Chatbot Laws · verified Oct. 21, 2026
From Jan 1, 2027, operators of public conversational AI services must tell users it is AI each day and every 3 hours, estimate user ages, give known minors extra protections and parental tools, run a suicide and self-harm protocol, and not pass output off as licensed professional advice. Annual report to the Attorney General starts July 1, 2027.
Who must comply
Operators that develop and make publicly available, or offer to consumers, a conversational AI service. Excludes app stores and search engines, and 12 categories of tools (e.g., developer tools, business-only or internal tools, HIPAA-covered uses, narrow-topic bots, voice assistants, limited video-game features, school tools) (§ 6-1-1701(3.5)(b)).
What it requires
| AI disclosure | Operator must clearly and conspicuously tell each user the service is AI, and answer user questions about whether it is artificially generated and not human.When: At the first interaction each day, and at least once every 3 hours in a continuous interaction or as a persistent visible disclosure§ 6-1-1708(3) |
|---|---|
| Minors | If the operator knows a user is a minor (under 18), it must give the AI notice (persistent on-screen, intermittent audio, or at the start and every 3 hours), not give points or rewards at unpredictable intervals, take technically feasible measures against sexually explicit output and intimate digital depictions, take reasonable measures against simulated emotional dependence or isolation, implement protocols on sexual conduct with a minor, comply with the state's minor privacy rules, and offer privacy and account tools to the minor and a parent or guardian.When: Notice at the start and at least every 3 hours (or persistent)§ 6-1-1701(15.3); § 6-1-1708(2)(a)-(h) |
| Age checks | Operator must use commercially reasonable or generally accepted methods to estimate the age of account holders and users, and may not willfully disregard clear and convincing information that a user is a minor. The estimated age counts as knowledge.§ 6-1-1708(2) |
| Crisis protocol | Operator must implement a protocol for prompts about suicidal ideation or self-harm that refers users to a crisis service provider (not law enforcement) and has escalation procedures for repeated or severe indicators.§ 6-1-1708(4) |
| Reporting | Operator reports to the Attorney General the number of crisis-referral notifications in the prior calendar year, its detection and response protocols, and other metrics the Attorney General sets, without user identifiers. The Attorney General posts the data publicly.When: Annually from July 1, 2027§ 6-1-1708(6) |
| Design limits | For known minors, no unpredictable points or rewards to drive engagement and measures against simulated emotional dependence, claims of being human or sentient, romantic simulation and adult-minor romantic role-play.§ 6-1-1708(2)(b), (d) |
| Therapy and licensed titles | Operator may not state in advertising, interface or outputs that the service's output is provided by, endorsed by or equivalent to services of a licensed health-care, legal or mental health professional or a qualified dietitian.§ 6-1-1708(5) |
| Data limits | For known minors, operator must offer tools to control whether the service remembers prior interactions and whether the minor's data is used for training.§ 6-1-1708(2)(h) |
Enforcement
| Enforced by | Attorney GeneralC.R.S. § 6-1-1706 (2024 text and as reenacted by SB 26-189) |
|---|---|
| Private lawsuits | Not stated |
| Penalties | The Act has no enforcement clause of its own. Through Dec 31, 2026, part 17 violations are deceptive trade practices under § 6-1-105(1)(hhhh), enforced only by the Attorney General (§ 6-1-1706 (2024)). From Jan 1, 2027, SB 26-189's § 6-1-1706 makes part 17 violations deceptive trade practices under the Colorado Consumer Protection Act, enforced by the Attorney General, with a 60-day notice-and-cure step when the Attorney General finds a cure possible. |
| Cure period | From Jan 1, 2027, the Attorney General must give notice and 60 days to cure before suing if a cure is possible; not required for knowing or repeated violations (§ 6-1-1706(3) as reenacted by SB 26-189; repealed Jan 1, 2030) |
Key dates
- The law takes effect
- Operator duties begin
- Annual report to the Attorney General begins
Related laws
- Colorado SB 24-205Colorado Artificial Intelligence ActIn effect since June 30, 2026; more from Jan. 1, 2027
- Colorado HB 26-1195AI in psychotherapyIn effect since Aug. 12, 2026
Note
Colorado SB 26-189 rewrites this part of the state’s consumer protection law on January 1, 2027. Where these provisions will sit after that has not been published yet.
Sources
- Chapter 208, Session Laws of Colorado 2026 (HB 26-1263) Supports: All provisions, effective-date clause, approval date May 29, 2026.
- HB26-1263 bill page and history, Colorado General Assembly Supports: Votes and dates; Governor signed May 29, 2026; session-law table lists effective date 08/12/2026, Chapter 208.
- Colorado General Assembly home page Supports: Adjourned sine die on May 13, 2026.
- Chapter 131, Session Laws of Colorado 2026 (SB 26-189) Supports: part 17 repealed and reenacted Jan 1, 2027; new § 6-1-1706 enforcement and cure; reenacted § 6-1-1708 is unrelated.
- X.AI LLC v. Weiser, D. Colo. 1:26-cv-01515 (docket, Justia) Supports: Apr 27, 2026 order pausing enforcement; United States intervention.
- Colorado Attorney General: artificial intelligence rulemaking Supports: SB 26-189 effective Jan 1, 2027; proposed rules and hearing date.