Colorado Chatbot Law (HB 26-1263): What It Means for Your Business

What the law actually requires

The headline duty is simple and directly affects any consumer-facing chatbot: operators of conversational AI services must clearly disclose that a user is communicating with artificial intelligence, not a person. The Act also adds protections aimed at consumer harm — operators can't represent the bot as a licensed professional, must maintain self-harm and crisis response protocols, and must apply added safeguards for minors (reasonable age estimation, limits on explicit content, and guardrails against simulated emotional dependency). Covered operators also file an annual report with the Attorney General.

Does it apply to my small business?

The Act regulates "operators" — entities that develop and make a conversational AI service publicly available. If you build or offer the chatbot service itself, you're squarely covered. If you simply embed a third-party widget on your site — Intercom, Drift, Tidio, Zendesk AI, an off-the-shelf ChatGPT plugin — you're often a customer of an operator rather than an operator yourself. That boundary is being sharpened in the Attorney General's rulemaking before the January 1, 2027 effective date.

Here's the practical takeaway either way: the safe, low-cost move is to add a clear AI disclosure near your chat widget now. It's exactly what the Chatbot Safety Act pushes toward, it aligns with Colorado's separate ADMT law (SB 26-189) for consumer-facing AI, and it's the kind of easy, visible gap an Attorney General looks for first.

The penalty

Enforcement falls to the Colorado Attorney General, and violations are treated as deceptive trade practices under the Colorado Consumer Protection Act — carrying civil penalties of up to $20,000 per violation. Because each affected consumer can count separately, exposure adds up fast for a busy chat widget.

What to do before January 1, 2027

• Add a plain-language notice at the start of any chat: e.g., "You're chatting with an AI assistant."
• Make sure the bot never implies it's a licensed professional (legal, medical, financial).
• Offer an easy path to reach a human.
• Document which chat and AI tools you run and where the disclosures live.
• Watch for the Attorney General's rulemaking, which will finalize who counts as an operator and the exact disclosure format.

How to check where you stand

ComplianceBeacon scans your site, detects the AI and chatbot tools you're actually running, and tells you which Colorado disclosures apply — with copy-paste language you can add today. Run a free scan.