Colorado AI Chatbot Law: What It Requires
Colorado passed the first US state law aimed specifically at AI chatbots and minors. Whether it applies to you turns on one word: operator.
Colorado's Chatbot Safety Act, HB 26-1263, takes effect on 1 January 2027. It is the first US state law written specifically about AI chatbots and minors, and it lands on a category most builders have not thought of as regulated: any publicly available system that simulates human conversation in text, audio or visual form.
Whether it touches you depends almost entirely on one distinction, so start there.
Operator or customer
The law applies to entities that develop and make publicly available a conversational AI service. It does not apply to businesses that buy one.
A dental practice that drops a third-party chat widget onto its booking page is a customer. The company that built and sells the widget is the operator, and carries the compliance obligations. That line covers a large share of the small businesses currently adding chat to their sites.
It does not cover you if you built the assistant yourself and shipped it to the public. If you wired a model to a system prompt, put it behind a URL, and let anyone talk to it, you are the operator of a conversational AI service in the sense the statute means, whether or not your product is aimed at teenagers.
The five obligations
Once you are an operator, five things apply from 1 January 2027, per the text and summaries of HB 26-1263:
Disclosure. Users must be told they are talking to AI rather than a person. Not buried in terms, but as part of the interaction.
Self-harm protocols. You must maintain documented procedures for responding to expressions of suicidal ideation or self-harm. Documented is the operative word. An informal belief that the model handles it is not a protocol.
Age estimation and minor protections. Operators must estimate user age. For users identified as minors: block sexually explicit content, avoid design that fosters emotional dependence, remove engagement rewards, and provide privacy and account-management tools.
Annual reporting. Compliance documentation goes to the Colorado Attorney General each year.
No professional impersonation. Output cannot be presented as provided by, endorsed by, or equivalent to the services of a licensed or certified professional. Therapy-adjacent, legal-adjacent and medical-adjacent assistants are the obvious targets.
The bill was signed in May 2026 and reported at the time by local coverage of the signing, giving operators roughly nineteen months of lead time.
What each obligation costs you to build
Only two of the five are genuinely hard.
Obligation | Build cost |
|---|---|
Disclosure | Low. A persistent label in the chat UI. |
No professional impersonation | Low. System prompt and marketing copy review. |
Annual reporting | Low, once the rest exists. |
Self-harm protocol | Medium. Detection, a defined response, an escalation path, and a written record of all three. |
Age estimation | High. There is no clean way to estimate age without collecting more data than you wanted. |
Age estimation is the one to think about early, because the cheap implementations conflict with each other. Self-declared birthdates are trivially bypassed. Behavioural inference means profiling your users. Document upload means holding identity documents belonging to minors, which creates a worse problem than the one it solves.
There is no consensus answer yet, and rulemaking will likely produce more guidance before the effective date. What you can do now is design so that the age signal is a single input to a policy layer, rather than something threaded through your prompts, so that swapping the method later is a small change.
Why this matters outside Colorado
Colorado moved first, not last. The pattern in state AI legislation through 2026 has been narrow, use-case-specific rules rather than broad statutes, which means the next few will look structurally similar and differ in detail. Building to the strictest version you are exposed to is usually cheaper than building three.
It also rhymes with what is happening in Europe, where transparency obligations around telling users they are dealing with AI began applying in August 2026. If you already handled the EU transparency rules, the Colorado disclosure requirement is close to free.
The rest is ordinary product work you should probably be doing anyway. Guardrails for a customer-facing chatbot covers the detection and response layer the self-harm protocol needs. Keeping a chatbot on topic covers most of the impersonation risk. And if you collect age signals, your privacy policy has to say so.
Questions people ask
Does this apply if my chatbot is not aimed at children?
Yes. The obligations attach to publicly available conversational services, not to services marketed to minors. Age estimation exists precisely because a general-audience product will have minors in it.
I use a third-party chatbot on my site. Am I covered?
Generally no. The vendor that develops and publishes the service is the operator. That said, if you have significantly customised the behaviour and publish it under your own name, the line gets less comfortable and is worth a lawyer's twenty minutes.
What happens if I ignore it?
Enforcement runs through the Attorney General, and annual compliance reporting is one of the obligations, so non-filing is itself visible. This is not a statute you can quietly fail.
Is January 2027 the deadline for everything?
That is the effective date for the obligations. Rulemaking may add detail before then, which is a reason to build the flexible version rather than the literal one.
How did this land?
About the author
Senior Editor, AI & Product
Cecilia leads the Swarmz editorial desk. She has spent a decade turning complex AI and product topics into writing people actually finish, and she owns the blog's quality bar.
