Colorado HB 26-1263 (Chatbot Safety Act, Enrolled Act)

Colorado House Bill 26-1263, titled "Concerning Requirements for an Operator of a Conversational Artificial Intelligence Service" and called the Chatbot Safety Act by the Colorado Department of Law, adds section 6-1-1708 to the Colorado Revised Statutes and seven definitions to section 6-1-1701, both within Part 17 of article 1 of title 6 — the Colorado Consumer Protection Act. Governor Jared Polis signed it on May 29, 2026; it was enacted as Chapter 208 of the 2026 session laws with an effective date of August 12, 2026, and its operative duties attach on and after January 1, 2027. The act regulates operators of publicly available conversational artificial intelligence services rather than model developers as such, and does so through duties owed to users and, more extensively, to users the operator knows to be minors. This page summarizes the enrolled text in Raw Sources/Colorado HB 26-1263 (Chatbot Safety Act, Final Act).md.

Definitions added to § 6-1-1701

A conversational artificial intelligence service is an artificial intelligence system that is accessible to the general public and that primarily simulates human conversation and interaction through adaptive textual, visual, or aural communications. The definition excludes twelve categories of software application, web interface, or computer program: those primarily designed and marketed for developers or researchers; those primarily designed for commerce-related or transactional assistance, including product or service recommendations, shopping, ordering, payments, delivery, returns, customer support, or customer service; those designed for a narrow and discrete topic that cannot generate outputs related to sexually explicit conduct or depictions as described in § 6-1-1708(2)(c) and (2)(d) and cannot maintain dialogue related to suicidal ideation or self-harm; those primarily designed and marketed for commercial use by business entities for business operations, productivity, information analysis, internal research, training, or technical assistance; voice- or text-activated virtual assistants for consumer electronic devices subject to the same content limits; software used by a business solely for internal purposes; video-game features limited to dialogue focused on the game; theme-park or location-based entertainment features limited to dialogue about the attraction; services used by, rendered to, or provided on behalf of a covered entity or business associate as defined in the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §§ 1320d to 1320d-9; services used by an entity subject to the Health Care Availability Act, article 64 of title 13; educational tools designed primarily for specific and limited instructional, administrative, accessibility, or student-support purposes in a school setting and not designed to simulate emotional companionship or encourage emotionally dependent interaction; and features within another application, web interface, or program — including a social media platform as defined in § 6-1-1601(4)(a) — where that host program is not itself the conversational artificial intelligence service and is not designed to simulate emotional companionship or encourage emotionally dependent interaction.

An operator is a person, partnership, corporation, or entity that either develops and makes publicly available a conversational artificial intelligence service or offers such a service to a consumer. A mobile application store or search engine is not an operator solely because it provides access to such a service.

A minor is a consumer under eighteen years old. Self-harm means intentional self-injury, with or without the intent to cause death. Explicit sexual conduct takes the meaning in § 13-21-1502(7) and excludes evidence-based medical information and factual descriptions of reproductive health care. Intimate digital depiction takes the meaning in § 13-21-1502(10), and visual depiction the meaning in 18 U.S.C. § 2256(5).

Section 6-1-1708(1) adds three further definitions used only within that section. An account holder is a consumer who has or opens an account or profile for the purpose of using a conversational artificial intelligence service; a minor account holder is an account holder who is a minor; and a minor user is a user whom an operator has knowledge is a minor by using commercially reasonable or generally accepted methods to estimate the age or age range of a user.

Age estimation

An operator must use commercially reasonable methods or generally accepted methods to estimate the age of account holders or users, and must not willfully disregard clear and convincing information that an account holder or user is a minor. The act provides that an estimated age or age range is considered knowledge of the minor's age. That knowledge is the trigger for the minor-specific duties in § 6-1-1708(2), which apply on and after January 1, 2027. The act names no particular estimation technology and imposes no document-based verification requirement.

Duties owed to minors

Where the operator knows an account holder or user is a minor, § 6-1-1708(2) imposes eight duties.

Disclosure. The operator must clearly and conspicuously disclose that the minor is interacting with artificial intelligence that is artificially generated and not human. The disclosure must be provided in response to user prompts asking whether the service is artificially generated and not human, and must take one of three forms: a persistent visible disclaimer on a product with a screen interface; an intermittent audio disclaimer on a product without one; or a disclosure at the beginning of each interaction that recurs at least once every three hours in a continuous interaction.

Engagement rewards. The operator must not provide the minor with points or similar rewards at unpredictable intervals with the intent to encourage increased engagement with the service.

Sexual content. The operator must institute technically feasible measures to prevent the service from producing textual, visual, or aural depictions of explicit sexual conduct; producing an intimate digital depiction; generating a statement that the minor should engage in explicit sexual conduct; or engaging in erotic or sexually explicit interactions with the minor. Two separate protocol duties accompany this: a protocol prohibiting the service from engaging in explicit sexual conduct with a minor, and a protocol for the service to stop engaging in response to a user prompt regarding explicit sexual conduct with a minor.

Emotional dependence. The operator must institute reasonable measures to prevent the service from formulating, structuring, or optimizing a response that simulates emotional dependence or isolation from real-world supports, including preventing an explicit claim that the service is human or artificially sentient, a statement that simulates a romantic companionship, and role-playing of an adult–minor romantic relationship. The standard here is "reasonable measures", one step below the "technically feasible measures" required for sexual content.

Privacy and controls. The operator must comply with Part 13 of article 1 on the privacy and data of minors, and must offer the minor tools to manage privacy and account settings — including the ability to control whether the service retains information from prior interactions or sessions to personalize future interactions, and whether the minor's personal data is used to train the service — together with equivalent tools for a parent or guardian.

Duties owed to all users

Independently of age, on and after January 1, 2027 an operator must clearly and conspicuously disclose to a user that the service is artificial intelligence. The disclosure must be provided at the beginning of the user's first interaction each day, must appear at least once every three hours in a continuous interaction or appear as a persistent disclosure visible to the user, and must be provided in response to user prompts asking whether the service is artificially generated and not human.

The operator must also implement a protocol for the service to respond to a user prompt regarding suicidal ideation or self-harm. The protocol must include referral to a crisis service provider such as a suicide hotline, a crisis text line, or another appropriate crisis service, and must exclude referral to a law enforcement agency. It must also include escalation procedures for repeated or severe crisis indicators.

Section 6-1-1708(5) prohibits an operator from using any term, letter, or phrase in the advertising, interface, or outputs of the service stating that output data is being provided by, endorsed by, or equivalent to services provided by a licensed health-care professional, a licensed legal professional, a licensed, certified, or registered mental health professional, or a qualified dietitian as described in § 6-1-707(1)(b). The prohibition reaches advertising and interface elements, not only model outputs.

Annual reporting

On and after July 1, 2027 an operator must report annually to the attorney general's office the number of times it issued a crisis service provider referral notification in the preceding calendar year; any protocols implemented to detect, remove, and respond to instances of user suicidal ideation or self-harm; any protocols implemented to prevent a service response about suicidal ideation or self-harm actions; and any additional metrics the attorney general determines necessary to establish the efficacy and reliability of the implemented safeguards or protocols. The report must not include any identifiers or personal information about a user, and the attorney general's office is directed to post data from the submitted reports on its public website. In preparing the report an operator must use evidence-based methods for measuring suicidal ideation or self-harm.

Savings clauses and enforcement

Section 6-1-1708(7) provides that nothing in the section limits an individual's ability to access information and resources under section 32 of article II of the state constitution and part 4 of article 6 of title 25; requires an operator to disclose trade secrets, confidential or proprietary information, or other information protected from disclosure by state or federal law; or authorizes content-moderation practices inconsistent with the United States Constitution.

The enrolled act contains no penalty provision, no private right of action, and no severability clause. Because § 6-1-1708 is placed inside Part 17 of the Colorado Consumer Protection Act, enforcement runs through the Part 17 mechanism reenacted three weeks earlier by SB 26-189, under which violations are deceptive trade practices enforceable solely by the attorney general with a 60-day right to cure that sunsets on January 1, 2030. The act itself does not restate that mechanism.

Effective date

Section 3 sets the act to take effect at 12:01 a.m. on the day following expiration of the ninety-day period after final adjournment of the General Assembly — August 12, 2026, given adjournment sine die on May 13, 2026. If a referendum petition were filed under article V, section 1(3) of the state constitution against the act or any part of it within that period, the affected part would not take effect unless approved at the November 2026 general election, taking effect on the date of the governor's official declaration of the vote. The Colorado General Assembly's session-laws table records the act as effective August 12, 2026 (Source: leg.colorado.gov).

Provenance

The text summarized here is the Final Act version dated May 28, 2026 (bill_files/116772), a born-digital PDF. The Signed Act version dated June 1, 2026 (bill_files/116851) carries the executed signatures but is a scanned image without a text layer; optical character recognition of it dropped § 6-1-1701(1)(a), (1)(c), and (12.5), the introductory clauses of § 6-1-1708(2)(c) and (5), exclusion (VIII), and § 6-1-1708(6)(b)–(c). The two versions carry identical operative text.

Relationships

• supports: Colorado HB 26-1263 (Chatbot Safety Act) — the operative primary text behind the legislation page
• related: Colorado SB 26-189 (Signed Act, May 14 2026) — the companion Part 17 statute signed May 14, 2026, supplying the enforcement mechanism
• depends-on: Age Verification — the age-estimation duty conditions every minor-specific obligation
• instance-of: AI Companions — regulates services that simulate human conversation and companionship
• related: California SB 243 — Companion Chatbots — state companion-chatbot statute addressing overlapping conduct

Sources

• (Source: leg.colorado.gov) — HB 26-1263, Final Act (PDF, 10 pp.), the enrolled text summarized above
• (Source: leg.colorado.gov) — Colorado General Assembly bill page: version table, sponsors, bill history, signature dates, session-law chapter and effective date