Colorado HB 1263 (Conversational Artificial Intelligence Service Operator Requirements)

• Authority: Colorado
• Parent authority: State governments
• Jurisdiction: United States
• Collections: U.S. state and local documents
• Most recent activity: Enacted
• Most recent activity date: 2026-06-01

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Exposure to toxic content
• Overreliance and unsafe use
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Fraud, scams, and targeted manipulation
• Loss of human agency and autonomy
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 5-6 subdomains, with strong focus on toxic content exposure (1.2), overreliance and unsafe use (5.1), lack of transparency (7.4), and moderate coverage of fraud/manipulation (4.3), privacy compromise (2.1), loss of agency (5.2), and lack of robustness (7.3). Coverage is concentrated in human-computer interaction harms and content safety domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Professional & Technical Services
• Scientific Research & Development Services
• Educational Services
• Health Care & Social Assistance
• Arts, Entertainment & Recreation
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs the Information sector, specifically operators of conversational AI services that provide data processing and interactive software services to the general public. Through its extensive exclusions, the document explicitly does NOT govern AI use in Healthcare, Educational Services, Professional Services, Arts/Entertainment (video games, theme parks), or internal business operations.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding state statute enacted by the Colorado General Assembly with mandatory obligations using 'SHALL' and 'SHALL NOT' language throughout, specific enforcement mechanisms through the Attorney General's office, and formal legislative adoption with defined effective dates.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Colorado General Assembly
• Summary: The bill is formally enacted by the Colorado General Assembly, as stated in the opening line of the legislation, establishing it as a state legislative body proposing this governance instrument.

Target

• Entity Types: AI_Developer, AI_Deployer
• Summary: The legislation specifically targets 'operators' of conversational artificial intelligence services, defined as entities that develop and make publicly available or offer conversational AI services to consumers. These operators are the regulated entities who must comply with disclosure, safeguarding, and reporting requirements.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Attorney General's office
• Summary: The Attorney General's office is designated as the primary enforcement body, receiving annual compliance reports from operators and posting public compliance data. The Attorney General also has authority to determine additional metrics for efficacy assessment.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Attorney General's office
• Summary: The Attorney General's office monitors implementation through annual reporting requirements from operators, including data on crisis referrals, protocols implemented, and effectiveness metrics. The office also publicly posts this compliance data.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Collect and Process Data
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Deploy and Operate and Monitor lifecycle stages, with obligations applying to conversational AI services that are actively deployed and accessible to the general public. The requirements include ongoing operational safeguards, disclosure protocols, crisis response mechanisms, and annual monitoring reports.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Systems
• Generative AI
• Task-specific AI

Technical Scope Summary

The document explicitly defines and regulates 'conversational artificial intelligence services' and 'artificial intelligence systems' accessible to the general public. It does not mention frontier AI, general purpose AI, foundation models, compute thresholds, or open-source models. The focus is on deployed conversational AI systems that simulate human interaction through adaptive communications.