Colorado Keeps the Strictest Insurance AI Regime

Colorado continues to regulate insurance AI through its own statute, SB 21-169, and the Division of Insurance rules built under it, rather than adopting the NAIC Model Bulletin. What keeps it the most demanding regime to plan around is not that it piles the most law on carriers. It is that as of July 2026 Colorado’s is the only insurance regulator in the country we can find with an adopted AI rule that carries a filing, and the state’s newer general AI law defers back to it instead of layering on top.

The approach is distinct in two ways. First, the duties arrive line by line. SB 21-169 bars insurers from using external consumer data, algorithms, or predictive models that unfairly discriminate, but hands the Division the job of saying how that gets tested, one insurance type at a time. Regulation 10-1-1 is the one adopted so far, and an October 2025 amendment extended it from life alone to private passenger auto and health benefit plans. It asks those carriers for a governance and risk management framework aimed at unfair discrimination with respect to race, and for an annual compliance report signed by an officer. The regulation that would set the actual quantitative standards never got adopted, and there are now two drafts rather than one, the Division’s from 2023 and a version the American Council of Life Insurers put up in June 2024. The report line that depends on those standards was waived by bulletin for life insurers only, and only through the report due December 1, 2025.

Second, the newer general AI law steps aside rather than piling on. SB 26-189 arrives January 1, 2027 with pre-use notice, a 30-day adverse-outcome notice, human review, and data correction rights, but it deems an insurer subject to SB 21-169 to be in compliance in the practice of insurance. For a licensed carrier, the notice-and-recourse build lands on what sits outside that deference: employment and hiring systems, which the statute expressly carves back in, plus any vendor or third-party administrator running its own deployment, none of whom the deference reaches.

The asymmetry that follows is worth noticing. Satisfying Regulation 10-1-1 means holding documented model testing and an officer prepared to sign for it, which is more than the NAIC Model Bulletin asks of anyone. Satisfying the bulletin leaves a carrier with no filing, no attestation, and no line-specific testing record when Colorado asks for one.

The operational impact lands where SB 21-169 defines its insurance practices: marketing, underwriting, pricing, utilization management, reimbursement methodologies, and claims management. For carriers in the three lines the rules reach, the ask is evidence rather than policy, meaning documented testing, a framework with an owner, and a report an officer will sign. For other personal lines the prohibition still binds, but Colorado has not yet published the method for demonstrating you are clear of it. Check subsection (6) before assuming any of it is yours, because the statute excludes title insurance, surety bonds, and commercial policies apart from small business owners’ and commercial general liability books. The reach includes algorithms that do not look like AI in the popular sense, such as rules-based scoring or external data overlays, because the legal trigger is the decision and not the technology. Systems built before SB 21-169 are not grandfathered.

Colorado’s rulemaking is not finished evolving. Auto and health only came inside the framework rule in late 2025, homeowners has not been taken up at all, and the quantitative testing standards remain unwritten while the waiver on the reporting element they attach to has run out. Treating Colorado as a permanent test bed for the rest of the country, rather than a one-off filing requirement, is the posture that survives the next amendment.

For other states the direction is legible even where the details differ. Regulators keep arriving at the same two demands: know what your models do, and be able to produce the analysis that says they are not discriminating. Colorado is further along that path than anyone, which is why solving for it tends to produce answers that transfer to California, New York, and whoever follows. The one thing that will not transfer is the deference, since on the same July 2026 scan no other state has an insurance regulator with adopted rules for a general AI law to defer to.

What to do with that in a multi-state program is set out in our AI governance guide, which sorts state obligations into the ones worth replicating everywhere and the ones that stay put. Colorado’s testing methodology is in the first group and its filings are in the second. Which of the new duties survive the carve-out is in the SB 26-189 breakdown. Start with whatever touches a filed rate, since those are the items with a deadline attached.