CO HB 1263: Conversational Artificial Intelligence Service Operator Requirements

In one paragraph

Colorado's HB 26-1263 regulates operators of conversational AI services: public AI systems that mainly simulate human conversation (customer-service, business and other listed uses excluded). From January 1, 2027, operators must tell users the service is AI (daily, every three hours or persistently, and when asked), run a suicide and self-harm protocol with crisis referrals, and not claim outputs come from or are endorsed by licensed health, legal or mental health professionals. For known minors they must also guard against sexual content and simulated romance, avoid unpredictable engagement rewards and offer privacy tools. Signed May 29, 2026 (Chapter 208); act effective August 12, 2026.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

Operators of public AI chatbots that mainly simulate human conversation (customer-service, business and other listed tools excluded) must add AI disclosures, a suicide and self-harm protocol and minor protections from January 1, 2027, and report yearly to the Attorney General from July 1, 2027.

Key provisions

1. 1Operator: anyone who develops and makes publicly available, or offers to consumers, a conversational AI service (app stores and search engines are not operators solely for providing access); excluded services include developer and research tools, commerce and customer-service bots, business and internal tools, narrow-topic bots and voice assistants that cannot produce sexual content or self-harm dialogue, game and theme-park features, HIPAA and Health Care Availability Act entities, school tools and features inside other software that do not simulate emotional companionship (§ 6-1-1701(3.5), (15.5))
2. 2All users, from January 1, 2027: a clear and conspicuous disclosure that the service is AI at the start of the first interaction each day, at least every three hours or persistently, and in response to questions about whether it is human (§ 6-1-1708(3))
3. 3Operators must use commercially reasonable or generally accepted methods to estimate users' ages and may not willfully disregard clear and convincing information that a user is under 18; an estimated age counts as knowledge (§ 6-1-1708(2))
4. 4Known minors, from January 1, 2027: AI-not-human disclaimers; no points or rewards at unpredictable intervals to drive engagement; technically feasible measures against explicit sexual content and intimate digital depictions; reasonable measures against claims of being human or sentient, romantic statements and adult-minor romantic role-play; privacy and account tools (including memory and training-data controls) for minors and parents; compliance with the Colorado Privacy Act (§ 6-1-1708(2))
5. 5All users, from January 1, 2027: a protocol for prompts about suicidal ideation or self-harm, with referral to a crisis service such as a suicide hotline or crisis text line (not law enforcement) and escalation for repeated or severe crisis indicators (§ 6-1-1708(4))
6. 6No advertising, interface or output stating that outputs are provided by, endorsed by or equivalent to a licensed health-care, legal or mental health professional or a qualified dietitian (§ 6-1-1708(5))
7. 7From July 1, 2027, annual reports to the Attorney General on crisis-referral counts, self-harm detection and response protocols and AG-set metrics, with no user identifiers; the AG posts the data (§ 6-1-1708(6)). The act sets no penalty amounts of its own; its duties sit in Part 17 of the Colorado Consumer Protection Act, which the Attorney General enforces
8. 8Signed May 29, 2026 (Chapter 208, Session Laws 2026); act effective August 12, 2026; the AI-disclosure, minor-protection, crisis-protocol and professional-claim duties apply from January 1, 2027 and annual reporting from July 1, 2027 (the age-estimation sentences in § 6-1-1708(2) carry no separate date)

Latest legislative action

May 29, 2026. Governor Signed

Sponsors (showing 5 of 23)