides that an operator "must not use as a sole method of age assurance a method that requires a user to provide government-issued identification", and that an inconclusive outcome cannot support a determination that a user is not a minor. Rule 10 requires a persistent visible disclaimer to remain visible without scrolling or clicking and to use a font size not smaller than the largest font size elsewhere on the interface. Rule 11.5 provides that a minor's privacy and account settings default to the most protective setting, specifically to non-retention of prior sessions and non-use of the minor's personal data for training, while preserving retention needed for legal, safety, or fraud-prevention obligations and stating that nothing requires modification or retraining of any underlying model, model weights, or training corpus. Rule 13 adds an operator size tier by monthly active users, a denominator of total conversations against which the crisis-referral count is measured, a referral-accuracy figure, and reporting on third-party reports that a user is a minor or was exposed to prohibited content (Colorado 4 CCR 904-6 — ADMT and Conversational AI Service Proposed Rules (2026)).

The Department states that the proposed rules aim for clarity and flexibility given what it describes as a rapidly evolving landscape of age-estimation and age-assurance technologies, and that stakeholder input may produce additional rules or significant changes (Colorado 4 CCR 904-6 — ADMT and Conversational AI Service Proposed Rules (2026)).

Formal written comments are accepted from August 11 through October 26, 2026 at 11:59 p.m. MST, with the period extending through the last day of the hearing if the hearing continues past that date; the Department asks that comments intended to inform revisions presented at the hearing be submitted by October 5, 2026. Comments are posted to a public rulemaking-comment site and added to the official record. Under C.R.S. § 24-4-103(2.5), any person may request a cost-benefit analysis of the proposed rules within five days of their publication in the Colorado Register (Source: coag.gov).

Related

HB 26-1263 is one of several 2025–2026 state statutes addressing conversational and companion AI systems and minors, alongside California SB 243 — Companion Chatbots. It is distinct in subject matter from Colorado SB 26-189 (2026 — replaces 2024 Colorado AI Act), which governs automated decision-making technology used in consequential decisions, although the Attorney General has consolidated implementation of the two into a single rulemaking under the same Part 17. The duties it places on operators bear on the questions raised in Character.AI Litigation (umbrella) and overlap with the federal approach in Kids Online Safety Act (KOSA, S. 1748).

Open questions

• Whether the Attorney General's rulemaking page's "July 1, 2026" signing date reflects a separate procedural step or an error is not explained by any Colorado source.
• The act's twelve exclusions turn on how a service is "primarily designed and marketed". Rule 8 supplies factor tests for the business-use, video-game, and emotional-companionship exemptions, but how the Department will apply the threshold to general-purpose assistants with companion-style features is not resolved in the proposed rules.
• Whether the proposed rules survive notice and comment in their filed form is unresolved; the Department states that stakeholder input may produce additional rules, amendments, or significant changes.
• Two acts of the same session assign different content to C.R.S. § 6-1-1708. SB 26-189, signed May 14, 2026, enacts § 6-1-1708 as "Compliance with other legal obligations — insurers" and § 6-1-1709 as the no-private-right-of-action provision (Colorado SB 26-189 (Signed Act, May 14 2026)); HB 26-1263, signed May 29, 2026, adds § 6-1-1708 as the Chatbot Safety Act (Colorado HB 26-1263 (Chatbot Safety Act, Enrolled Act)). The Department of Law's proposed rules describe the covered statutes as "sections 6-1-1701 through 6-1-1709" while citing § 6-1-1708 throughout for the chatbot duties (Colorado 4 CCR 904-6 — ADMT and Conversational AI Service Proposed Rules (2026)). How the revisor of statutes resolved the collision is not stated in any of the three documents.

Relationships

• depends-on: Colorado HB 26-1263 (Chatbot Safety Act, Enrolled Act) — the enrolled primary text summarized here
• depends-on: Colorado 4 CCR 904-6 — ADMT and Conversational AI Service Proposed Rules (2026) — the proposed 4 CCR 904-6 implementing rules
• related: Colorado SB 26-189 (2026 — replaces 2024 Colorado AI Act) — companion Colorado statute in the same Part 17; implemented through the same rulemaking
• related: Colorado AI Act (SB 24-205) — the 2024 statute that SB 26-189 repeals and reenacts
• related: California SB 243 — Companion Chatbots — state companion-chatbot statute addressing overlapping conduct
• related: Kids Online Safety Act (KOSA, S. 1748) — federal minor-protection proposal covering adjacent duties
• instance-of: AI Companions — regulates services that simulate human conversation and companionship
• depends-on: Age Verification — the age-estimation duty is the gateway to the minor-specific requirements
• related: Character.AI Litigation (umbrella) — litigation raising the harms the minor-protection provisions address
• regulated-by: Federal Trade Commission (FTC) — federal consumer-protection authority over overlapping conduct

Sources

• Colorado HB 26-1263 (Chatbot Safety Act, Enrolled Act) — the enrolled act: definitions, operator duties, disclosure formats, crisis protocol, false-representation prohibition, annual reporting, savings clauses, effective-date section
• Colorado 4 CCR 904-6 — ADMT and Conversational AI Service Proposed Rules (2026) — the proposed 4 CCR 904-6 rules and the Department of Law's statement of basis: statutory authority, rule-by-rule content, signing date
• Colorado SB 26-189 (Signed Act, May 14 2026) — the Part 17 statute supplying the enforcement mechanism
• (Source: leg.colorado.gov) — Colorado General Assembly bill page: official title, sponsors, votes, amendments, bill history, session law chapter and effective date
• (Source: coag.gov) — Colorado Attorney General rulemaking page: filing date, comment deadlines, cost-benefit-analysis procedure