Rep. Amy Paschal

Maddy summaryThis bill is a resolution that formally honors Colorado law enforcement officers for their service and sacrifices. It expresses gratitude for their role in protecting communities and encourages residents to engage with police to build trust. The measure does not create new laws or funding but serves as a public acknowledgment of officers' work and challenges.

The act requires that school districts test the vision of students in pre-kindergarten, in addition to testing the vision of students in kindergarten and the first, second, third, fifth, seventh, and ninth grades.     The act updates terminology by replacing the word 'sight' with the word 'vision'.(Note: This summary applies to this bill as enacted.)

The act prohibits individuals lawfully permitted to provide psychotherapy services in the state (regulated professionals) from allowing an artificial intelligence system (AI system) to interact with clients in any form of therapeutic communication without synchronous, real-time interaction between the regulated professional, the AI system, and the client, or generate therapeutic recommendations or treatment plans without review and approval by the regulated professional.     Except for educational, administrative, simulation, or training purposes or as part of a research program, a regulated professional shall not use an AI system to provide, direct, or guide psychotherapy, clinical intervention, counseling, diagnosis, treatment planning, or other activity that constitutes the practice of psychotherapy with an individual or group unless the use satisfies the conditions specified in the act. At initial client contact, a regulated professional shall inform clients of the prohibitions regarding use of AI systems in the practice of psychotherapy. Regulated professionals may be disciplined by the appropriate licensing board in the department of regulatory agencies for violations of this act.     The act allows regulated professionals to use an AI system to assist in providing administrative support or supplementary support, as these terms are defined in the act, for psychotherapy services if the regulated professional maintains responsibility for reviewing any outputs of the AI system used to provide administrative support or supplementary support. If a client's therapeutic session will be recorded or transcribed through the use of an AI system, the regulated professional must disclose in advance the use of an AI system and the purposes for its use, and obtain written, informed consent from the client.     The act does not prohibit a regulated professional from using an AI system within accredited or approved educational, instructional, or professional training programs, so long as the AI system is used solely for educational, administrative, simulation, or training purposes and is not deployed, marketed, or represented as a tool for use with clients, patients, or the public. Further, a regulated professional may be involved in the development, testing, or evaluation of an AI system solely for research purposes under the oversight of a federally registered institutional review board, so long as the AI system is not offered to consumers or used outside of the research setting.     The act does not apply to regulated professionals who use or recommend the use of technology in the state that does not diagnose or treat mental health disorders, clearly discloses that the technology is not a substitute for clinical care, and:Provides self-help, therapeutic homework, coaching, patient navigation, guided meditation, journaling, or other tools specified in the act; orIs regulated by the federal food and drug administration.     Except as provided in the act, the act also makes it an unfair or deceptive trade practice under the 'Colorado Consumer Protection Act' for an individual, corporation, or entity (person) to use any term, letter, or phrase in the use of an AI system in a manner that:Indicates or implies that the AI system's outputs are provided by, endorsed by, or equivalent to services provided by a regulated professional;Represents that the AI system provides psychotherapy services; orRepresents that a user's data is confidential in a manner that would lead a reasonable user to believe that the privacy of their data is protected in a manner similar to therapist-client confidentiality.      The act does not impose liability on a regulated professional for defects in or failures of an AI system that are attributable to the developer or deployer of the AI system.     Further, under conditions specified in the act, nothing in the act prohibits a person from developing, testing, or evaluating an AI system solely for research purposes or using an AI system in educational, instructional, or training programs. In addition, it is not an unfair or deceptive trade practice for a person to use a technology that does not diagnose or treat mental health disorders, clearly discloses that the technology is not a substitute for clinical care, and:Provides self-help, therapeutic homework, coaching, patient navigation, guided meditation, journaling, or other tools specified in the act; orIs regulated by the federal food and drug administration.(Note: This summary applies to this bill as enacted.)

The act implements the recommendations of the department of regulatory agencies in its 2025 sunset review and report by:Continuing the fire suppression programs of the division of fire prevention and control (division) for 11 years until September 1, 2037, pursuant to the provisions of the sunset law; andModifying certain provisions of the fire suppression programs of the division to replace gender-specific terminology with gender-neutral terminology.(Note: This summary applies to this bill as enacted.)

The act requires an operating system provider that operates a publicly available internet website, software application, online service, or platform that distributes and facilitates, on a commercial basis, the download of applications from third-party developers to users of devices (covered application store) or makes a covered application store available preinstalled on an operating system to:Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or age bracket of the user of that device in order to provide a signal regarding the user's age (age signal) to applications available in the covered application store;Provide application developers with a reasonably consistent, real-time application programming interface to request and receive an age signal; andSend only the minimum amount of information necessary to comply with the act. An operating system provider or covered application store shall not share an age signal with a third party for a purpose not required by the act.     The act requires a consumer software application that is accessed through a covered application store and that may be run or directed by a user on a device (covered application) to request an age signal with respect to a particular user when the covered application is initially launched or when a user first creates an account. A covered application that receives an age signal is deemed to have knowledge of the age range of the user to whom that age signal pertains across all platforms of the application and points of access of the application. However, if a developer has clear and convincing information that a user's age is different than the age indicated by an age signal, the developer shall use that information as the primary indicator of the user's age range.     A developer shall ensure that a covered application that receives an age signal does not:Request more information concerning a user from an operating system provider or a covered application store than is necessary to comply with the act; orCommunicate an age signal to a third party for a purpose not required by the act.     With respect to a device for which account setup was completed before July 1, 2028, the act requires an operating system provider to provide, before January 1, 2029, an accessible interface that allows an account holder to indicate the birth date or age of the user of that device for the purpose of providing an age signal regarding the user's age-bracket data to covered applications available in the operating system provider's covered application store. If a covered application last updated on or after July 1, 2027, was downloaded to a device before July 1, 2028, and the covered application has not requested an age signal with respect to the user of the device on which the covered application was downloaded, the covered application must request an age signal from the covered application store from which the covered application was downloaded with respect to that user before January 1, 2029.     A person that violates the act must pay a civil penalty of not more than $2,500 for each minor affected by each negligent violation or not more than $7,500 for each minor affected by each intentional violation. The penalty is assessed and recovered in a civil action brought by the attorney general. An operating system provider or covered application store that makes a good faith effort to comply with the act is not liable for an erroneous age signal or for conduct by a covered application that receives an age signal.(Note: This summary applies to this bill as enacted.)

The act creates a statutory cause of action for a person who has their federal constitutional rights violated by another person who, acting under color of law, is participating in civil immigration enforcement. A person who violates the United States constitution while participating in civil immigration enforcement and whose conduct was the proximate cause of violating another person's constitutional rights is liable to the person whose rights are violated for legal or equitable relief or any other appropriate relief. The action must be commenced within 2 years after the cause of action accrues.     The act appropriates $125,604 to the department of law from the legal services cash fund to provide legal services for the department of personnel.(Note: This summary applies to this bill as enacted.)

The act creates the 'Colorado Mandatory Lethality Assessment Act', which requires peace officers to conduct a lethality assessment when responding to a domestic violence incident and include the completed lethality assessment in the incident report. A peace officer is not required to administer a lethality assessment if a victim is unavailable, not at the scene, incapacitated, or if circumstances otherwise make the administration of the lethality assessment impossible or impracticable. If the lethality assessment indicates that an individual is a high-risk victim, or if the lethality assessment does not indicate a victim is high-risk but a peace officer determines an individual is a high-risk victim based on the totality of the circumstances, the peace officer is required to immediately contact a community-based victim's advocate either by phone or in person and provide the high-risk victim the opportunity to speak with the advocate.     The act requires the attorney general's office, in consultation with a Colorado-based coalition that advocates for survivors of domestic violence, to develop a mandatory training for peace officers to learn how to administer the lethality assessment and provide victim referrals. No later than June 1, 2027, the attorney general is required to make the training available and offer assistance to law enforcement agencies in providing the training. Beginning July 1, 2027, the act requires each law enforcement agency to ensure that each peace officer employed by the agency has completed the mandatory training; except that a law enforcement agency that has provided training on the administration of lethality assessments prior to July 1, 2027, is not required to provide additional training.     Beginning January 2028, and each January thereafter, the act requires the attorney general's office to report to the general assembly certain information related to lethality assessments conducted in the previous calendar year. No later than January 31, 2030, the domestic violence fatality review board shall evaluate the effectiveness of mandatory lethality assessments and referrals to resources and submit the evaluation to the general assembly.     The act does not impose criminal, administrative, or civil liability on any person for an act or omission made in good faith related to administering a lethality assessment.(Note: This summary applies to this bill as enacted.)

The act allows the joint technology committee (JTC), within 90 days after the day that the chief information security officer of the office of information technology (security officer) files a written information technology security compliance report (compliance report) with the JTC as required by the act, to vote to request that the legislative audit committee direct the state auditor to conduct a special information technology security audit (IT security audit) of the office of information technology (OIT) if the compliance report indicates that one or more audit recommendations made by the state auditor is unresolved 2 or more years past the implementation date for the audit recommendation or if a material discrepancy exists between a representation in the compliance report and a previous audit finding.     If the JTC votes to request an IT security audit and if the legislative audit committee votes to direct the audit, the act requires:The state auditor to conduct the IT security audit;The state auditor to obtain input from OIT when the state auditor determines the scope and boundaries of the audit;The state auditor to submit the IT security audit report to the legislative audit committee, the JTC, the joint budget committee, and the governor; andOIT to reimburse the state auditor for the auditor's costs incurred in completing the IT security audit.     The act requires OIT to establish, maintain, keep, update, and make available to state agency information technology leadership and the members of the JTC a list of all active information technology vendor contracts for state agencies.     The act specifies that, except in the case of an information technology security emergency, OIT shall not publish or implement a technical information technology standard, and that the standard is void, unless the standard:Was publicly posted; andReceived approval from the security officer if the standard relates to security, access controls, or the handling of data.     The act requires OIT to ensure that, if an information technology contract provides ongoing service and delivery to Coloradans, the contract maintains current architecture diagrams that are updated at least annually.     The act prohibits the chief information officer from delegating a duty, responsibility, or power of the security officer.     The act requires the security officer to submit 2 annual reports to the JTC. The first report is a written compliance report that includes OIT's current compliance status with applicable security standards; all open audit recommendations regarding OIT made by the state auditor and the date on which each recommendation was made; and a timeline for remediation and a mitigation plan or compensation controls for each open audit recommendation made by the state auditor.     The second report is a written statewide information technology security risk report (security risk report) that assesses the overall security risk posture of state agency information technology systems. To support the preparation of the security risk report, the security officer may conduct evaluations of state agency information technology systems, including penetration testing, vulnerability scanning, configuration evaluations, and vendor and system reviews. Each state agency shall provide to the security officer, upon request, the access and information necessary to conduct evaluations of state agency technology systems, including system access, product information, and architecture information.     The act requires the security officer, or the chief information officer if the security officer is unavailable, to perform the duties and uphold the responsibilities assigned to the security officer pursuant to law.(Note: This summary applies to this bill as enacted.)

The act makes various updates to language in the 'Workers' Compensation Act of Colorado' to align with technology changes in the division of workers' compensation in the department of labor and employment. These updates include changing current statutory language requiring mailing of documents to allow for electronic mailing or filing of the documents. The act also changes the fund into which an employer or employer's insurance carrier makes payments to the state for a compensable injury resulting in death of a minor without surviving parents from the subsequent injury fund to the Colorado uninsured employer fund.(Note: This summary applies to this bill as enacted.)

The act:Authorizes the health insurance affordability enterprise (enterprise), on or after January 1, 2027, to issue revenue bonds of up to $100 million to fund enterprise programs, secured by the enterprise's revenues, and require the enterprise to pay bond obligations before allocating revenues for enterprise programs;Allows the enterprise to invest specified money in the health insurance affordability cash fund (cash fund) without regard to otherwise applicable requirements for such investments and to contract with private professional fund managers to advise on investment strategies;Modifies the allocation of enterprise revenue among authorized purposes and allows the enterprise to reallocate unexpended amounts for specified purposes;Directs the enterprise to require qualified individuals who are enrolled in state-subsidized individual health coverage plans eligible for subsidies from the enterprise to pay premiums established in rules adopted by the commissioner, in consultation with the health insurance affordability board (board);Requires the enterprise to adjust the statewide average premium reduction under the reinsurance program to 18% and to reduce the amount of bonds issued to account for the reduced costs for the reinsurance program;Directs the board, in recommending parameters for implementing subsidies for state-subsidized individual health coverage plans, to recommend coverage that prioritizes enrollment stability and customer predictability; when seeking input on its recommendations regarding plans, coverage, and the number of eligible slots, to enable feedback in at least English and Spanish and in other languages upon request; and to indicate how it incorporated such feedback into its final recommendations;Directs the enterprise to conduct or contract a third party to conduct a study to evaluate the feasibility of restructuring the enterprise programs to increase health insurance affordability and maximize enrollment in health insurance plans;Requires the enterprise to submit 3 written reports and make one in-person presentation to the joint budget committee each year regarding the status of the cash fund and, as part of its in-person presentation in January 2027, to provide an analysis of the effects of changing the statewide average premium reduction under the reinsurance program to 15% and of creating a tiered, income-based, structure for premium assistance for individuals who purchase insurance on the Colorado health benefit exchange (exchange);Repeals the tax credit for contributions to the exchange and replaces it with a tax credit for contributions to the enterprise; andDirects the state treasurer to transfer $40 million from the marijuana tax cash fund to the cash fund by June 30, 2026, reduces to $60 million the designation of money in the marijuana tax cash fund as the state emergency reserve for the 2025-26 and 2026-27 state fiscal years, and increases by $40 million the value of the capitol annex building for purposes of the state emergency reserve for the 2025-26 and 2026-27 state fiscal years.(Note: This summary applies to this bill as enacted.)