Colorado: AI health lawsYour state
13 entries on the map: 9 in force, 3 enacted and not yet in force (main duties begin Jan. 1, 2027) and 1 proposed rule.
Colorado's health care AI rules bind insurers, chatbot operators, psychotherapists and businesses covered by the Colorado Privacy Act.
Full overview and dates aheadHide full overview
Regulation 10-1-1 makes a provider acting for a health plan ultimately responsible for prior authorization denials informed by external consumer data. Starting Jan. 1, 2027, HB26-1139 bars medical necessity denials based solely on AI output without review by a licensed clinician or other competent regulated professional.
HB26-1195, in force since Aug. 12, 2026, requires mental health licensees to get written consent before AI records or transcribes sessions and bars presenting AI as psychotherapy. Practices face consent rules for biometric identifiers under HB24-1130 and, outside protected health information, for websites minors use under SB24-041. From Jan. 1, 2027, HB26-1263 requires anyone offering a public chatbot to disclose it is AI, and SB26-189 exempts practices covered by federal health privacy law from most duties but requires general notice to patients of their use of advanced technologies. The Attorney General's proposed rules for both laws took comments through Oct. 26, 2026.
Dates ahead
- Jan. 1, 2027HB26-1139, Use of Artificial Intelligence in Health CarePayer and utilization review AI
- Jan. 1, 2027HB26-1263, Conversational Artificial Intelligence Service Operator RequirementsClinical decision and chatbot limits
- Jan. 1, 2027SB26-189, Automated Decision-Making TechnologyPatient disclosure of AI use
Payer and utilization review AI
SB21-169, Restrict Insurers' Use of External Consumer Data
This entry's details are for members
What the law requires, who it binds, when it takes effect and the primary sources, checked on a dated schedule.
Founding Pro: $149 a year, locked while you stay. Until Dec. 31. Regular price $249 a year.
Pro adds your state's duties as a dated checklist, with law alerts, coming soon.
Already a member? Sign in
Regulation 10-1-1 (3 CCR 702-10), Governance and Risk Management Framework Requirements for Life Insurers', Private Passenger Automobile Insurers', and Health Benefit Plan Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models
HB26-1139, Use of Artificial Intelligence in Health Care
Patient disclosure of AI use
SB26-189, Automated Decision-Making Technology
Automated Decision-Making Technology & Conversational Artificial Intelligence Service rules (the ADMT and Chatbot Safety Rules), proposed by the Attorney General
Also relevant here: HB26-1195, Psychotherapy Artificial Intelligence Restrictions (under mental health AI); HB26-1263, Conversational Artificial Intelligence Service Operator Requirements (under clinical decision and chatbot limits).
Clinical decision and chatbot limits
HB26-1263, Conversational Artificial Intelligence Service Operator Requirements
Also relevant here: HB26-1195, Psychotherapy Artificial Intelligence Restrictions (under mental health AI); SB26-189, Automated Decision-Making Technology (under patient disclosure of AI use); Automated Decision-Making Technology & Conversational Artificial Intelligence Service rules (the ADMT and Chatbot Safety Rules), proposed by the Attorney General (under patient disclosure of AI use).
Mental health AI
HB26-1195, Psychotherapy Artificial Intelligence Restrictions
Also relevant here: HB26-1139, Use of Artificial Intelligence in Health Care (under payer and utilization review AI); HB26-1263, Conversational Artificial Intelligence Service Operator Requirements (under clinical decision and chatbot limits); Automated Decision-Making Technology & Conversational Artificial Intelligence Service rules (the ADMT and Chatbot Safety Rules), proposed by the Attorney General (under patient disclosure of AI use).
Data and privacy
SB21-190, Protect Personal Data Privacy (the Colorado Privacy Act)
HB24-1058, Protect Privacy of Biological Data
SB25-276, Protect Civil Rights Immigration Status
HB24-1130, Privacy of Biometric Identifiers & Data
SB24-041, Privacy Protections for Children's Online Data
Colorado Privacy Act Rules (4 CCR 904-3)
What applies to me in Colorado: physician, practice owner, hospital.
Federal law also applies in every state: see federal law and policy.
Calendar of dates laws take effect (Colorado): subscribe or download the .ics file.
General information, not legal advice. The whole map is available as data at /law-map/laws.json.