# Colorado AI insurance law: SB 21-169, Regulation 10-1-1, and how they differ from the NAIC model bulletin

> Colorado is recorded as 'Independent framework' on the NAIC adoption map, under 3 CCR 702-10 (Reg 10-1-1). SB 21-169 was signed in 2021, two years before the NAIC adopted the model text, and Regulation 10-1-1 has been in force since 2023, amended effective October 15, 2025. The two regimes grew up separately; neither is a version of the other.

- Source page: https://insureaiwire.com/states/colorado/
- Publication: InsureAI Wire
- Difference layer reviewed: 2026-08-18
- Measured against: naic-model-bulletin-2023-12-04 (parallel-framework)
- NAIC AI Systems Evaluation Tool pilot: participating. The trial runs from March to September 2026 and is about how examiners will work, not a new duty on insurers. (https://content.naic.org/sites/default/files/call_materials/Pilot%20Project%20Summary.pdf)
- Method: every departure below is quoted from both instruments with a locator. Where one side has nothing to quote, the reading that established the absence is given in its place. Not legal advice.

## What is different

| Point | NAIC model | Colorado |
|---|---|---|
| Quantitative testing | — | Test for race bias before you rely on the model |
| Annual compliance report | — | Officer-signed report, every Dec 1 or Jul 1 |
| If you use none of it | — | Attestation every Dec 1, even if you use none |
| Prior-auth decisions | — | A provider must own the prior-auth call |
| Governance committee | A committee is suggested, not required | Standing committee, functions named in the rule |
| Framework review | No review cadence set | Whole framework reviewed once a year |
| Vendor accountability | Due diligence expected | You answer to the Division, not the vendor |
| Lines covered | Every insurer in the state | Life, private auto and health only |
| Carve-outs | No carve-outs | Title, surety and most commercial are out |

An em dash means that instrument says nothing on the point. That is a finding, not a gap in the review.

## Every difference, with both texts

### Who and what it covers

#### Covers fewer insurers: The regulation reaches three lines of business. The model bulletin reaches every insurer in the state, whatever it writes.

- Item id: co-scope-three-lines
- NAIC model bulletin (Section 3, p.4): 'all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an "AIS Program") for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices.'
- Colorado (3 CCR 702-10 §3): 'This regulation shall apply to all insurers authorized to do business in the state of Colorado and offering the following types of insurance: A. Individually issued life insurance; B. Private passenger automobile insurance; and C. Health benefit plans.'
- Lines affected: life, auto, health
- Source: Amended Regulation 10-1-1 (3 CCR 702-10) · Colorado DOI, retrieved 2026-08-18 via curl + pypdf (https://doi.colorado.gov/announcements/notice-of-adoption-amended-regulation-10-1-1-governance-and-risk-management-framework)

#### Covers fewer insurers: The statute behind the regulation excludes title, surety and most commercial insurance outright, so those insurers sit outside the Colorado regime entirely rather than merely outside the three regulated lines.

- Item id: co-statutory-carve-outs
- NAIC model bulletin (Section 1, p.1): 'to remind all Insurers that hold certificates of authority to do business in the state that decisions or actions impacting consumers that are made or supported by advanced analytical and computational technologies, including Artificial Intelligence (AI) Systems … must comply with all applicable insurance laws and regulations.'
- Colorado (C.R.S. 10-3-1104.9(6)): 'NOTWITHSTANDING ANY PROVISION OF THIS SECTION TO THE CONTRARY, THIS SECTION DOES NOT APPLY TO: (a) TITLE INSURANCE …; (b) BONDS EXECUTED BY QUALIFIED SURETY COMPANIES …; OR (c) INSURERS ISSUING COMMERCIAL INSURANCE POLICIES; EXCEPT THAT THIS SECTION DOES APPLY TO INSURERS THAT ISSUE BUSINESS OWNERS' POLICIES OR COMMERCIAL GENERAL LIABILITY POLICIES, WHICH … HAVE ANNUAL PREMIUMS OF TEN THOUSAND DOLLARS OR LESS.'
- Source: SB 21-169, codified at C.R.S. 10-3-1104.9 · Colorado General Assembly, retrieved 2026-08-18 via curl bill_files/54604/download + pypdf (https://leg.colorado.gov/bills/sb21-169)

### Testing you have to run

#### Extra requirement here: Colorado is the only jurisdiction that makes insurers run a test. The framework must detect unfair discrimination with respect to race through quantitative testing set by the Division, and remediate what it finds.

- Item id: co-quantitative-testing
- Not in the model bulletin. Basis for that reading: The model bulletin never asks for a test: "quantitative" 0 hits, "disparate" 0 hits, and "race" 0 hits as a whole word (the only substring match is "traceability"). §3.2 asks for "bias analysis and minimization" and names no method, metric or threshold. Word-boundary counts over the 9-page, 28,577-character text, pypdf, 2026-08-18.
- Colorado (3 CCR 702-10 §5.A): '…must establish a risk-based governance and risk management framework that facilitates and supports policies, procedures, systems, and controls designed to determine whether the use of such ECDIS, algorithms, and predictive models potentially result in unfair discrimination with respect to race and remediate unfair discrimination, if detected through quantitative testing requirements established by the Division.'
- Lines affected: life, auto, health
- Source: Amended Regulation 10-1-1 (3 CCR 702-10) · Colorado DOI, retrieved 2026-08-18 via curl + pypdf (https://doi.colorado.gov/announcements/notice-of-adoption-amended-regulation-10-1-1-governance-and-risk-management-framework)

### What you have to file

#### Extra requirement here: Colorado turns the governance program into a filing: an annual report of no more than ten pages, signed by an officer, filed in SERFF, with a corrective action plan required from anyone who cannot attest.

- Item id: co-annual-compliance-report
- Not in the model bulletin. Basis for that reading: The model bulletin creates no filing: "attest" 0 hits, "SERFF" 0 hits, and no scheduled report of any kind. Its only document hook is SECTION 4, which describes what a regulator may request during an investigation or market conduct action. Word-boundary counts, pypdf, 2026-08-18.
- Colorado (3 CCR 702-10 §6.D): 'These reports must be signed by an officer attesting to compliance with this regulation. In the event an insurer is unable to attest to compliance with this regulation, the insurer must submit to the Division a corrective action plan. This report shall be no more than ten (10) pages including an executive summary and address Sections 5.A.1. through 5.A.13.'
- Lines affected: life, auto, health
- Source: Amended Regulation 10-1-1 (3 CCR 702-10) · Colorado DOI, retrieved 2026-08-18 via curl + pypdf (https://doi.colorado.gov/announcements/notice-of-adoption-amended-regulation-10-1-1-governance-and-risk-management-framework)

#### Extra requirement here: Colorado also reaches insurers that use none of this technology. They are exempt from the framework but must still file an officer-signed attestation saying so, every December 1.

- Item id: co-non-use-attestation
- Not in the model bulletin. Basis for that reading: The model bulletin places no obligation on an insurer that does not use AI systems. It opens by addressing decisions "made or supported by" the technology, and no filing, notice or attestation appears anywhere in the text ("attest" 0 hits, pypdf, 2026-08-18).
- Colorado (3 CCR 702-10 §6.E): 'Insurers that do not use ECDIS or algorithms and/or predictive models that use ECDIS are exempt from the requirements described in Section 5 and must submit to the Division within one month of the effective date of this regulation and on December 1 annually thereafter an attestation signed by an officer indicating that the insurer does not use ECDIS or algorithms and/or predictive models that use ECDIS.'
- Source: Amended Regulation 10-1-1 (3 CCR 702-10) · Colorado DOI, retrieved 2026-08-18 via curl + pypdf (https://doi.colorado.gov/announcements/notice-of-adoption-amended-regulation-10-1-1-governance-and-risk-management-framework)

### The written programme

#### Extra requirement here: For health benefit plans, Colorado fixes who owns the decision: a provider acting for the insurer must be ultimately responsible when these systems inform a denial or modification of prior authorization.

- Item id: co-health-prior-auth-provider
- Not in the model bulletin. Basis for that reading: "prior authorization" 0 hits in the model bulletin (pypdf, 2026-08-18). The model treats "the extent to which humans are involved in the final decision-making process" as one of five factors that set how strong controls should be (Section 3 introduction, pp.4-5), and never assigns a decision to a named role.
- Colorado (3 CCR 702-10 §5.A.5): 'Health benefit plan insurers shall ensure that a provider acting on behalf of the insurer is ultimately responsible for the decisions made when ECDIS, or algorithms or predictive models that use ECDIS, are used to inform decisions to modify, or deny requests by a covered person or a covered person's provider for authorization prior to, or concurrent with, the provision of health care services to a covered person.'
- Lines affected: health
- Source: Amended Regulation 10-1-1 (3 CCR 702-10) · Colorado DOI, retrieved 2026-08-18 via curl + pypdf (https://doi.colorado.gov/announcements/notice-of-adoption-amended-regulation-10-1-1-governance-and-risk-management-framework)

### Who signs off

#### Goes further here: The model suggests a committee and lists disciplines a company might include. Colorado requires a documented cross-functional group and names the functions, adding marketing and customer service to the model's list.

- Item id: co-cross-functional-group
- NAIC model bulletin (§2.0 introduction and §2.3(a), p.5): '…in developing its governance framework, the Insurer should consider addressing the following items: … The formation of centralized, federated, or otherwise constituted committees comprised of representatives from appropriate disciplines and units within the Insurer, such as business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance, and legal.'
- Colorado (3 CCR 702-10 §5.A.4): 'Documented cross-functional ECDIS, algorithm, and predictive model governance group composed of representatives from key functional areas including legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, as applicable.'
- Lines affected: life, auto, health
- Source: Amended Regulation 10-1-1 (3 CCR 702-10) · Colorado DOI, retrieved 2026-08-18 via curl + pypdf (https://doi.colorado.gov/announcements/notice-of-adoption-amended-regulation-10-1-1-governance-and-risk-management-framework)

#### Goes further here: Colorado puts the whole framework on an annual clock. The model bulletin asks for monitoring and reporting protocols but sets no review cadence for the program itself.

- Item id: co-annual-framework-review
- NAIC model bulletin (§2.3(d), p.6): 'Monitoring, auditing, escalation, and reporting protocols and requirements.'
- Colorado (3 CCR 702-10 §5.A.14): 'Documented comprehensive annual reviews of the governance structure and risk management framework and updates to the required documentation to ensure its continued accuracy and relevance.'
- Supporting reading: The word "annual" appears three times in the model bulletin and every occurrence is a reference to the Corporate Governance Annual Disclosure Model Act (#305) in the legal-basis section, not a cadence for the AIS Program. pypdf, 2026-08-18.
- Lines affected: life, auto, health
- Source: Amended Regulation 10-1-1 (3 CCR 702-10) · Colorado DOI, retrieved 2026-08-18 via curl + pypdf (https://doi.colorado.gov/announcements/notice-of-adoption-amended-regulation-10-1-1-governance-and-risk-management-framework)

### Vendors and outside data

#### Goes further here: Using a vendor changes nothing about who answers to the Division, and Colorado says so on the face of the rule. It also lets the vendor hand documents to the Division directly on the insurer's behalf.

- Item id: co-third-party-responsibility
- NAIC model bulletin (§4.1, p.7): 'Due diligence and the methods employed by the Insurer to assess the third party and its data or AI Systems acquired from the third party to ensure that decisions made or supported from such AI Systems that could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the Insurer itself.'
- Colorado (3 CCR 702-10 §5.B): 'If an insurer uses third-party vendors and other external resources …, the insurer remains responsible for ensuring all requirements in Section 5.A. are met, including the production of any documents or information that the Division deems necessary to ensure compliance with regulatory requirements. … Insurers may satisfy requests for documentation and information by third-party vendors providing the requested documents or information directly to the Division on behalf of the insurer.'
- Lines affected: life, auto, health
- Source: Amended Regulation 10-1-1 (3 CCR 702-10) · Colorado DOI, retrieved 2026-08-18 via curl + pypdf (https://doi.colorado.gov/announcements/notice-of-adoption-amended-regulation-10-1-1-governance-and-risk-management-framework)


## What the regulator asks for

| Obligation | Who | Cadence | Due | Citation |
|---|---|---|---|---|
| A compliance report against Section 5, naming the title and qualifications of each person responsible and which requirement each one owns. | Life insurers using ECDIS, or algorithms and predictive models that use ECDIS | annual | Every December 1 | 3 CCR 702-10 §6.B |
| The same compliance report as life insurers file, on a different date. The first one was due July 1, 2026. | Private passenger automobile and health benefit plan insurers using ECDIS | annual | Every July 1 | 3 CCR 702-10 §6.C |
| An officer signs a statement that the company uses none of this technology. Not filing it is the same failure as not filing a report. | Insurers in the three regulated lines that do not use ECDIS | annual | Every December 1 | 3 CCR 702-10 §6.E |
| Everything goes through SERFF under the Annual Report filing type, one filing per insurer, with the description naming Regulation 10-1-1. Group filings are not accepted. | Every insurer filing anything under Section 6 | annual |  | 3 CCR 702-10 §6.G |
| Beyond the ten-page report, every component of the framework itself has to be producible to the Division on request from the dates below onward. | All insurers subject to Section 5 | on-request |  | 3 CCR 702-10 §5.C |

- 3 CCR 702-10 §6.B: 'Life insurers that are using ECDIS … must submit to the Division on December 1, 2024 and annually thereafter a report summarizing compliance with the requirements in Section 5 and the title and qualifications of each individual responsible for ensuring compliance along with the specific requirement(s) from Section 5 for which that individual is responsible.'
- 3 CCR 702-10 §6.C: 'Private passenger automobile insurers and health benefit plan insurers that are using ECDIS … must submit to the Division on July 1, 2026 and annually thereafter a report summarizing compliance with the requirements in Section 5 and the title and qualifications of each individual responsible for ensuring compliance…'
- 3 CCR 702-10 §6.E: '…must submit to the Division within one month of the effective date of this regulation and on December 1 annually thereafter an attestation signed by an officer indicating that the insurer does not use ECDIS or algorithms and/or predictive models that use ECDIS.'
- 3 CCR 702-10 §6.G: 'All reports required by this Section 6 shall be submitted in SERFF using Annual Report as the filing type. Separate filings shall be used for each insurer. The filing description shall indicate that the report is being submitted pursuant to Colorado Insurance Regulation 10-1-1.'
- 3 CCR 702-10 §5.C: 'For life insurers, all components of the governance structure and risk management framework required by Section 5 must be available upon request by the Division pursuant to § 10-3-1104.9(4), C.R.S. on December 1, 2024, and annually thereafter. For private passenger automobile and health benefit plan insurers, … on July 1, 2026, and annually thereafter.'

NAIC AI Systems Evaluation Tool pilot: participating. The trial runs from March to September 2026 and is about how examiners will work, not a new duty on insurers. (https://content.naic.org/sites/default/files/call_materials/Pilot%20Project%20Summary.pdf)

## If you write in more than one state

A program built to satisfy the model bulletin will not satisfy Colorado, and the gap is not a matter of degree. Two things are missing from it by construction: a quantitative test for race-based unfair discrimination, and a calendar filing. If Colorado is on the licence list, those two drive the schedule and the model-bulletin states ride along behind them. The one trap is the exemption: a company that uses none of this technology in Colorado still files, every December 1. (This paragraph is InsureAI Wire's reading, resting on: co-quantitative-testing, co-annual-compliance-report, co-non-use-attestation, co-annual-report-life, co-non-use-attestation-filing.)

## What InsureAI Wire has written about Colorado

- Colorado Replaces Its AI Act with SB 26-189 (https://insureaiwire.com/colorado-sb-26-189/) · SB 26-189 replaced the Colorado AI Act: what changed, what SB 21-169 still governs, and which duties start on January 1, 2027.
- Colorado Keeps the Strictest Insurance AI Regime (https://insureaiwire.com/news/colorado-ai-insurance-regime/) · Why Colorado is still the only insurance regulator we can find whose adopted AI rule carries a filing.
- What Trump's AI Executive Order (EO 14365) Means for State Insurance Regulation (https://insureaiwire.com/ai-executive-order-insurance-preemption/) · Colorado is the federal AI executive order's one worked example, and xAI's suit against the attorney general is live.

## Sources read

- Amended Regulation 10-1-1 (3 CCR 702-10), effective October 15, 2025 · Colorado DOI, retrieved 2026-08-18 via curl + pypdf (regulation PDF reached from the DOI adoption notice; 6 pages, 16,674 characters) (https://doi.colorado.gov/announcements/notice-of-adoption-amended-regulation-10-1-1-governance-and-risk-management-framework)
- SB 21-169, codified at C.R.S. 10-3-1104.9 · Colorado General Assembly, retrieved 2026-08-18 via curl bill_files/54604/download + pypdf (the signed act; the file labelled Signed Act on the landing page, 54633, is the fiscal note) (https://leg.colorado.gov/bills/sb21-169)
- Model Bulletin: Use of Artificial Intelligence Systems by Insurers, adopted December 4, 2023 · NAIC, retrieved 2026-08-18 via curl + pypdf (9 pages, 28,577 characters) (https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf)
- AI Systems Evaluation Tool Pilot: Pilot Project Summary · NAIC, retrieved 2026-08-18 via curl + pypdf (357,714 bytes; participant list read from p.1) (https://content.naic.org/sites/default/files/call_materials/Pilot%20Project%20Summary.pdf)

Last reviewed Aug 18, 2026.