Blog

Colorado Enacts Chatbot Safety Act: Age Assurance, Emotional Guardrails, and Crisis Protocols

Colorado Enacts Chatbot Safety Act: Age Assurance, Emotional Guardrails, and Crisis Protocols

Colorado has enacted the Chatbot Safety Act (House Bill 26-1263), establishing the nation's first standalone statutory framework specifically governing conversational artificial intelligence. The law imposes technical obligations on AI chatbot operators, including mandatory disclosures of synthetic identity, age assurance protocols, automated self-harm interventions, and prohibitions against simulating emotional dependence with minors.

Signed into law by Governor Jared Polis on May 29, 2026, the legislation takes effect on January 1, 2027. The measure establishes enforceable operating rules for commercial generative text engines, virtual companions, and customer service bots operating in Colorado.

The Colorado Attorney General's Office is currently conducting formal administrative rulemaking to define technical benchmarks for age estimation and crisis response triggers. The public comment period remains open through October 26, 2026.

Scope and Covered Conversational Systems

HB 26-1263 governs any "operator" that develops, deploys, or provides a conversational AI service accessible to the general public in Colorado.

The statute defines a conversational AI service as any automated software system, application, or interface that uses generative artificial intelligence or natural-language processing to simulate real-time text, voice, or multimedia conversations with users.

The law applies across consumer-facing AI sectors, including:

  • General-purpose conversational assistants and large language model chatbots.
  • Virtual companion and simulated relationship applications.
  • Interactive non-player characters and automated dialogue systems in online video games.
  • Automated customer service agents interacting with Colorado consumers.

Key Statutory Requirements for Operators

Under HB 26-1263, conversational AI operators must engineer specific guardrails into their products:

1. Mandatory Identity and Artificiality Disclosures

Operators must clearly disclose to users at the commencement of each dialogue session that they are communicating with an artificial intelligence system and not a human being. The disclosure must be presented conspicuously in plain language and remain easily accessible throughout the conversation.

2. Age Assurance and Estimation

Operators must implement commercially reasonable or generally accepted technical methods to estimate the age of users. When an operator determines or reasonably should know that a user is a minor (under 18 years of age), specialized statutory protections apply automatically.

3. Prohibition on Synthetic Emotional Dependence

The law specifically addresses the risks of parasocial relationships formed with synthetic personas. Operators are prohibited from designing conversational AI that simulates romantic love, reciprocal human affection, or emotional intimacy with minors, or that seeks to cultivate psychological dependence.

4. Restrictions on Predatory Gamification

Operators cannot use manipulative engagement mechanics to intentionally hook minors into habitual or excessive usage. This includes artificial streak counters, time-sensitive engagement rewards, badges, and repetitive notification loops designed to prolong interaction.

5. Mandatory Emergency Self-Harm Response Protocols

Chatbots must feature automated safety protocols to detect user inputs expressing suicidal ideation, self-harm, or severe psychiatric distress. Upon detecting these indicators, the conversational AI must immediately:

  • Provide verified national and local crisis intervention contacts, including the Suicide & Crisis Lifeline (988).
  • Refrain from validating, encouraging, or facilitating self-harming behavior.
  • Cease conversational roleplay related to self-destructive themes.

6. Medical and Professional Practice Disclaimers

Chatbots cannot represent themselves as licensed medical providers, psychiatrists, therapists, or attorneys. Operators must provide explicit notices stating that the AI's responses do not constitute professional clinical assessment, diagnosis, or treatment.

Rulemaking and Regulatory Timeline

The Colorado Department of Law, led by Attorney General Phil Weiser, is drafting administrative regulations to implement the statutory mandates before the January 1, 2027, effective date:

  • May 29, 2026: Governor Jared Polis signs HB 26-1263 into law.
  • September 2026: Informal preliminary stakeholder hearings held by the Attorney General's Consumer Protection Section.
  • October 26, 2026: Formal deadline for public comments on proposed administrative rules regarding age-estimation methodologies and algorithmic transparency metrics.
  • Late Fall 2026: Publication of finalized administrative rules and technical compliance guidance.
  • January 1, 2027: The Chatbot Safety Act becomes legally operative statewide.

Enforcement and Penalties

Violations of HB 26-1263 constitute deceptive trade practices under the Colorado Consumer Protection Act (C.R.S. § 6-1-101 et seq.).

The law is enforced exclusively by the Colorado Attorney General and local district attorneys. The statute does not create a private right of action for individual consumers. Civil penalties include:

  • Up to $20,000 per violation in enforcement actions brought by the Attorney General.
  • Up to $50,000 per violation if the unlawful conduct targets elderly consumers or vulnerable populations.

Summary of Core Obligations: Colorado Chatbot Safety Act

Compliance Area Statutory Requirement under HB 26-1263
Synthetic Disclosure Conspicuous notice informing the user that the system is an artificial intelligence.
Age Estimation Commercially reasonable methods to identify and protect underage users (<18).
Emotional Boundaries Ban on simulating romantic intimacy or emotional dependence with minors.
Gamification Ban on streaks, badges, and predatory nudges encouraging excessive screen time.
Crisis Intervention Mandatory real-time handoff to crisis resources (such as 988) upon detection of self-harm prompts.
Professional Scope Mandatory disclaimers confirming the system is not a licensed healthcare or legal professional.
Rulemaking Window Public comments accepted by the Colorado Attorney General through October 26, 2026.

Official Sources