EveryAILaw.comDoes Colorado Conversational AI Service Operator Requirements (HB 26-1263) require Risk Assessment?
Colorado • enacted
Yes — 3 provisions
Requirements at a glance
This regulation imposes 16 specific requirements for Risk Assessment across 3 provisions:
- Estimate user age — Use commercially reasonable methods or generally accepted methods to estimate the age of account holders or users (§ 6-1-1708(2))
- No willful disregard — Do not willfully disregard clear and convincing information that an account holder or user is a minor (§ 6-1-1708(2))
- Estimate is knowledge — The estimated age or age range of a minor account holder or user is considered knowledge of the minor's age for the whole of § 6-1-1708 (§ 6-1-1708(2))
- Minor user definition — A minor user is a user the operator has knowledge is a minor by using commercially reasonable or generally accepted age-estimation methods (§ 6-1-1708(1)(c))
- Trigger for minor duties — Where the operator knows an account holder or user is a minor, the duties at § 6-1-1708(2)(a)-(h) apply on and after 2027-01-01 (§ 6-1-1708(2))
- No variable-interval rewards — Do not provide the minor with points or similar rewards at unpredictable intervals with the intent to encourage increased engagement (§ 6-1-1708(2)(b))
- Sexual content controls — Institute technically feasible measures to prevent the service from producing textual, visual, or aural depictions of explicit sexual conduct, producing an intimate digital depiction, generating a statement that the minor should engage in explicit sexual conduct, or engaging in erotic or sexually explicit interactions with the minor (§ 6-1-1708(2)(c)(I)-(IV))
- Emotional-dependence controls — Institute reasonable measures to prevent the service from formulating, structuring, or optimizing a response that simulates emotional dependence or isolation from real-world supports (§ 6-1-1708(2)(d))
- Named prohibited outputs — Those measures must prevent an explicit claim that the service is human or artificially sentient, a statement that simulates a romantic companionship, and role-playing of an adult-minor romantic relationship (§ 6-1-1708(2)(d)(I)-(III))
- Prohibition protocol — Implement a protocol to prohibit the service from engaging in explicit sexual conduct with a minor (§ 6-1-1708(2)(e))
- Stop-engagement protocol — Implement a protocol for the service to stop engaging in response to a user prompt regarding explicit sexual conduct with a minor (§ 6-1-1708(2)(f))
- Crisis protocol — Implement a protocol for the service to respond to a user prompt regarding suicidal ideation or self-harm (§ 6-1-1708(4))
- Crisis service referral — The protocol must include user referral to a crisis service provider such as a suicide hotline, a crisis text line, or another appropriate crisis service (§ 6-1-1708(4))
- Law enforcement excluded — The referral expressly does not include a law enforcement agency (§ 6-1-1708(4))
- Escalation procedures — The protocol must include escalation procedures for repeated or severe crisis indicators (§ 6-1-1708(4))
- Self-harm definition — Self-harm means intentional self-injury, with or without the intent to cause death (§ 6-1-1701(16.5))
Age Estimation and Minor Identification
The 2026 C.R.S. publishes the section as § 6-1-1708 through 2026-12-31, then expressly harmonizes it with SB 26-189 and relocates it to § 6-1-1710 effective 2027-01-01. The separate predecessor-framework operative history remains unresolved, and no court interpretation is claimed. Colorado requires age estimation by commercially reasonable or generally accepted methods and deems the estimate to be knowledge of the minor's age. The age-estimation and willful-disregard sentences sit before the "on and after January 1, 2027" clause in the same paragraph. The saved pending status and 2027-01-01 date describe the minor-triggered duties in the list, not a resolved conclusion that the preceding age-estimation commands have no effect before 2027. The official bill summary broadly describes 2027 commencement; this textual timing question remains unresolved.
Requirements
| Requirement | Details |
|---|---|
| Estimate user age | Use commercially reasonable methods or generally accepted methods to estimate the age of account holders or users (§ 6-1-1708(2)) |
| No willful disregard | Do not willfully disregard clear and convincing information that an account holder or user is a minor (§ 6-1-1708(2)) |
| Estimate is knowledge | The estimated age or age range of a minor account holder or user is considered knowledge of the minor's age for the whole of § 6-1-1708 (§ 6-1-1708(2)) |
| Minor user definition | A minor user is a user the operator has knowledge is a minor by using commercially reasonable or generally accepted age-estimation methods (§ 6-1-1708(1)(c)) |
| Trigger for minor duties | Where the operator knows an account holder or user is a minor, the duties at § 6-1-1708(2)(a)-(h) apply on and after 2027-01-01 (§ 6-1-1708(2)) |
Penalties
| Violation | Fine |
|---|---|
| Enforcement route | Current § 6-1-1706 assigns Part 17 enforcement exclusively to the Attorney General; from 2027-01-01, § 6-1-1706(1)-(2) directs Attorney General enforcement through the Colorado Consumer Protection Act. Application of the future developer/deployer cure wording to an operator is unresolved. |
| Civil penalty | HB 26-1263 sets no separate dollar figure. The general CCPA ceiling under § 6-1-112(1)(a) is up to USD 20,000 per violation, separately per consumer or transaction, in an Attorney General civil action. Future § 6-1-1706(3) has a 60-day cure notice when the Attorney General deems cure possible for a developer or deployer, subject to its knowing/repeated-violation exception; application to a distinct operator remains unresolved. |
| Private right of action | Part 17 creates no new private right of action; future § 6-1-1706(4) preserves existing state and federal rights and remedies. |
Minor Engagement, Sexual Content, and Emotional-Dependence Limits
Colorado states two different measures inside the same subsection: sexual-content controls must be "technically feasible measures" (§ 6-1-1708(2)(c)) while emotional-dependence controls require "reasonable measures" (§ 6-1-1708(2)(d)). The text does not rank which standard is more demanding in every application. The emotional-dependence list reaches model behaviour rather than interface copy — the service must be prevented from explicitly claiming to be human or artificially sentient, from simulating romantic companionship, and from role-playing an adult-minor romantic relationship. The variable-reward ban at § 6-1-1708(2)(b) targets points or similar rewards at unpredictable intervals intended to increase engagement.
Requirements
| Requirement | Details |
|---|---|
| No variable-interval rewards | Do not provide the minor with points or similar rewards at unpredictable intervals with the intent to encourage increased engagement (§ 6-1-1708(2)(b)) |
| Sexual content controls | Institute technically feasible measures to prevent the service from producing textual, visual, or aural depictions of explicit sexual conduct, producing an intimate digital depiction, generating a statement that the minor should engage in explicit sexual conduct, or engaging in erotic or sexually explicit interactions with the minor (§ 6-1-1708(2)(c)(I)-(IV)) |
| Emotional-dependence controls | Institute reasonable measures to prevent the service from formulating, structuring, or optimizing a response that simulates emotional dependence or isolation from real-world supports (§ 6-1-1708(2)(d)) |
| Named prohibited outputs | Those measures must prevent an explicit claim that the service is human or artificially sentient, a statement that simulates a romantic companionship, and role-playing of an adult-minor romantic relationship (§ 6-1-1708(2)(d)(I)-(III)) |
| Prohibition protocol | Implement a protocol to prohibit the service from engaging in explicit sexual conduct with a minor (§ 6-1-1708(2)(e)) |
| Stop-engagement protocol | Implement a protocol for the service to stop engaging in response to a user prompt regarding explicit sexual conduct with a minor (§ 6-1-1708(2)(f)) |
Penalties
| Violation | Fine |
|---|---|
| Enforcement route | Current § 6-1-1706 assigns Part 17 enforcement exclusively to the Attorney General; from 2027-01-01, § 6-1-1706(1)-(2) directs Attorney General enforcement through the Colorado Consumer Protection Act. Application of the future developer/deployer cure wording to an operator is unresolved. |
| Civil penalty | HB 26-1263 sets no separate dollar figure. The general CCPA ceiling under § 6-1-112(1)(a) is up to USD 20,000 per violation, separately per consumer or transaction, in an Attorney General civil action. Future § 6-1-1706(3) has a 60-day cure notice when the Attorney General deems cure possible for a developer or deployer, subject to its knowing/repeated-violation exception; application to a distinct operator remains unresolved. |
| Private right of action | Part 17 creates no new private right of action; future § 6-1-1706(4) preserves existing state and federal rights and remedies. |
Suicide and Self-Harm Response Protocol
Colorado expressly excludes referral to a law enforcement agency from the crisis protocol — the referral must go to a crisis service provider such as a suicide hotline or crisis text line, and the statute says "but not including a law enforcement agency." The exclusion applies to the required crisis-service referral. The text does not resolve every possible separate welfare-check or escalation practice, and a claim of uniqueness would require a separate comparative source review. The protocol must also carry escalation procedures for repeated or severe crisis indicators, so a single-response referral does not satisfy the section. The ability to sustain suicide or self-harm dialogue is itself part of what pulls a product into scope: several of the § 6-1-1701(3.5)(b) carve-outs are conditioned on the product being unable to maintain or encourage such dialogue.
Requirements
| Requirement | Details |
|---|---|
| Crisis protocol | Implement a protocol for the service to respond to a user prompt regarding suicidal ideation or self-harm (§ 6-1-1708(4)) |
| Crisis service referral | The protocol must include user referral to a crisis service provider such as a suicide hotline, a crisis text line, or another appropriate crisis service (§ 6-1-1708(4)) |
| Law enforcement excluded | The referral expressly does not include a law enforcement agency (§ 6-1-1708(4)) |
| Escalation procedures | The protocol must include escalation procedures for repeated or severe crisis indicators (§ 6-1-1708(4)) |
| Self-harm definition | Self-harm means intentional self-injury, with or without the intent to cause death (§ 6-1-1701(16.5)) |
Penalties
| Violation | Fine |
|---|---|
| Enforcement route | Current § 6-1-1706 assigns Part 17 enforcement exclusively to the Attorney General; from 2027-01-01, § 6-1-1706(1)-(2) directs Attorney General enforcement through the Colorado Consumer Protection Act. Application of the future developer/deployer cure wording to an operator is unresolved. |
| Civil penalty | HB 26-1263 sets no separate dollar figure. The general CCPA ceiling under § 6-1-112(1)(a) is up to USD 20,000 per violation, separately per consumer or transaction, in an Attorney General civil action. Future § 6-1-1706(3) has a 60-day cure notice when the Attorney General deems cure possible for a developer or deployer, subject to its knowing/repeated-violation exception; application to a distinct operator remains unresolved. |
| Private right of action | Part 17 creates no new private right of action; future § 6-1-1706(4) preserves existing state and federal rights and remedies. |