Law / United States / Colorado
HB 26-1263 (2026), Conversational AI Service Operator Requirements
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force in 107 days, effective 1 January 2027.
An AI transparency rule binding private bodies.
As of 8 September 2026.
What it requires
- Use commercially reasonable or generally accepted methods to estimate the age of your account holders and other users, and do not willfully disregard clear and convincing information that one of them is a minor
- Starting January 1, 2027, if you know an account holder or user is a minor, clearly and conspicuously disclose that they are interacting with artificial intelligence, at least once every three hours or through a persistent visible or intermittent audio disclaimer
- Do not give a minor account holder or user points or similar rewards at unpredictable intervals meant to increase engagement
- Institute technically feasible measures preventing the service from producing explicit sexual content or intimate digital depictions involving a minor, or from engaging in or encouraging explicit sexual conduct with a minor, and reasonable measures preventing it from claiming to be human or sentient, simulating a romantic companionship, or role-playing an adult-minor romantic relationship
- Offer the minor account holder or user, and their parent or guardian, tools to manage privacy and account settings, including whether the service retains prior interactions for personalization or uses their data to train the service
- Starting January 1, 2027, disclose to every user, not only minors, that the service is artificial intelligence, implement a protocol for responding to a user prompt about suicidal ideation or self-harm that refers the user to a crisis service provider rather than law enforcement, and do not represent the service's output as coming from a licensed health-care, legal, or mental-health professional or a qualified dietitian
- Starting July 1, 2027, report annually to the Attorney General on the number of crisis-service-provider referrals issued and the protocols used to detect, prevent, and respond to suicidal ideation or self-harm, without including any user-identifying information
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
HB 26-1263 states no AI-specific penalty. C.R.S. 6-1-1706, added by SB 26-189, deems a Part 17 violation, which now includes this section, a deceptive trade practice under the Colorado Consumer Protection Act, so the Act's general civil-penalty section, C.R.S. 6-1-112, governs. Section 6-1-112(1)(a) sets a civil penalty of not more than twenty thousand dollars for each violation, counted separately per consumer or transaction. Two adjoining, narrower tiers in the same section could reach a related violation depending on the facts: 6-1-112(1)(b) sets a civil penalty of not more than ten thousand dollars for each violation of a related court order or injunction, and 6-1-112(1)(c) sets a civil penalty of not more than fifty thousand dollars for each violation committed against an elderly person.
- Rule
- Per violation only
- As of
- 8 September 2026
- Currency
- USD
- Per violation unit
- Person
- Per violation amount
- 20,000
Who enforces it
Enforcement body
Colorado Attorney General
What it reaches
Obligation class
Content labelling, Design code, Reporting
Who checks it
Audit expectation
periodic
Who audits it
Self
Where the report goes
Filed with regulator, Published summary
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
An operator that develops and makes publicly available, or offers to a consumer, a conversational artificial intelligence service must use commercially reasonable or generally accepted methods to estimate a user's age, and must not willfully disregard clear and convincing information that an account holder or user is a minor.
Starting January 1, 2027, if an operator knows an account holder or user is a minor, the operator must disclose that the service is artificial intelligence, withhold unpredictable-interval engagement rewards from the minor, prevent the service from producing explicit sexual content, intimate digital depictions, or statements simulating romantic companionship or emotional dependence with the minor, and give the minor and a parent or guardian tools to manage privacy and account settings.
Starting January 1, 2027, an operator must also disclose to every user, not only minors, that the service is artificial intelligence, run a suicide and self-harm response protocol that refers a user to a crisis service provider rather than law enforcement, and not represent the service's output as coming from a licensed health-care, legal, or mental-health professional or a qualified dietitian; starting July 1, 2027, it must report annually to the Attorney General on crisis referrals and self-harm safeguards without including user-identifying information.
Signed May 29, 2026 as Chapter 208 and added to Part 17 of Title 6 alongside SB 24-205 and SB 26-189, a violation of this duty is a deceptive trade practice under the Colorado Consumer Protection Act enforced by the Colorado Attorney General, subject to a 60-day right to cure before an enforcement action, and creates no new private right of action.
When LexLint raises it
deploys_chatbotgenerates_contentprocesses_voiceserves_minors
Read the law
official session-law chapter text, Chapter 208 (2026), Colorado General Assembly