EveryAILaw.comDoes Colorado Conversational AI Service Operator Requirements (HB 26-1263) require Risk Assessment?
Colorado • enacted
Yes — 3 provisions
Requirements at a glance
This regulation imposes 16 specific requirements for Risk Assessment across 3 provisions:
- Estimate user age — Use commercially reasonable methods or generally accepted methods to estimate the age of account holders or users (§ 6-1-1708(2))
- No willful disregard — Do not willfully disregard clear and convincing information that an account holder or user is a minor (§ 6-1-1708(2))
- Estimate is knowledge — The estimated age or age range of a minor account holder or user is considered knowledge of the minor's age for the whole of § 6-1-1708 (§ 6-1-1708(2))
- Minor user definition — A minor user is a user the operator has knowledge is a minor by using commercially reasonable or generally accepted age-estimation methods (§ 6-1-1708(1)(c))
- Trigger for minor duties — Where the operator knows an account holder or user is a minor, the duties at § 6-1-1708(2)(a)-(h) apply on and after 2027-01-01 (§ 6-1-1708(2))
- No variable-interval rewards — Do not provide the minor with points or similar rewards at unpredictable intervals with the intent to encourage increased engagement (§ 6-1-1708(2)(b))
- Sexual content controls — Institute technically feasible measures to prevent the service from producing textual, visual, or aural depictions of explicit sexual conduct, producing an intimate digital depiction, generating a statement that the minor should engage in explicit sexual conduct, or engaging in erotic or sexually explicit interactions with the minor (§ 6-1-1708(2)(c)(I)-(IV))
- Emotional-dependence controls — Institute reasonable measures to prevent the service from formulating, structuring, or optimizing a response that simulates emotional dependence or isolation from real-world supports (§ 6-1-1708(2)(d))
- Named prohibited outputs — Those measures must prevent an explicit claim that the service is human or artificially sentient, a statement that simulates a romantic companionship, and role-playing of an adult-minor romantic relationship (§ 6-1-1708(2)(d)(I)-(III))
- Prohibition protocol — Implement a protocol to prohibit the service from engaging in explicit sexual conduct with a minor (§ 6-1-1708(2)(e))
- Stop-engagement protocol — Implement a protocol for the service to stop engaging in response to a user prompt regarding explicit sexual conduct with a minor (§ 6-1-1708(2)(f))
- Crisis protocol — Implement a protocol for the service to respond to a user prompt regarding suicidal ideation or self-harm (§ 6-1-1708(4))
- Crisis service referral — The protocol must include user referral to a crisis service provider such as a suicide hotline, a crisis text line, or another appropriate crisis service (§ 6-1-1708(4))
- Law enforcement excluded — The referral expressly does not include a law enforcement agency (§ 6-1-1708(4))
- Escalation procedures — The protocol must include escalation procedures for repeated or severe crisis indicators (§ 6-1-1708(4))
- Self-harm definition — Self-harm means intentional self-injury, with or without the intent to cause death (§ 6-1-1701(16.5))
Age Estimation and Minor Identification #
HB 26-1263 was signed 2026-05-29 and adds subsections to C.R.S. § 6-1-1701 and adds § 6-1-1708 to part 17 of article 1 of title 6. SB 26-189, signed two weeks earlier on 2026-05-14, repeals and reenacts that same part 17 effective 2027-01-01 (tracked here as colorado-sb26-189). Whether § 6-1-1708 survives that repeal-and-reenactment unchanged is an open harmonization question for the revisor of statutes, and it lands on the same day these operator duties begin. Unresolved as of 2026-08-03 — no answer is asserted here. Separately, Colorado is the only 2026 state chatbot law that affirmatively requires age estimation by commercially reasonable or generally accepted methods and then deems the estimate to be knowledge of the minor's age, so age-blindness is not a defence. Note also that the age-estimation and willful-disregard sentences sit before the "on and after January 1, 2027" clause in the same paragraph; the 2027-01-01 date is recorded here because the clause governs the operator duties the estimate triggers.
Requirements
| Requirement | Details |
|---|---|
| Estimate user age | Use commercially reasonable methods or generally accepted methods to estimate the age of account holders or users (§ 6-1-1708(2)) |
| No willful disregard | Do not willfully disregard clear and convincing information that an account holder or user is a minor (§ 6-1-1708(2)) |
| Estimate is knowledge | The estimated age or age range of a minor account holder or user is considered knowledge of the minor's age for the whole of § 6-1-1708 (§ 6-1-1708(2)) |
| Minor user definition | A minor user is a user the operator has knowledge is a minor by using commercially reasonable or generally accepted age-estimation methods (§ 6-1-1708(1)(c)) |
| Trigger for minor duties | Where the operator knows an account holder or user is a minor, the duties at § 6-1-1708(2)(a)-(h) apply on and after 2027-01-01 (§ 6-1-1708(2)) |
Penalties
| Violation | Fine |
|---|---|
| Enforcement route | § 6-1-1708 is added to part 17 of article 1 of title 6, so enforcement runs through the Colorado Consumer Protection Act with the Attorney General |
| Penalty amount | HB 26-1263 sets no penalty amount |
| Private right of action | HB 26-1263 creates no private right of action |
Minor Engagement, Sexual Content, and Emotional-Dependence Limits #
Colorado sets two different standards of care inside the same subsection: sexual-content controls must be "technically feasible measures" (§ 6-1-1708(2)(c)) while emotional-dependence controls need only "reasonable measures" (§ 6-1-1708(2)(d)), so the sexual-content duty is the more demanding of the two. The emotional-dependence list reaches model behaviour rather than interface copy — the service must be prevented from explicitly claiming to be human or artificially sentient, from simulating romantic companionship, and from role-playing an adult-minor romantic relationship. The variable-reward ban at § 6-1-1708(2)(b) targets points or similar rewards at unpredictable intervals intended to increase engagement.
Requirements
| Requirement | Details |
|---|---|
| No variable-interval rewards | Do not provide the minor with points or similar rewards at unpredictable intervals with the intent to encourage increased engagement (§ 6-1-1708(2)(b)) |
| Sexual content controls | Institute technically feasible measures to prevent the service from producing textual, visual, or aural depictions of explicit sexual conduct, producing an intimate digital depiction, generating a statement that the minor should engage in explicit sexual conduct, or engaging in erotic or sexually explicit interactions with the minor (§ 6-1-1708(2)(c)(I)-(IV)) |
| Emotional-dependence controls | Institute reasonable measures to prevent the service from formulating, structuring, or optimizing a response that simulates emotional dependence or isolation from real-world supports (§ 6-1-1708(2)(d)) |
| Named prohibited outputs | Those measures must prevent an explicit claim that the service is human or artificially sentient, a statement that simulates a romantic companionship, and role-playing of an adult-minor romantic relationship (§ 6-1-1708(2)(d)(I)-(III)) |
| Prohibition protocol | Implement a protocol to prohibit the service from engaging in explicit sexual conduct with a minor (§ 6-1-1708(2)(e)) |
| Stop-engagement protocol | Implement a protocol for the service to stop engaging in response to a user prompt regarding explicit sexual conduct with a minor (§ 6-1-1708(2)(f)) |
Penalties
| Violation | Fine |
|---|---|
| Enforcement route | Added to part 17 of article 1 of title 6, so enforcement runs through the Colorado Consumer Protection Act with the Attorney General |
| Penalty amount | HB 26-1263 sets no penalty amount |
| Private right of action | HB 26-1263 creates no private right of action |
Suicide and Self-Harm Response Protocol #
Colorado expressly excludes referral to a law enforcement agency from the crisis protocol — the referral must go to a crisis service provider such as a suicide hotline or crisis text line, and the statute says "but not including a law enforcement agency." That carve-out is unique among the 2026 state chatbot laws and rules out the wellness-check escalation pattern several operators use today. The protocol must also carry escalation procedures for repeated or severe crisis indicators, so a single-response referral does not satisfy the section. The ability to sustain suicide or self-harm dialogue is itself part of what pulls a product into scope: several of the § 6-1-1701(3.5)(b) carve-outs are conditioned on the product being unable to maintain or encourage such dialogue.
Requirements
| Requirement | Details |
|---|---|
| Crisis protocol | Implement a protocol for the service to respond to a user prompt regarding suicidal ideation or self-harm (§ 6-1-1708(4)) |
| Crisis service referral | The protocol must include user referral to a crisis service provider such as a suicide hotline, a crisis text line, or another appropriate crisis service (§ 6-1-1708(4)) |
| Law enforcement excluded | The referral expressly does not include a law enforcement agency (§ 6-1-1708(4)) |
| Escalation procedures | The protocol must include escalation procedures for repeated or severe crisis indicators (§ 6-1-1708(4)) |
| Self-harm definition | Self-harm means intentional self-injury, with or without the intent to cause death (§ 6-1-1701(16.5)) |
Penalties
| Violation | Fine |
|---|---|
| Enforcement route | Added to part 17 of article 1 of title 6, so enforcement runs through the Colorado Consumer Protection Act with the Attorney General |
| Penalty amount | HB 26-1263 sets no penalty amount |
| Private right of action | HB 26-1263 creates no private right of action |