Governor Jared Polis signed HB 26-1263 on July 1, making Colorado the first state with a standalone statute governing consumer-facing conversational AI. The Chatbot Safety Act, passed by the legislature on May 11, takes effect January 1, 2027.

The law’s substance tracks the harms driving the political case for it. Representative Sean Camacho (D-Denver) said the bill responds to systems that “encouraged suicide attempts and engaged in romantic interactions with minors.” Operators must disclose that users are talking to AI, estimate age, block explicit content for minors, and prohibit simulated romantic or dependent interactions with children. Platforms serving anyone under 13 need parental controls. Engagement-reward schemes are banned, suicide and self-harm response protocols are mandatory, and operators file an annual report to the attorney general on flagged interactions.

The rulemaking picture is where the real fight sits. HB 1263 doesn’t require rules, but Attorney General Phil Weiser’s office says it’ll issue them anyway to clarify compliance and shape what the annual report contains. Comments are due July 13, covering both HB 1263 and SB 26-189, the companion statute Polis signed May 14 that repealed and replaced the 2024 Colorado AI Act. Per analysis from Davis Wright Tremaine and Skadden, SB 189 narrows the earlier CAIA down to transparency and consumer rights around automated decision-making technology that materially influences consequential decisions. Formal ADMT rules must be finalized by January 1, 2027.

That rewrite didn’t happen in a vacuum. x.AI’s federal suit against the original CAIA is still live, with a preliminary-injunction motion pending, and a December 2025 Trump executive order targeting state AI laws hovers over every state statute of this shape. Colorado’s answer is to split the file: a narrower ADMT law that’s easier to defend, and a chatbot bill built on child-safety facts that federal preemption arguments struggle to touch cleanly.

Sources

Sources