AI Frontier Institute

Conversational Artificial Intelligence Service Operator Requirements

View primary source →

House Bill 26-1263, signed by Governor Polis on May 29, 2026, adds duties for operators of conversational artificial intelligence services to part 17 of article 1 of title 6 of the Colorado Revised Statutes. A conversational AI service is a publicly available AI system that primarily simulates human conversation (6-1-1701(3.5)). The definition excludes, with conditions, tools built mainly for developers, commerce or customer service, internal business use, narrow-topic tools, voice assistants, video game and theme park characters, health uses covered by HIPAA, school tools, and features inside other apps. From January 1, 2027, operators must tell every user the service is AI at the start of each day's first interaction, at least every three hours or through a persistent notice, and whenever asked (6-1-1708(3)). They must run a suicide and self-harm protocol that refers users to crisis services, not law enforcement, with escalation procedures for repeated or severe crisis signs (6-1-1708(4)), and may not claim outputs come from or equal a licensed health care, legal or mental health professional or a dietitian (6-1-1708(5)). Operators must estimate users' ages with commercially reasonable or generally accepted methods. For users they know are minors, they must give AI disclosures, avoid unpredictable engagement rewards, take measures to stop the service from producing explicit sexual conduct or intimate digital depictions (medical and reproductive health information is excluded) and responses that simulate emotional dependence, romantic companionship, or claims to be human or sentient, run protocols that prohibit sexual conduct with a minor and stop engaging when prompted about it, comply with Colorado's privacy law for minors' data, and offer privacy and parental controls, including over memory and the use of data for training (6-1-1708(2)). From July 1, 2027, operators report each year to the Attorney General on crisis referrals and safeguards, without user identifiers, and the Attorney General publishes the data; operators must measure suicidal ideation and self-harm with evidence-based methods (6-1-1708(6)). The act takes effect 90 days after the session adjourned (August 12, 2026, if adjournment was May 13), unless a referendum petition is filed against it.

← Back to the tracker