Colorado Laser Safety for Med Spas 2026: Who Can Operate

Most states answer "who can run our laser?" with a list of credentials. Colorado answers with a chain of custody. There is no laser operator license, no state technician certificate, and no device registration — only an unusually well-drafted definition of when energy on skin becomes medicine, and a delegation rule that says precisely what a physician or APRN must do before handing the device to someone else.

That structure catches operators out in both directions. Some read the absence of a laser license as permissiveness and hire a "certified laser technician" off a two-week course. Others assume only providers can touch the handpiece and staff a hair-removal business twice as expensively as they need to. The second mistake is merely costly; the first is the fact pattern the Medical Board investigates.

This guide walks the 2026 picture: why Class IIIb and above is medicine, who may operate at each license level, how Rule 1.17 delegation works in a laser room, what stands in for a good-faith exam, and what happens when the chain breaks. Pair it with our Colorado med spa compliance checklist and the national med spa regulations by state reference.

Why Colorado Puts Lasers on the Medical Side

Everything in Colorado laser compliance descends from one definition. Get it right and the staffing, supervision, and safety questions resolve. Get it wrong and every downstream decision inherits the error.

Rule 1.17 and Medical-Aesthetic Services

The Colorado Medical Board regulates the practice of medicine under the Medical Practice Act at C.R.S. 12-240-101 et seq. Its delegation rule — Rule 1.17 of 3 CCR 713-1, adopted under C.R.S. 12-240-107(3)(l) — defines medical-aesthetic services as cosmetic or aesthetic services that constitute the practice of medicine. The rule names the devices directly: a Class IIIb or higher laser, a radiofrequency device, intense pulsed light, or any other technique resulting in the revision, destruction, incision, or other structural alteration of human tissue — and/or for hair removal.

That clause does two jobs. The first half is a mechanism test: if the technique alters tissue, it is medicine. The second is an anti-loophole clause reaching hair removal regardless.

The Class IIIb Threshold Is the Line That Matters

Colorado draws its boundary at device class rather than treatment name, which makes it unusually mechanical to apply. Class I, II, and IIIa devices — the low-power band covering most LED panels — sit below the threshold, which is why an LED facial remains an esthetician service. Class IIIb and Class IV sit above it, capturing essentially every aesthetic platform sold: diode and alexandrite hair removal, Nd:YAG, fractional and ablative resurfacing, picosecond and Q-switched pigment systems, and IPL.

So find the classification in the manufacturer's documentation and FDA clearance paperwork, not the sales deck. "It is on a gentle setting" is not a classification. If the paperwork says IIIb or IV, Colorado says medicine — and that does not change because your menu calls it a photofacial.

From Rule 800 to 3 CCR 713-1.17

Many Colorado compliance packets still say "Rule 800." That rule was codified at 3 CCR 713-30, recodified into 3 CCR 713-1 effective July 15, 2023, and now sits at 3 CCR 713-1.17. The substance carried over; the citation did not. A binder citing Rule 800 without mentioning 1.17 tells an investigator it has not been reviewed since 2023. For the national framing, see our overview of who can operate a laser at a med spa.

Who Can Operate a Laser at a Colorado Med Spa

Because operation is a medical act, the question is never "is this person certified?" but "does this person hold medical authority, or a valid delegation of it?" Colorado's answer runs down the license ladder, then keeps going past the bottom rung.

Physicians (MD/DO)

A Colorado-licensed physician in good standing may operate any laser within their training and competence, and is the source of most delegated authority in the state. The physician owns the standard of care and the duty to manage burns, blistering, hyperpigmentation, scarring, and ocular injury, and usually writes the protocols the team works from. Our Colorado medical director requirements guide covers what that role really involves.

APRNs with Full Practice Authority

Colorado is a full practice authority state, and that matters more for lasers than for almost any other service. An APRN with prescriptive authority can evaluate patients, make the treatment decision, own the protocols, operate the device, and delegate it — with no physician in the chain. That is why HB25-1024 reaches APRN delegators expressly, and why a Colorado laser program can be built entirely around a nurse practitioner.

Physician Assistants

A Colorado PA may operate lasers under a collaborative agreement, with a supervisory agreement during the first 5,000 practice hours under SB23-083. The PA holds a genuine medical license, so a PA can also perform the evaluation that lawfully opens treatment — but still needs documented device-specific training, since a license authorizes the act, not competence on a particular platform.

Registered Nurses

RNs operate lasers and IPL routinely, pursuant to a valid order from a provider who evaluated the patient. The nuance is what the RN does not do independently: determine candidacy, select the device or wavelength, or set parameters outside the ordered protocol. The Colorado Board of Nursing does not regulate cosmetic lasers, so an RN cannot look to nursing rules for permission the Medical Board must supply. Because an RN is licensed, RN-delivered services do not trigger the HB25-1024 disclosures.

Estheticians and Laser Technicians — Delegatees Only

Here Colorado departs from most of the country. An esthetician, medical assistant, or holder of a vendor "certified laser technician" certificate may lawfully operate a Class IIIb or higher laser — but only as a Rule 1.17 delegatee of a physician or APRN, acting as an unlicensed person. The certificate is evidence of training, never authority. What authorizes the treatment is the delegation file; without it, the same person doing the same treatment is practicing medicine without a license.

Who Has No Independent Authority

• Estheticians and cosmetologists — licensed by DORA's Office of Barber and Cosmetology Licensure. Rule 1.8 of 4 CCR 731-1 excludes anything past the epidermis. Lawful only through delegation.
• Medical assistants and unlicensed staff — same position: lawful only inside a properly built delegation.
• "Certified laser technician" and "master laser specialist" certificate holders — Colorado does not license or recognize these titles.

Is Laser Hair Removal the Practice of Medicine in Colorado?

Hair removal deserves its own section: it is the highest-volume laser service in the state and the one operators most often assume falls outside medicine. In Colorado it does not.

The "And/Or for Hair Removal" Clause

Rule 1.17 reaches techniques that revise, destroy, incise, or structurally alter human tissue and/or are used for hair removal. Where a definition stops at "alteration of tissue," operators argue follicular damage is trivial or purely cosmetic. Colorado forecloses that by naming hair removal as its own trigger: an 810 nm diode is a medical-aesthetic device here whether or not you concede it alters tissue — and it does.

IPL Gets No Separate Treatment

The second argument is that IPL is not technically a laser, since a flashlamp emits broadband incoherent light. Physically true, legally irrelevant: Rule 1.17 names intense pulsed light on its own, so rebranding IPL hair reduction as a "light treatment" changes the marketing and nothing else. For the clinical downside that makes this oversight matter, see our guide to laser and peel complications.

The Franchise and Multi-Site Problem

National chains often port a technician-operated model built in a permissive state straight into Colorado. It can be made lawful here — the delegation route is wider than Ohio's or Florida's — but not by importing the staffing chart alone. Every site needs a delegating physician or APRN who has assessed each technician on each service, keeps the service list on site, monitors quality there every two weeks, and can attend a patient in person within thirty minutes of it. That last standard caps how many sites one delegator covers.

Delegation and Supervision Under Rule 1.17

Colorado's delegation rule is more permissive than most about who may be delegated to, and far more demanding about what the delegator must do. Operators who read only the first half get into trouble.

What May Be Delegated: Routine and Technical

Delegated services must be the type a reasonable and prudent physician would find within sound medical judgment to delegate, and should be routine, technical services that do not require the special skills of a licensed physician. Facilities must also be appropriate to the service. Applied to lasers: a standard hair-removal pass on an established protocol and a previously treated area is plausibly routine and technical. A first ablative pass, an aggressive setting change, treating around an unexpected lesion, or managing a blistering reaction is not — those require judgment in the moment, and judgment cannot be delegated.

Personal Competence Assessment and Over-the-Shoulder Monitoring

Before anyone works unobserved, the delegating physician or APRN must personally assess that person's qualifications and competence for each delegated service, including initial monitoring of them actually performing it. This is where vendor certificates fail: a three-day course elsewhere is not a Colorado competence assessment, because the assessment is something your delegating provider performs and documents. Keep dated records naming the device, service, and observer.

The Lists, the Protocols, and the Public File

Rule 1.17 turns delegation into a documented file, not an understanding. The delegating provider maintains a written list of delegatees and, for each, the authorized services with supporting qualification documentation. The written agreement must be available to the public at the site — not filed at a management company in another city. Every delegated service needs specific and detailed written treatment protocols plus adequate written emergency protocols: device-specific parameter ranges, skin-type guidance, test-spot policy, endpoints, and pathways for burns, ocular exposure, and infection.

The Thirty-Minute Rule

The baseline expectation is a delegating physician on the premises and readily available. Colorado then supplies a conditional relief valve: where the delegatee acts pursuant to specific and detailed written protocols and adequate written emergency protocols exist, on-premises presence may not be necessary — but the provider must be able to attend the patient in person within thirty minutes. That is a design constraint, not a loophole: it sets a geographic radius during operating hours and fails the moment your provider is in surgery. A practice with thin protocols does not get the relief valve at all.

Two-Week Quality Monitoring and Annual Reassessment

This is the part of Rule 1.17 most Colorado laser programs miss. At least every two weeks, the delegating provider must monitor the quality of the delegatee's services — through direct observation, review of care, outcomes, equipment, protocols, and charts — at the site where the services are performed. At least annually, the provider must personally reassess the delegatee's qualifications and competence. Put concretely: a delegator who visits quarterly is not compliant, however good the paperwork looks.

The Good-Faith Exam Before a Colorado Laser Treatment

Colorado never uses the phrase "good-faith exam," so some operators conclude the requirement does not exist here. It does — it arrives through the practice-of-medicine analysis rather than a named rule.

Where the Requirement Comes From

Two threads converge. Class IIIb and higher lasers and IPL systems are prescription medical devices, and a prescription device requires a licensed provider to evaluate the patient and authorize its use. And Rule 1.17 permits delegation only of routine, technical services — which presupposes the clinical decision already happened. If the person holding the handpiece is also deciding whether to treat at all, the delegation was never valid.

What the Evaluation Must Cover

A defensible Colorado evaluation is performed by a physician, APRN, or PA and documented before the first treatment. It establishes the provider-patient relationship, reviews history and medications, and screens the contraindications that actually cause laser injuries: photosensitizing drugs such as isotretinoin and tetracyclines, recent sun exposure, active infection in the area, pregnancy, keloids or melasma, and recent resurfacing. It assesses Fitzpatrick type and treatment area, confirms the device and indication, and records the plan and parameters the operator will follow.

Series Treatments and What Counts as a Re-Evaluation

Laser services run in series, so the evaluation is not a one-time gate. The order defines what was authorized: this device, this area, this parameter range, this many sessions. A material change — new area, new device, parameter escalation, a new medication, a reaction to the last session — sends the patient back to the provider. Put that trigger list in your protocols, because "the technician thought it looked fine" is where a delegated technical service becomes unlicensed medical judgment. The same discipline governs injectables, as we describe in who can inject Botox in Colorado.

Laser Safety: ANSI Z136.3, the LSO, and OSHA

Colorado writes the scope rules and stops: no laser safety code, no licensed safety officer, no device registration. That absence is not permission — the recognized national standards define the standard of care, and they are what a plaintiff's expert will measure you against.

ANSI Z136.3 and the Laser Safety Officer

ANSI Z136.3, "Safe Use of Lasers in Health Care," calls for a designated Laser Safety Officer wherever Class 3B or Class 4 systems operate — which is every aesthetic laser worth buying. The LSO maintains the written safety program, performs hazard evaluations, controls the nominal hazard zone, approves wavelength-specific eyewear, oversees training records, and investigates incidents. The standard applies whether the device is owned, leased, or rented. The LSO may be a physician, nurse, or trained staff member, but needs documented training and real authority to stop unsafe operation.

OSHA: Eyewear, Plume, and Documented Training

OSHA jurisdiction attaches the moment you have an employee. Wavelength-specific eyewear with adequate optical density is required for staff and patients inside the hazard zone — one pair of generic "laser glasses" does not protect across an alexandrite, an Nd:YAG, and an IPL, and mismatched eyewear is worse than none. Plume from ablative work can carry viable particulate, bringing the bloodborne pathogens standard and plume evacuation into play. Documented hazard training is the third leg. See OSHA's laser hazards guidance for the federal layer on top of Colorado's medical rules.

What Colorado Does Not Require — and Why It Still Matters

To be precise about the negative space: Colorado has no aesthetic-laser device registration scheme, no operator license, no mandated training hours, and no rule naming an LSO. Confirm current requirements with the Medical Board and, for radiation questions, the Colorado Department of Public Health and Environment. But do not mistake the gap for freedom — with no state credential to point to, the only proof your operator was qualified is your competence assessment, training file, protocols, and safety program. In a Colorado laser case, the file is the defense.

HB25-1024: Your Delegated Laser Program Is Now Public

Colorado added a transparency layer in 2025 that changes the calculus of running lasers through delegatees. House Bill 25-1024, signed April 7, 2025 and effective August 6, 2025, did not change what may be delegated under Rule 1.17. It changed what has to be disclosed.

The Sign, the Website, and the Advertising

Where a physician or APRN delegates medical-aesthetic services to a person who is not a licensed health-care provider, the practice must post a highly visible on-site sign giving the delegating practitioner's name, license number, and contact information, plus the board's web address for complaints. The same arrangement must be disclosed on the website and in advertising for that person. For a hair-removal business staffed by esthetician delegatees, the staffing model is now legible to every patient who walks in.

The Signed Consent and Seven-Year Retention

The practice must also obtain written informed consent stating that the patient is receiving a medical-aesthetic service delegated to an unlicensed individual, containing the same licensee details as the sign, signed before treatment begins, and retained for at least seven years. This is a separate document, not a line in a general consent — and an unsigned acknowledgment is a standing violation on every chart it is missing from.

SB25-152 and Credential Disclosure in Advertising

A second layer landed in 2026. SB25-152, effective June 1, 2026, requires health-care advertising that names a practitioner to clearly identify their Colorado license or credential. The effect is cumulative: if your website names the person treating, the advertising must be accurate about what they are, and if that person is an unlicensed delegatee, the delegation has to be disclosed too. Titles like "medical aesthetician" and "master laser specialist" are what these rules target — Colorado issues neither.

Estheticians, Laser Technicians, and the Cosmetology Line

The most common Colorado laser question is whether an esthetician can run the device. The answer has two halves, and quoting one produces a wrong answer.

The Epidermis Test in Rule 1.8

Estheticians are licensed under the Barber and Cosmetologist Act and the rules at 4 CCR 731-1. Rule 1.8 imposes a universal prohibition: a licensee may not perform a service, or use any implement, device, product, machine, tool, or technique, that penetrates, destroys, or alters the client's skin beyond the epidermis. A Class IIIb or IV laser destroys a chromophore in living tissue below the epidermis. That is the whole analysis — and physician supervision does not enlarge a cosmetology license.

The Delegation Door Colorado Leaves Open

The second half is what makes Colorado unusual. Rule 1.8 expressly contemplates services delegated under the Medical Practice Act, so the same esthetician may lawfully operate the laser — not as an esthetician, but as a Rule 1.17 delegatee acting as an unlicensed person. Everything above then applies: competence assessment, annual reassessment, the service list at the site, detailed protocols, thirty-minute availability, two-week monitoring, and HB25-1024 disclosures. For the full map of the license, see our Colorado esthetician and skin scope guide.

Penalties for Improper Laser Use in Colorado

Colorado does not treat laser scope as a paperwork matter, and the exposure reaches everyone in the chain.

Unauthorized Practice of Medicine

Operating a Class IIIb or higher laser without a medical license and without valid Rule 1.17 delegation is the unauthorized practice of medicine — a Medical Board matter carrying injunctive and criminal exposure. A physician's name on the wall does not cure it. No competence assessment, no authorized-service list, no protocols, no realistic thirty-minute availability means no delegation, and a delegation that exists only on paper is precisely what the Board looks for.

Discipline Against the Delegating Provider

The delegating physician or APRN faces separate discipline for improper delegation — fines, practice conditions, probation, suspension, revocation — and the two-week monitoring and annual reassessment duties are what an investigator will ask them to evidence. Providers who lend their license to sites they rarely visit are the most exposed group in the state. DORA's cosmetology office can separately discipline an esthetics license used beyond Rule 1.8, and it has been referring cases to the Medical Board.

Civil Liability and the Insurance Gap

On top of regulatory action sits civil liability for burns, scarring, dyspigmentation, and ocular injury — where laser cases become business-ending rather than merely expensive. Professional liability policies routinely exclude treatment outside the insured's licensed scope, so one full-thickness burn from an operator who was not validly delegated can land as an uninsured personal-liability judgment against the operator and the owner. Audit coverage against the devices and credentials actually in the building. For how Colorado compares, see our med spa regulations by state reference.

Common Colorado Laser Violations

The same patterns recur across Colorado enforcement files and malpractice claims — read this as a self-audit list.

1. The certificate-only technician. Hired on a vendor credential with no delegation file behind it — the most common violation in the state.
2. Delegation on paper only. A signed agreement with no dated competence assessment and no evidence the delegator watched the person work.
3. The absent delegator. No two-week on-site monitoring, no annual reassessment, and a thirty-minute claim no one could meet.
4. Thin or generic protocols. Manufacturer manuals instead of written treatment and emergency protocols, which also forfeits relief from on-premises presence.
5. No provider evaluation, or a stale one. Treating on an intake form, or continuing a series after a material change.
6. Missing HB25-1024 disclosures. No sign, nothing on the website, no signed acknowledgment retained seven years.
7. No safety program. No LSO, mismatched eyewear, no controlled hazard zone, no plume evacuation, no documented training.

Building a Compliant Colorado Laser Program

A defensible Colorado laser program has a recognizable shape. Use this as a build order.

1. Classify every device. Record class and FDA clearance from manufacturer documentation; treat Class IIIb and above, IPL, and tissue-altering radiofrequency as medical.
2. Name the authority. Identify the physician or APRN who owns clinical decision-making, and confirm they can meet the thirty-minute standard at each site.
3. Decide each operator's route. Provider, PA, RN on order, or Rule 1.17 delegatee — written down per person and per service.
4. Build the delegation file. Dated competence assessments, authorized-service lists, qualification documentation, annual reassessments, and the agreement available to the public at the site.
5. Write real protocols. Device-specific parameters, skin-type guidance, test spots, endpoints, and emergency protocols for burns and ocular exposure.
6. Schedule the monitoring. Put the two-week on-site quality review on the calendar with a documented method.
7. Build the evaluation workflow. Provider evaluation and treatment order before the first session, with a trigger list for what sends a patient back.
8. Stand up the safety program. Train an LSO, match eyewear to every wavelength, control the hazard zone, set up plume evacuation.
9. Post the disclosures. HB25-1024 sign, website, and advertising disclosures plus the signed consent retained seven years, and align advertising with SB25-152.
10. Match insurance to reality. Confirm coverage reflects the devices, indications, and credentials in the building.

Industry groups such as the American Med Spa Association track Colorado's delegation and disclosure rules and usefully supplement Colorado healthcare counsel. If you would rather not draft the protocols, competence assessments, and consent forms from scratch, our library of ready-to-use med spa compliance SOPs and protocol kits maps directly to every step above.

Summary: Colorado Laser Rules in Plain Terms

• Rule 1.17 makes Class IIIb and higher lasers, radiofrequency devices, and IPL medical-aesthetic services — expressly including for hair removal.
• Class I, II, and IIIa devices sit below the threshold, which is why LED facials remain esthetician services.
• Colorado issues no laser operator license; a vendor certificate is training evidence, not authority.
• Physicians and APRNs with prescriptive authority may operate and delegate; PAs work under a collaborative agreement; RNs operate on a provider order.
• Estheticians, medical assistants, and technicians may operate only as Rule 1.17 delegatees acting as unlicensed persons.
• Delegated services must be routine and technical, with a personal competence assessment and annual reassessment.
• The delegator must be on premises, or able to attend in person within thirty minutes where detailed written protocols exist.
• Quality monitoring is required every two weeks, at the site where the services are performed.
• A provider evaluation and treatment order must precede treatment — Colorado's functional good-faith exam.
• ANSI Z136.3 expects a Laser Safety Officer for Class 3B and 4 devices; OSHA adds eyewear, plume, and training duties.
• HB25-1024 requires posted, website, and advertising disclosures plus a signed consent retained seven years.
• Improper operation is the unauthorized practice of medicine, with delegator discipline and commonly uninsured civil liability.

For the complete pre-opening picture, work through the Colorado Med Spa Compliance Checklist, and browse the full Colorado med spa compliance hub.

This article is for informational purposes only and does not constitute legal or medical advice. Colorado laser regulation involves overlapping Colorado Medical Board, DORA cosmetology, and federal OSHA and ANSI requirements that are fact-specific and change over time, including the rule citations, delegation duties, disclosure obligations, and penalties referenced here. Confirm current requirements with the relevant Colorado agency and consult a Colorado healthcare attorney and a qualified Laser Safety Officer before launching or modifying a laser program.

Frequently Asked Questions