AI chat providers must safeguard minors starting January 2027

Covered providers must estimate users' ages and apply safeguards when they know a user is under 18. Coverage applies to providers of public AI services that mainly simulate human conversation, with exemptions for specified developer, commerce, business, health-care, school, entertainment, device, and embedded tools. App stores and search engines are excluded when they only provide access. Providers must use commercially reasonable or generally accepted age-estimation methods. Estimates count as knowledge, and providers cannot deliberately ignore clear and convincing evidence that a user is under 18. Providers must take technically feasible steps against sexual content and reasonable steps against emotional dependence or isolation. They must prevent simulated romance and claims of being human or sentient, meaning able to feel or experience things. Providers must have procedures to prohibit sexual interactions with minors and stop responding to prompts about sexual conduct with minors. Evidence-based medical information and factual descriptions of reproductive health care are excluded from the sexual-conduct definition. Providers cannot give minors points or similar rewards at unpredictable intervals with the intent to increase engagement. They must follow the referenced child privacy rules and offer minors controls over conversation memory and use of personal data for AI training. Parents or guardians must also have privacy and account controls. The safeguards for known minors apply on and after January 1, 2027. Age estimation has no separate January start date and follows the law's general effective-date rule.

Covered providers must tell users they are interacting with AI and cannot claim their answers come from, are endorsed by, or equal services from specified professionals. These duties apply to covered public AI chat services. The professional-claim restriction covers health-care, legal, and mental health professionals, as well as qualified dietitians, who advise on food and nutrition. Users must receive notice at their first interaction each day and when they ask whether the service is human. During continuous use, notice must appear at least every three hours or remain visible. Known minors must receive a clear nonhuman disclosure through a persistent screen notice, intermittent audio notice, or notice at each interaction's start and at least every three hours. Providers must also answer their questions about whether the service is human. The disclosure and professional-claim rules apply on and after January 1, 2027.

Covered providers must have a response plan for user prompts about suicidal thoughts or intentional self-injury. The response plan covers prompts from all users of covered public AI chat services, including adults. The plan must refer users to an appropriate crisis service, such as a suicide hotline or crisis text line. A law enforcement agency does not count as that crisis service. The plan must include steps to escalate the response when signs of crisis are repeated or severe. The crisis-response duty applies on and after January 1, 2027.

Covered providers must send annual safety reports to the Colorado attorney general, whose office must publish report data. Covered public AI chat providers must report on crisis referrals and their suicide and self-harm safeguards. Reports must include crisis-referral counts from the previous calendar year, suicide and self-harm safety procedures, and additional measurements required by the attorney general. Reports cannot include user identifiers or personal information. Providers must use evidence-based methods to measure suicidal thoughts or self-harm. The law does not require disclosure of trade secrets or other legally protected information. It preserves the referenced rights to information and does not authorize content restrictions that violate the United States Constitution. The annual reporting duty applies on and after July 1, 2027.