Colorado Chatbot Law (HB 26-1263): What It Means for Your Business

What the law actually requires

The headline duty is simple and directly affects any consumer-facing chatbot: operators of conversational AI services must clearly disclose that a user is communicating with artificial intelligence, not a person. The Act also adds protections aimed at consumer harm — operators can't represent the bot as a licensed professional, must maintain self-harm and crisis response protocols, and must apply added safeguards for minors (reasonable age estimation, limits on explicit content, and guardrails against simulated emotional dependency). Covered operators also file an annual report with the Attorney General.

Does it apply to my small business?

The Act regulates "operators" — entities that develop and make a conversational AI service publicly available. If you build or offer the chatbot service itself, you're squarely covered. If you simply embed a third-party widget on your site — Intercom, Drift, Tidio, Zendesk AI, an off-the-shelf ChatGPT plugin — you're often a customer of an operator rather than an operator yourself. That boundary is being sharpened in the Attorney General's rulemaking before the January 1, 2027 effective date.

Here's the practical takeaway either way: the safe, low-cost move is to add a clear AI disclosure near your chat widget now. It's exactly what the Chatbot Safety Act pushes toward, it aligns with Colorado's separate ADMT law (SB 26-189) for consumer-facing AI, and it's the kind of easy, visible gap an Attorney General looks for first.

The penalty

Enforcement falls to the Colorado Attorney General, and violations are treated as deceptive trade practices under the Colorado Consumer Protection Act — carrying civil penalties of up to $20,000 per violation. Because each affected consumer can count separately, exposure adds up fast for a busy chat widget.

Rulemaking status: draft rules are out now (updated August 12, 2026)

This is the part most guides haven't caught up with yet. On August 11, 2026, the Colorado Department of Law filed proposed Automated Decision-Making Technology & Conversational Artificial Intelligence Service rules with the Secretary of State. One rule package implements both the Chatbot Safety Act (HB 26-1263) and the ADMT Act (SB 26-189). An earlier pre-rulemaking comment form closed July 13, 2026; this is the formal round.

Worth knowing: the Chatbot Safety Act did not itself require rulemaking. The Attorney General chose to fold it in anyway, on the view that operators need clearer compliance obligations — including what actually goes in the required annual report to the AG. If you expect to be a covered operator, that annual-report content is the detail to read first, because it's the duty with the least statutory guidance.

Written comments are being accepted through October 26, 2026. An earlier cutoff applies for comments to be weighed in the AG's proposed revisions, so check the current date on the Attorney General's rulemaking page before you rely on the October date. Comments are posted publicly and may become part of the rulemaking record. Small businesses are exactly the constituency that tends not to file comments here — if the operator/customer boundary below matters to you, this is the window in which to say so.

What to do before January 1, 2027

• Add a plain-language notice at the start of any chat: e.g., "You're chatting with an AI assistant."
• Make sure the bot never implies it's a licensed professional (legal, medical, financial).
• Offer an easy path to reach a human.
• Document which chat and AI tools you run and where the disclosures live.
• Read the draft rules filed August 11, 2026 — and comment before the window closes if the operator/customer line affects you.

How to check where you stand

ComplianceBeacon scans your site, detects the AI and chatbot tools you're actually running, and tells you which Colorado disclosures apply — with copy-paste language you can add today. Run a free scan.