AI governance for Colorado carriers
Colorado does not follow the NAIC AI model bulletin. It runs its own, stricter regime. Senate Bill 21-169 prohibits carriers from using external consumer data and information sources (ECDIS), algorithms, and predictive models in ways that unfairly discriminate against consumers based on a protected class, and Regulation 10-1-1 requires a governance and risk-management framework around that use. The rules currently reach life, private passenger auto, and health benefit plan carriers.
What Colorado requires
Colorado's framework is built around the use of external consumer data and predictive models, not the NAIC's AIS-Program structure. Covered carriers must govern that use and prove it is not unfairly discriminatory.
Governance & accountability
Stand up a risk-based governance and risk-management framework for any use of ECDIS, algorithms, and predictive models, with documented senior-management and board oversight.
Bias testing & corrective action
Assess and document whether ECDIS or models produce unfairly discriminatory outcomes against consumers on the basis of a protected class, and take corrective action when they do.
ECDIS & model inventory
Maintain an inventory of the external data sources, algorithms, and predictive models in use, including third-party tools, and document how data flows into insurance decisions.
Reporting & attestation
File the progress reports and compliance documentation the Division requires. Carriers that do not use ECDIS must file an attestation to that effect.
Legal authority
Colorado grounds its regime in statute and regulation that go beyond the NAIC model:
- Restrictions on the use of external consumer data, algorithms, and predictive models (SB 21-169)C.R.S. §10-3-1104.9
- Governance and Risk Management Framework (Regulation 10-1-1)3 CCR 702-10
- Unfair methods of competition and unfair or deceptive actsC.R.S. §10-3-1104
Who it applies to
The ECDIS rules reach these lines today:
- Life carriers
- Private passenger automobile carriers
- Health benefit plan carriers
- Not yet extended to farm or commercial property and casualty lines
Scope note: Colorado's ECDIS rules currently reach life, private passenger auto, and health benefit plan carriers. They do not yet apply to farm or commercial property and casualty lines. The Division has expanded the framework line by line, so carriers in those segments should track new rulemaking rather than assume they are out of scope for good.
Compliance timeline
- Jul 6, 2021Governor signs SB 21-169 into law, codified at C.R.S. §10-3-1104.9.
- Sept 2023Division of Insurance adopts Regulation 10-1-1 (3 CCR 702-10), the governance framework for life carriers.
- Jun 1, 2024Life carriers' initial progress report due to the Division.
- Dec 1, 2024Life carriers' full governance-framework compliance; carriers that do not use ECDIS file an attestation.
- OngoingFramework extended to private passenger auto and health benefit plan carriers.
Resources for Colorado carriers
Start with these plain-language explainers and field guides.
What is the NAIC Model Bulletin on AI?
The NAIC Model Bulletin on the Use of AI Systems by Insurers is the template most states use to set AI governance expectations. Here is what it says and why it matters.
GuideWhat is an AIS Program?
An AI Systems Program (AIS Program) is the written program the NAIC Model Bulletin expects every carrier to maintain. Here are its four pillars and what each one requires.
GuideWhat are the NAIC AI Principles?
The NAIC AI Principles, adopted in 2020, are the foundation beneath every state AI bulletin. The five principles spell FACTS: Fair, Accountable, Compliant, Transparent, and Secure.
GuideAI in Insurance: Key Regulatory Definitions
The NAIC Model Bulletin defines the terms that carry legal weight, from AI System to Adverse Consumer Outcome to Model Drift. Here is what each one means for carriers.
ArticleAI Governance for Insurance Carriers: Where AI Runs Across the Value Chain and What Regulators Expect
Insurance AI governance across underwriting, claims, catastrophe modeling, distribution, and cyber: where AI runs today, how its failures reach the loss ratio, and the evidence state regulators now expect carriers to produce.
ArticleReinsurance AI: How Reinsurers and Rating Agencies Are Underwriting Your AI
Reinsurers and rating agencies are already forming a view of the AI in your rating and claims stack. The treaty clauses, rating methodology, case history, and renewal evidence every carrier should understand.
Colorado insurance AI FAQs
Does Colorado follow the NAIC AI model bulletin?
What is ECDIS?
Which carriers does Colorado's regime cover?
What must a covered carrier do?
What were the key compliance dates?
Sources
- Colorado SB 21-169 (C.R.S. §10-3-1104.9), Colorado General Assembly
- Colorado Division of Insurance — SB 21-169 program page
- Regulation 10-1-1 (3 CCR 702-10), Colorado Secretary of State
- Bryan Cave Leighton Paisner — Colorado's new ECDIS and AI model regulations
- Alston & Bird — New AI Regulation from the Colorado Dept. of Insurance
Get audit-ready for Colorado's ECDIS rules
Swept AI inventories your models and external data sources, runs the bias testing Colorado expects, and produces the governance documentation the Division can request.