Colorado is becoming the country’s test case for AI chatbot regulation, and the comment period that sets how strict it gets draws far less attention than the bill signings did. On July 13, the Future of Privacy Forum filed comments with the Colorado Department of Justice’s pre-rulemaking process covering two new statutes: SB 189, the rewritten Colorado AI Act, and HB 1263, the Chatbot Safety Act.
SB 189 replaced the original Colorado AI Act after Governor Polis convened a working group to address concerns raised against the prior law. What’s left: developer documentation duties, deployer notice requirements, and a consumer right to human review after an adverse automated decision. It takes effect January 1, 2027. FPF’s core ask is to align its definitions with the existing Colorado Privacy Act so companies aren’t running two compliance programs off two different rulebooks for the same data.
HB 1263 carries more teeth. Its obligations, age estimation, minor safety tools, AI disclosure, phase in through July 2027. FPF wants the “narrow and discrete topic” exemption defined now, before a customer-service bot and a companion app land in the same bucket.
Colorado’s original AI Act was repealed and replaced in 2026, and HB 1263 is already flagged as the first state chatbot safety law in the country. Whatever definitions survive this comment period are what the next state’s drafters copy first. If you’re running a chatbot with Colorado users, read the pre-rulemaking considerations document, not just the statute text.
Nathan Zakhary