On this page · 10 sections
- The 2027 chatbot law calendar
- Who counts as an operator
- Colorado HB 26-1263: what operators must do from 1 January 2027
- California SB 243: live since 2026, reporting from 1 July 2027
- California SB 1119 (Adam's Law): child safety from 1 July 2027
- Practical build checklist for chatbot products
- Worked example: a companion app planning for 2027
- Decision table: which rules apply to your bot
- How eCorpIT can help
- References
Summary. Two US states put dated duties on consumer and companion chatbots in 2027. Colorado's HB 26-1263, signed on 29 May 2026, applies from 1 January 2027 to operators of public conversational AI services. Operators must estimate user age, disclose AI use daily and at least every 3 hours (or persistently), refer users at risk of suicide or self-harm to crisis services, not police, and never present output as coming from a licensed professional. For users known to be minors they must block sexual content, curb simulated emotional dependence and variable rewards, and offer memory, training and parental controls. Annual reports to the attorney general start on 1 July 2027; the implementing rules (4 CCR 904-6) were not yet adopted on 12 November 2026. California has two layers. SB 243 (Chapter 677, Statutes of 2025) has covered companion chatbots since 1 January 2026, adds annual reports to the Office of Suicide Prevention from 1 July 2027 and lets injured users recover at least $1,000 per violation. SB 1119, Adam's Law (Chapter 190, Statutes of 2026), adds child-safety duties from 1 July 2027, including 1-hour session and 2-hour daily default limits, penalties of up to $15,000 per affected child and audits from 2029. Customer service bots are excluded in both states.
About this article. For product, trust-and-safety and engineering leads running consumer chatbots or companion apps used in Colorado or California. We checked every date, duty and penalty on 12 November 2026 against the enacted texts, the Colorado rulemaking docket, the Colorado Revised Statutes and the federal court docket, using archived copies where official sites block automated access. This is general information, not legal advice; confirm your obligations with your own counsel. Researched with AI assistance and reviewed by our editorial team.
The 2027 chatbot law calendar
Dates come from the enacted texts and the rulemaking notice.
| Date | State | What happens | Legal source |
|---|---|---|---|
| 1 January 2026 | California | SB 243 duties apply: AI notice, crisis protocol, minor safeguards | Bus. and Prof. Code 22601 to 22606 |
| 29 May 2026 | Colorado | HB 26-1263 signed by the governor | HB 26-1263 |
| 11 August 2026 | Colorado | Attorney general files proposed rules, 4 CCR 904-6 | Colorado Register |
| 10 September 2026 | California | SB 1119 approved, Chapter 190 | SB 1119 |
| 26 October 2026 | Colorado | Rulemaking hearing; written comments due by its last day | Rulemaking notice |
| 1 January 2027 | Colorado | AI disclosure, minor protections, crisis protocol, professional-claims ban | HB 26-1263, section 2 |
| 1 January 2027 | California | SB 1119 rewrites section 22602 and drops its minor subdivision; age determination section 21811 takes effect | SB 1119, sections 1 and 2 |
| 1 July 2027 | California | First SB 243 report; SB 1119 child protections, record keeping, ad and data limits | 22603; 21812 to 21813 |
| 1 July 2027 | Colorado | Annual report to the attorney general begins | HB 26-1263, subsection (6) |
| 1 January 2028 | California | Child and parent interface testing due; attorney general complaint portal due | 21812(d)(6); 21815 |
| 1 January 2029 | California | First independent child safety audit, or before launch if later | 21814 |
Two details catch teams out. First, California's report counts crisis referrals in the preceding calendar year, so the July 2027 filing covers calendar 2026. Colorado's act uses the same wording, but its August proposed rules say the first report covers calendar year 2027; the final rules must settle that. If you are not counting referrals today, start now. Second, California deletes its old minor safeguards on 1 January 2027, but the SB 1119 replacements are not operative until 1 July 2027. Do not switch anything off in that window.
Who counts as an operator
Settle scope first: a support bot and a companion app land in different places. If your bot makes or scores hiring, lending or housing decisions instead, the separate Colorado ADMT law applies; see our Colorado AI Act 2027 guide. The comparison below is drawn from the Colorado definitions and the California code.
| Question | Colorado HB 26-1263 | California SB 243 and SB 1119 |
|---|---|---|
| What is regulated | A conversational AI service: AI open to the general public that mainly simulates human conversation through adaptive text, images or audio | A companion chatbot: AI with a natural language interface giving adaptive, human-like replies, able to meet a user's social needs and sustain a relationship across interactions |
| Who is the operator | Develops and makes the service publicly available, or offers it to a consumer; app stores and search engines are not operators just for giving access | Makes a companion chatbot platform available to a user in California |
| Customer service and shopping bots | Excluded | Excluded if used only for customer service |
| Business productivity and internal tools | Excluded | Excluded; SB 1119 also excludes workplace-only deployments |
| Video game characters | Excluded if dialogue stays on the game | Excluded if replies stay on the game and avoid mental health, self-harm and sexual topics |
| Device voice assistants | Excluded if they cannot produce sexual content or encourage self-harm dialogue | Excluded if they do not sustain a relationship or elicit emotional responses |
| AI features inside other apps, including social media | Excluded if not designed for emotional companionship or dependent interaction | No equivalent exclusion |
| Health care | Excluded for HIPAA covered entities, their business associates and Health Care Availability Act entities | No equivalent exclusion |
| Education | Excluded for school tools not designed for emotional companionship | SB 1119 excludes postsecondary institutions using bots only in educational settings |
Colorado also excludes developer and research tools, theme-park features, and narrow single-task bots that cannot produce sexual content or hold self-harm dialogue.
Colorado's August proposed rules treat a service as public even behind a sign-up, subscription or paywall; only internal workforce deployments in restricted, authenticated environments fall outside. For the companionship tests they weigh names, avatars and backstories, sycophantic design and memory of past conversations. A paid consumer assistant with memory is therefore likely in scope in Colorado. In California it turns on whether it meets social needs and sustains a relationship across sessions, which persistent memory makes easier to argue.
Colorado HB 26-1263: what operators must do from 1 January 2027
The act adds section 6-1-1708 to part 17 of the Colorado Consumer Protection Act, which SB 26-189 re-enacts for automated decisions from the same date. SB 26-189 also creates a section 6-1-1708, so expect renumbering when the statutes are compiled.
Age estimation. Operators must use commercially reasonable or generally accepted methods to estimate the age of account holders and users, and may not wilfully disregard clear and convincing information that a user is under 18. An estimated age or age range counts as knowledge that the user is a minor, so estimation triggers the minor duties below. The proposed rules bar reliance on self-declared age alone or on government ID as the only option, and expect operating system, app store and device age signals, re-assessment as new signals appear, and tested accuracy. Accepted examples include the ISO/IEC 27566 framework, zero-knowledge proofs and ID-to-selfie matching. An inconclusive result cannot be used to treat a user as an adult.
AI disclosure for every user. The disclosure must be clear and conspicuous and must:
- appear at the beginning of a user's first interaction each day;
- appear at least once every 3 hours in a continuous interaction, or stay visible as a persistent disclosure; and
- answer any prompt asking whether the service is artificial and not human.
The proposed rules define a continuous interaction as one that persists through pauses and can span several threads or chatbot profiles, so a timer per chat window is not enough. A persistent on-screen disclaimer must stay visible without scrolling and use a font no smaller than the largest other text on screen.
Extra duties once you know a user is a minor. The operator must:
- give a minor-specific AI disclosure: persistent on screens, intermittent audio without a screen, or at the start of each interaction and every 3 hours;
- not give points or similar rewards at unpredictable intervals to drive engagement;
- block explicit sexual content, intimate digital depictions and erotic interactions;
- take reasonable measures against responses that simulate emotional dependence or isolation, including claims to be human or sentient, romantic statements and adult-minor romantic role-play;
- run a protocol that stops engagement on prompts about explicit sexual conduct with a minor;
- comply with the Colorado Privacy Act's rules on minors' data; and
- offer the minor and a parent controls over privacy settings, including cross-session memory and use of the minor's data for training.
Crisis protocol. Every operator must answer prompts about suicidal ideation or self-harm by referring the user to a crisis service such as a suicide hotline or crisis text line, expressly not law enforcement, with escalation for repeated or severe crisis indicators. The proposed rules define those as recurring signals or heightened risk measured with an evidence-based method.
No professional claims. Advertising, interface and outputs may not present output as provided by, endorsed by or equivalent to a licensed health-care, legal or mental health professional or a qualified dietitian. The proposed rules would also check whether users can create bot profiles named therapist, doctor, lawyer or dietitian.
Annual report from 1 July 2027. Operators report the number of crisis referral notifications in the preceding calendar year, their protocols to detect and respond to suicidal ideation or self-harm and to prevent bot responses about it, and any metrics the attorney general sets. Reports carry no user identifiers, the attorney general publishes the data, and measurement must use evidence-based methods. The proposed rules cite examples such as the Columbia-Suicide Severity Rating Scale and PHQ-9 item 9, and would require much more:
- a size tier by monthly active users, from under 500,000 to over 10 million;
- total conversations as the denominator for the referral count, and the share of referrals that involved real risk under an evidence-based method;
- the user base split by age category: under 13, 13 to 15, 16 to 17, 18 to 24 and over 25;
- descriptions of age estimation and minor-protection methods; and
- counts and handling times for reports that a user is a minor or that a minor saw prohibited sexual content.
The final rules may change all of this.
Enforcement. HB 26-1263 has no penalty clause. From 1 January 2027, SB 26-189 makes any part 17 violation a deceptive trade practice enforced by the attorney general, with no new private right of action. On our reading, that exposes operators to civil penalties of up to $20,000 per violation, with each consumer or transaction counted separately. The 60-day cure notice in part 17 is written for developers and deployers, so operators should not count on it.
Litigation and rulemaking. In X. AI LLC v. Weiser, which the United States has joined as a plaintiff, a 27 April 2026 order bars the attorney general from starting enforcement of SB 24-205, or 2026 legislation replacing or amending it, for conduct up to 14 days after the court rules on xAI's preliminary injunction motion, due within 28 days after the rules are finally adopted. The order does not name HB 26-1263, so its reach to chatbot duties is unsettled. The rules were heard on 26 October 2026, and on 12 November 2026 the docket showed no adopted rule.
California SB 243: live since 2026, reporting from 1 July 2027
SB 243 added Business and Professions Code sections 22601 to 22606, effective 1 January 2026. What remains after SB 1119:
- AI notice (22602(a)). If a reasonable person would be misled into thinking they are talking to a human, the operator must clearly say the bot is artificially generated and not human.
- Crisis protocol (22602(b)). The bot may not engage users unless the operator keeps a protocol against producing suicide or self-harm content, including referrals to a suicide hotline or crisis text line, published on its website.
- Suitability notice (22604). Operators must disclose that companion chatbots may not be suitable for some minors.
- Annual report (22603). From 1 July 2027, operators report to the Office of Suicide Prevention their crisis referral count for the preceding calendar year and their detection and response protocols, with no identifiers and evidence-based measurement. The office publishes the data.
- Private right of action (22605). A person with injury in fact can recover injunctive relief, the greater of actual damages or $1,000 per violation, and attorney's fees.
SB 1119 rewrites 22602 without subdivision (c), the minor-specific duties to disclose AI, send 3-hour break reminders and block sexual imagery. The bill passed by majority vote with no urgency clause, so that change takes effect on 1 January 2027.
California SB 1119 (Adam's Law): child safety from 1 July 2027
SB 1119 adds Chapter 11.6, sections 21810 to 21818, to the Business and Professions Code. A child is anyone under 18. The operator definition leaves out postsecondary institutions using bots only for education and employers offering bots only to their workforce.
Age determination (21811). An operator must either determine age through California's Digital Age Assurance Act (Civil Code section 1798.500 onward), the age-signal regime covered in our California AB 1043 guide, with a fallback to Health and Safety Code section 27001, or apply the child protections to every user. Section 21811 has no separate operative date, so it applies from 1 January 2027.
If you block children (21812(b)). Publish a high-level description of how you meet the age assurance rules. Most other duties attach only to operators that allow child users.
If you allow children (21812, operative 1 July 2027):
- Before launching a new or substantially modified companion chatbot, document a risk assessment of covered harms to children, with your evaluation method and benchmarks, and mitigate what you find.
- Publish a child safety policy.
- Run a crisis protocol with in-service referral and, for a credible and imminent threat, either notify a linked parent or give the child a direct path to 988 or an equivalent helpline.
- Ship defaults that only a parent can change: persistent conversational memory off (with a narrower rule at 16 and over), push notifications off, a 1-hour limit per continuous session and 2 hours per day.
- Give parents controls over each default, including disabling access for children under 16, and actively promote them.
- Reinforce the AI notice periodically in child-appropriate language.
- Take reasonable measures against 14 listed behaviours, including encouraging self-harm or disordered eating, claiming sentience, romantic interest, encouraging emotional reliance, excessive flattery, discouraging breaks, soliciting purchases to keep the relationship going, and helping children get round parental controls.
- Test the safety interface with children and parents by 1 January 2028 and every 2 years after, and run a public incident-reporting channel.
Records, ads and data. If the operator notifies a parent, or learns a child died or seriously self-harmed, it must preserve related conversation records for at least 3 years (21812.5). From 1 July 2027 there is no cross-context behavioural advertising to children, no selling of child data, ads must be labelled, and dark patterns around safety controls are banned (21813).
Audits (21814). An independent child safety audit is due by 1 January 2029, or before first launch if later, then every 2 years, with a summary to the attorney general within 30 business days. Operators under $500 million in prior-year gross revenue are exempt before 1 January 2032. The section has two versions depending on AB 1405, an AI auditor registration law chaptered on 9 September 2026 (Chapter 178), so the AB 1405 version applies; both keep those dates and the threshold.
Penalties (21816). Public prosecutors can seek up to $5,000 per affected child for each negligent violation and $15,000 for each intentional one. A child who suffers actual harm from a breach of the core protections in 21812(d) can sue for actual damages.
Practical build checklist for chatbot products
Disclosures
- A server-side clock per user, not per tab, firing the AI disclosure daily and every 3 hours, or a persistent banner.
- Intent detection for are-you-human questions with a fixed, non-generated answer.
- The California suitability notice and, for children, periodic child-language AI reminders.
Age and minors
- Age estimation combining operating system and app store signals, declared age and behavioural signals, with a logged decision per account.
- A minor mode that changes model policy: sexual-content blocking, persona rules against sentience and romance claims, no variable rewards.
- Memory and training-data toggles plus a parent console; for California children, memory and push off by default and 1-hour and 2-hour timers.
Crisis protocols
- A self-harm classifier with referral to 988 or a crisis text line, never routed to police in Colorado.
- Escalation rules for repeated or severe indicators, validated against an evidence-based method.
- A published protocol page for California, and 3-year record preservation when a child is at risk.
Claims and content
- Scrub ads, interface copy, system prompts and user-created bot names for therapist, doctor, lawyer or dietitian equivalence claims.
Reporting and records
- A log of crisis referrals and a count of all conversations, aggregated by calendar year, with no identifiers in the report.
- Versioned protocols, age-estimation accuracy tests and risk assessments for the July 2027 filings and the 2029 audit.
Worked example: a companion app planning for 2027
The figures are illustrative assumptions. A companion app has 400,000 US monthly active users: 32,000 in California and 8,000 in Colorado. Its age estimation flags 15% of California users, or 4,800, as likely children.
Option A: block minors in both states. The app still needs age estimation, a published age-assurance description, the all-user AI disclosure, the crisis protocol, professional-claims checks and both annual reports. It skips the child defaults, parent console and SB 1119 risk assessment.
Option B: allow minors. It adds the minor mode, parent controls, time limits, child risk assessment, child safety policy and incident channel by 1 July 2027.
Penalty arithmetic if Option B ships without the time limits. At 4,800 affected children, the ceiling is 4,800 × $5,000 = $24,000,000 for negligent violations or 4,800 × $15,000 = $72,000,000 for intentional ones. In Colorado, a missing AI disclosure across 8,000 users at up to $20,000 per violation has a theoretical ceiling of 8,000 × $20,000 = $160,000,000. Real penalties sit far below ceilings, but per-child counting makes shortcuts scale with users.
For most teams under $500 million in revenue, the audit cost waits until 2032. The risk assessment and reporting pipeline do not. Track these dates in our US and UK compliance calendar.
Decision table: which rules apply to your bot
| If your product is... | Colorado HB 26-1263 | California SB 243 and SB 1119 |
|---|---|---|
| A customer support or shopping assistant | Excluded | Excluded |
| An internal employee assistant | Excluded | Excluded |
| A companion or character chat app | In scope | In scope |
| A public general-purpose assistant with memory | Likely in scope | Possibly a companion chatbot; get counsel's view |
| A K-12 tutor not designed for companionship | Excluded | Check; SB 1119 excludes only postsecondary use |
| A HIPAA covered entity's patient chatbot | Excluded | No equivalent exclusion |
| A bot that scores job or loan applicants | Colorado ADMT law (SB 26-189) | California CCPA ADMT rules |
For the last row, see California's CCPA ADMT rules.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our AI and machine learning services team builds the engineering behind these duties, from disclosure timers and age-signal checks to crisis routing and de-identified reporting pipelines, while your counsel decides what applies to you. Talk to us at /contact-us/.
Last updated: 12 November 2026.
