Law / United States / 
Colorado
HB 26-1263 (2026), Conversational AI Service Operator Requirements
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://leg.colorado.gov/bill_files/116772/downloadIn force since .
An AI transparency rule binding private bodies.
- Enforcement body
- Colorado Attorney General
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Content labelling, Design code, Reporting
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Filed with regulator, Published summary
What it requires
- Starting , use commercially reasonable or generally accepted methods to estimate the age of your account holders and other users, and do not willfully disregard clear and convincing information that one of them is a minorNIST AI RMFMAP 3.3
- Starting , if you know an account holder or user is a minor, clearly and conspicuously disclose that they are interacting with artificial intelligence, in response to their prompts asking whether the service is artificially generated and not human, and through a persistent visible disclaimer on a product with a screen interface, an intermittent audio disclaimer on a product without one, or a disclosure at the beginning of each interaction that recurs at least once every three hours of a continuous interaction
- Starting , if you know an account holder or user is a minor, do not give them points or similar rewards at unpredictable intervals meant to increase engagementNIST AI RMFMAP 1.6
- Starting , if you know an account holder or user is a minor, institute technically feasible measures preventing the service from producing explicit sexual content or intimate digital depictions involving a minor, or from engaging in or encouraging explicit sexual conduct with a minor, and reasonable measures preventing it from claiming to be human or sentient, simulating a romantic companionship, or role-playing an adult-minor romantic relationshipNIST AI RMFMEASURE 2.6NIST AI RMFMEASURE 2.8
- Starting , if you know an account holder or user is a minor, offer them and their parent or guardian tools to manage privacy and account settings, including whether the service retains prior interactions for personalization or uses their data to train the serviceNIST AI RMFMAP 1.6
- Starting , disclose to every user, not only minors, that the service is artificial intelligence (at the beginning of the user's first interaction each day, at least once every three hours of a continuous interaction or through a persistent visible disclosure, and in response to user prompts asking whether the service is artificially generated and not human), implement a protocol for responding to a user prompt about suicidal ideation or self-harm that refers the user to a crisis service provider rather than law enforcement, and do not represent the service's output as coming from a licensed health-care, legal, or mental-health professional or a qualified dietitian
- Starting , report annually to the Attorney General on the number of crisis-service-provider referrals issued and the protocols used to detect, prevent, and respond to suicidal ideation or self-harm, without including any user-identifying informationNIST AI RMFGOVERN 1.1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MEASURE 2.6The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-03Dangerous, Violent, or Hateful Content
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-09Information Security
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
HB 26-1263 states no AI-specific penalty. C.R.S. 6-1-1706, added by SB 26-189, deems a Part 17 violation, which now includes this section, a deceptive trade practice under the Colorado Consumer Protection Act, so the Act's general civil-penalty section, C.R.S. 6-1-112, governs. Section 6-1-112(1)(a) sets a civil penalty of not more than twenty thousand dollars for each violation, counted separately per consumer or transaction. Two adjoining, narrower tiers in the same section could reach a related violation depending on the facts: 6-1-112(1)(b) sets a civil penalty of not more than ten thousand dollars for each violation of a related court order or injunction, and 6-1-112(1)(c) sets a civil penalty of not more than fifty thousand dollars for each violation committed against an elderly person.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Person
- Per violation amount
- 20,000
What it makes you log
Who may demand the log
Regulator, Public
What the log must hold
Output reference
Logging duty
Subsection (6) requires an operator to report annually to the Attorney General the number of crisis-service-provider referral notifications it issued in the preceding year, the protocols it implemented to detect, remove and respond to suicidal-ideation or self-harm content, and to use evidence-based methods for measuring suicidal ideation or self-harm when compiling that report. The clause never uses the words logs, records, event recording, or an audit trail; it requires the operator to be able to count and describe what its service did over the year, which cannot be done without an underlying record. No retention period is stated for that underlying record.
- Kind
- Implicit
- As of
- Provision
- C.R.S. 6-1-1708(6)(a) to (d)
- Trigger
- content_generation
What this law does
An operator that develops and makes publicly available, or offers to a consumer, a conversational artificial intelligence service must use commercially reasonable or generally accepted methods to estimate a user's age, and must not willfully disregard clear and convincing information that an account holder or user is a minor. The act's effective date is . The age-estimation duties carry no start date later than that effective date.
Starting , if an operator knows an account holder or user is a minor, the operator must disclose that the service is artificial intelligence, withhold unpredictable-interval engagement rewards from the minor, prevent the service from producing explicit sexual content, intimate digital depictions, or statements simulating romantic companionship or emotional dependence with the minor, and give the minor and a parent or guardian tools to manage privacy and account settings.
Starting , an operator must also disclose to every user, not only minors, that the service is artificial intelligence, run a suicide and self-harm response protocol that refers a user to a crisis service provider rather than law enforcement, and not represent the service's output as coming from a licensed health-care, legal, or mental-health professional or a qualified dietitian; starting , it must report annually to the Attorney General on crisis referrals and self-harm safeguards without including user-identifying information.
Signed as Chapter 208 and added to Part 17 of Title 6 alongside SB 24-205 and SB 26-189, a violation of this duty is a deceptive trade practice under the Colorado Consumer Protection Act enforced by the Colorado Attorney General, subject to a 60-day right to cure before an enforcement action, and creates no new private right of action.
When LexLint raises it
When your app profile says your app deploys a chatbot, generates content with AI, processes voice recordings or serves under-18s.
Back to the example · Lint your app
Page updated .