Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act)

Chatbot Safety Act (HB 26-1263)

Artificial intelligence · Children

HB 26-1263, signed May 29, 2026, sets safety and disclosure duties for companion-style and general chatbots starting January 1, 2027. Operators must estimate users' ages, disclose that the service is AI, run suicide and self-harm referral protocols, and, for known minors, block sexual content and emotional-dependence tactics and offer privacy controls over memory and training use. The act itself took effect August 12, 2026.

Where: Colorado
Citation: C.R.S. 6-1-1708 and 6-1-1701(3.5), (10.5), (12.5) as added by HB 26-1263 (numbering may be changed by the revisor because SB 26-189 reenacts Part 17)
Status: Enacted, not yet in force
In force since: 2027-01-01
Enforced by: Colorado Attorney General
People can sue: No
Penalties: Enforced by the Attorney General as part of Part 17 of the Colorado Consumer Protection Act article; penalties follow the Colorado Consumer Protection Act (up to $20,000 per violation).
Applies to: Operators that develop and make publicly available, or offer to Colorado consumers, a conversational AI service that is publicly accessible and primarily simulates human conversation (HB 26-1263, 6-1-1701 additions; 6-1-1708)

What a privacy notice must say

Disclose clearly that the service is AI at the start of each day's first interaction, at least every three hours or persistently, and when asked.HB 26-1263, C.R.S. 6-1-1708(3) · From 2027-01-01

Rights it gives people

Give minors and their parents tools to manage privacy and account settings, including whether the service retains prior conversations for personalization and whether the minor's personal data is used for training; comply with the Colorado Privacy Act for minors' data.HB 26-1263, C.R.S. 6-1-1708(2)(g)-(h) · Only if: Operator knows the user is a minor · From 2027-01-01

Practices it requires

For known minors: no variable engagement rewards, technical measures against sexual content and intimate digital depictions, and measures against simulated emotional dependence or romantic role-play.HB 26-1263, C.R.S. 6-1-1708(2)(b)-(f) · Only if: Operator knows the user is a minor · From 2027-01-01
Use commercially reasonable or generally accepted methods to estimate the age of account holders and users, and do not willfully disregard clear and convincing evidence that a user is a minor.HB 26-1263, C.R.S. 6-1-1708(2) · From 2027-01-01
Implement a suicide and self-harm protocol that refers users to crisis services (not law enforcement) with escalation procedures.HB 26-1263, C.R.S. 6-1-1708(4) · From 2027-01-01
Do not represent outputs as provided by, endorsed by, or equivalent to licensed health-care, legal, or mental health professionals or dietitians.HB 26-1263, C.R.S. 6-1-1708(5) · From 2027-01-01

Registration

Report annually to the Attorney General crisis-referral counts and self-harm protocols, without user identifiers.HB 26-1263, C.R.S. 6-1-1708(6) · From 2027-07-01

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: The Attorney General's page says HB 26-1263 was signed July 1, 2026; the session law and bill history say it was approved May 29, 2026. The legislature's record is used here. | The act adds 6-1-1708 to the pre-2027 Part 17, while SB 26-189 separately reenacts Part 17 (with its own 6-1-1708) on January 1, 2027; final codified numbering was not verified.

Research reference, not legal advice.