The First US Law Specifically Targeting Chatbots Is Here
Colorado signed the Chatbot Safety Act into law this week, making it the first US state to pass legislation written specifically for conversational AI. The law takes effect January 1, 2027, giving chatbot operators six months to prepare. What it requires — and why Colorado went this route after its earlier AI law collapsed — matters beyond state lines.
What the law requires
House Bill 26-1263, the Chatbot Safety Act, passed the Colorado legislature in May 2026 and was signed into law on July 1. It creates four main categories of obligation for any company operating a chatbot service.
Disclosure. Chatbots must inform users that they're interacting with an AI, not a human. Most major platforms — ChatGPT, Claude, and Gemini — already do this. But codifying disclosure as a legal requirement changes the stakes. A company that obscures the AI nature of its product isn't just making a UX choice; it's violating Colorado law, with fines up to $20,000 per violation enforced by the state attorney general.
Age estimation. Operators must make reasonable efforts to determine whether users are minors. The law does not specify how — whether through account attestation at signup, behavioral signals, or some other mechanism. That implementation question is left entirely to chatbot operators to solve.
Teen protections. For users identified as minors, operators must guard against two specific harms: exposure to sexually explicit content, and what the law explicitly calls "simulated emotional dependence." That second term reflects a direct policy response to concerns — amplified by lawsuits involving AI companion apps — that some chatbot designs encourage attachment and emotional reliance in vulnerable young users. Persistent personas, affectionate response patterns, and memory systems that simulate ongoing relationships all fall into contested territory under this provision.
Professional impersonation. Chatbot outputs cannot be represented as equivalent to advice from a licensed professional. Medical diagnoses, legal opinions, financial guidance — chatbots can discuss all of these, but must make clear that their responses are not substitutes for professional counsel. Most platforms already include this disclaimer in their terms of service. The law converts it into a regulatory floor with enforcement authority behind it.
How Colorado got here
The Chatbot Safety Act doesn't exist in isolation. It emerged, in part, from the collapse of a more ambitious AI regulation effort.
In 2024, Colorado passed SB 24-205, the Consumer Protections for Artificial Intelligence Act — one of the most sweeping AI laws any US state had attempted. It required risk management programs, annual impact assessments for high-risk AI systems, and broad algorithmic discrimination duties covering employment, healthcare, lending, housing, and government services.
That law ran into sustained opposition. A federal magistrate judge stayed enforcement in April 2026. The US Department of Justice and Elon Musk's xAI jointly challenged its constitutionality. The Colorado legislature, facing both legal pressure and a narrowing political window, passed SB 26-189 in May 2026 — a substantial scaling-back that replaced the comprehensive framework with narrower transparency requirements for automated decision-making. SB 26-189 also takes effect January 1, 2027.
The Chatbot Safety Act passed in that same legislative session. It represents a more targeted alternative: abandon the comprehensive governance framework that proved legally vulnerable, but preserve specific consumer protections for the most visible AI interface. Chatbots are where most consumers actually encounter AI directly. Focusing regulation there is both politically defensible and practically testable in a way that broad algorithmic discrimination law is not.
What this means for chatbot operators
For the major platforms, the disclosure and professional disclaimer requirements are unlikely to require significant changes. Most already meet those standards under existing policies and terms of service.
Age estimation is the genuinely novel compliance challenge. No industry standard exists for chatbot age verification, and each available method involves tradeoffs. Account-creation attestation adds friction at signup. Dynamic behavioral estimation raises accuracy and privacy questions. The law leaves the method entirely to operators, which means companies will develop their own approaches and face scrutiny based on how well those approaches work in practice — likely through regulatory investigation or litigation rather than proactive compliance review.
The simulated emotional dependence provision requires careful design review, particularly for platforms that compete on persona depth — companion apps, customer service bots with persistent memory, AI tutors that build rapport with students over time. The line between useful personalization and harmful attachment engineering is not clearly drawn in the statute. Companies will need to make judgment calls about which features to modify or remove, and the answers will likely be litigated before they're settled.
The Colorado attorney general's office has been engaged in AI-related rulemaking for over a year. It has sole enforcement authority under the Chatbot Safety Act, with maximum fines of $20,000 per violation.
Looking ahead
No federal AI legislation is close to passing in the United States. Congress has held hearings, published frameworks, and introduced draft bills, but no comprehensive measure has reached a floor vote. That gap leaves states to act — and several are watching Colorado closely.
California has passed targeted AI measures covering deepfakes, employment screening, and election interference, but has repeatedly failed to advance comprehensive AI governance. Texas, New York, and Illinois have AI-related bills in various stages of committee review.
The Chatbot Safety Act is notable precisely because it's narrow enough to survive legal challenge. It doesn't attempt to govern AI broadly. It targets the chatbot interface specifically, focuses on disclosure and safety rather than output liability, and imposes obligations that are relatively straightforward to articulate even if implementation is difficult.
If the law holds up — and it's written to be durable — it could function as a template. The four core requirements (disclose the AI, estimate the age, protect teens, don't impersonate a licensed professional) are minimal enough to be hard to oppose on principle. The difficult questions are all in implementation, which is where the compliance work happens regardless of whether a law exists.
For chatbot users in Colorado and elsewhere, the practical changes by January 2027 may be subtle. Most major platforms already meet the spirit of these requirements. The significance is structural. Colorado has drawn a legal line for chatbot operators, the first state in the US to do so specifically for conversational AI, and regulators in other states are paying close attention to where that line holds.