EveryAILaw.comDoes Colorado Conversational AI Service Operator Requirements (HB 26-1263) require Incident Reporting?
Colorado • enacted
Yes — 1 provision
Requirements at a glance
This regulation imposes 8 specific requirements for Incident Reporting across 1 provision:
- Annual filing — Annually report to the Attorney General's office on and after 2027-07-01 (§ 6-1-1708(6)(a))
- Referral count — Report the number of times the operator issued a crisis service provider referral notification in the preceding calendar year (§ 6-1-1708(6)(a)(I))
- Detection protocols — Report any protocols implemented to detect, remove, and respond to instances of suicidal ideation or self-harm by a user (§ 6-1-1708(6)(a)(II))
- Prevention protocols — Report any protocols implemented to prevent a service response about suicidal ideation or self-harm actions (§ 6-1-1708(6)(a)(III))
- Attorney-General-determined metrics — Report any additional metrics necessary to determine the efficacy and reliability of implemented safeguards or detection, removal, and response protocols, as determined by the Attorney General (§ 6-1-1708(6)(a)(IV))
- No personal information — The report must not include any identifiers or personal information about a user (§ 6-1-1708(6)(b))
- Public posting — The Attorney General's office posts data from the reports on its public website (§ 6-1-1708(6)(c))
- Evidence-based measurement — For the purpose of creating the report, the operator must use evidence-based methods for measuring suicidal ideation or self-harm (§ 6-1-1708(6)(d))
Annual Attorney General Reporting #
This is a filing to a regulator, not a website self-disclosure — the contrast with Washington ESHB 2225 and Oregon, which require operators to publish crisis-referral counts themselves. It starts six months after the operator duties, on 2027-07-01, so the first report covers a period already under the § 6-1-1708(4) protocol. The Attorney General may expand the report by determining additional metrics necessary to judge the efficacy and reliability of safeguards, which is an open-ended content hook without a rulemaking procedure attached. Reports must exclude user identifiers and personal information, and measurement must use evidence-based methods.
Requirements
| Requirement | Details |
|---|---|
| Annual filing | Annually report to the Attorney General's office on and after 2027-07-01 (§ 6-1-1708(6)(a)) |
| Referral count | Report the number of times the operator issued a crisis service provider referral notification in the preceding calendar year (§ 6-1-1708(6)(a)(I)) |
| Detection protocols | Report any protocols implemented to detect, remove, and respond to instances of suicidal ideation or self-harm by a user (§ 6-1-1708(6)(a)(II)) |
| Prevention protocols | Report any protocols implemented to prevent a service response about suicidal ideation or self-harm actions (§ 6-1-1708(6)(a)(III)) |
| Attorney-General-determined metrics | Report any additional metrics necessary to determine the efficacy and reliability of implemented safeguards or detection, removal, and response protocols, as determined by the Attorney General (§ 6-1-1708(6)(a)(IV)) |
| No personal information | The report must not include any identifiers or personal information about a user (§ 6-1-1708(6)(b)) |
| Public posting | The Attorney General's office posts data from the reports on its public website (§ 6-1-1708(6)(c)) |
| Evidence-based measurement | For the purpose of creating the report, the operator must use evidence-based methods for measuring suicidal ideation or self-harm (§ 6-1-1708(6)(d)) |
Penalties
| Violation | Fine |
|---|---|
| Enforcement route | Added to part 17 of article 1 of title 6, so enforcement runs through the Colorado Consumer Protection Act with the Attorney General |
| Penalty amount | HB 26-1263 sets no penalty amount |
| Private right of action | HB 26-1263 creates no private right of action |