AI governance for Colorado insurers
Colorado does not follow the NAIC AI model bulletin. It runs its own, stricter regime. Senate Bill 21-169 prohibits insurers from using external consumer data and information sources (ECDIS), algorithms, and predictive models in ways that unfairly discriminate against consumers based on a protected class, and Regulation 10-1-1 requires a governance and risk-management framework around that use. The rules currently reach life, private passenger auto, and health benefit plan insurers.
What Colorado requires
Colorado's framework is built around the use of external consumer data and predictive models, not the NAIC's AIS-Program structure. Covered insurers must govern that use and prove it is not unfairly discriminatory.
Governance & accountability
Stand up a risk-based governance and risk-management framework for any use of ECDIS, algorithms, and predictive models, with documented senior-management and board oversight.
Bias testing & corrective action
Assess and document whether ECDIS or models produce unfairly discriminatory outcomes against consumers on the basis of a protected class, and take corrective action when they do.
ECDIS & model inventory
Maintain an inventory of the external data sources, algorithms, and predictive models in use, including third-party tools, and document how data flows into insurance decisions.
Reporting & attestation
File the progress reports and compliance documentation the Division requires. Insurers that do not use ECDIS must file an attestation to that effect.
Legal authority
Colorado grounds its regime in statute and regulation that go beyond the NAIC model:
- Restrictions on the use of external consumer data, algorithms, and predictive models (SB 21-169)C.R.S. §10-3-1104.9
- Governance and Risk Management Framework (Regulation 10-1-1)3 CCR 702-10
- Unfair methods of competition and unfair or deceptive actsC.R.S. §10-3-1104
Who it applies to
The ECDIS rules reach these lines today:
- Life insurers
- Private passenger automobile insurers
- Health benefit plan insurers
- Not yet extended to farm or commercial property and casualty lines
Scope note: Colorado's ECDIS rules currently reach life, private passenger auto, and health benefit plan insurers. They do not yet apply to farm or commercial property and casualty lines. The Division has expanded the framework line by line, so carriers in those segments should track new rulemaking rather than assume they are out of scope for good.
Compliance timeline
- Jul 6, 2021Governor signs SB 21-169 into law, codified at C.R.S. §10-3-1104.9.
- Sept 2023Division of Insurance adopts Regulation 10-1-1 (3 CCR 702-10), the governance framework for life insurers.
- Jun 1, 2024Life insurers' initial progress report due to the Division.
- Dec 1, 2024Life insurers' full governance-framework compliance; insurers that do not use ECDIS file an attestation.
- OngoingFramework extended to private passenger auto and health benefit plan insurers.
Resources for Colorado insurers
Start with these plain-language explainers and field guides.
What is the NAIC Model Bulletin on AI?
The NAIC Model Bulletin on the Use of AI Systems by Insurers is the template most states use to set AI governance expectations. Here is what it says and why it matters.
GuideWhat is an AIS Program?
An AI Systems Program (AIS Program) is the written program the NAIC Model Bulletin expects every insurer to maintain. Here are its four pillars and what each one requires.
GuideWhat are the NAIC AI Principles?
The NAIC AI Principles, adopted in 2020, are the foundation beneath every state AI bulletin. The five principles spell FACTS: Fair, Accountable, Compliant, Transparent, and Secure.
GuideAI in Insurance: Key Regulatory Definitions
The NAIC Model Bulletin defines the terms that carry legal weight, from AI System to Adverse Consumer Outcome to Model Drift. Here is what each one means for insurers.
ArticleInsurance Regulators Are Forcing AI Governance. Most Carriers Aren't Ready.
State insurance regulators and bar associations are sounding the alarm on AI in insurance. Legal and regulatory pressure is forcing insurers to operationalize AI governance, not just document it.
ArticleThe NAIC Bulletin Is the Floor Your Reinsurer Will Hold You To
Twenty-four jurisdictions have adopted the NAIC Model Bulletin on AI. Most carrier compliance teams are working to the regulatory text. Their reinsurers will use the same document as an evidentiary baseline at the next placement, and the cedent that meets the floor and stops there is preparing for the wrong audience.
Colorado insurance AI FAQs
Does Colorado follow the NAIC AI model bulletin?
What is ECDIS?
Which insurers does Colorado's regime cover?
What must a covered insurer do?
What were the key compliance dates?
Sources
- Colorado SB 21-169 (C.R.S. §10-3-1104.9), Colorado General Assembly
- Colorado Division of Insurance — SB 21-169 program page
- Regulation 10-1-1 (3 CCR 702-10), Colorado Secretary of State
- Bryan Cave Leighton Paisner — Colorado's new ECDIS and AI model regulations
- Alston & Bird — New AI Regulation from the Colorado Dept. of Insurance
Get audit-ready for Colorado's ECDIS rules
Swept AI inventories your models and external data sources, runs the bias testing Colorado expects, and produces the governance documentation the Division can request.