InsureAI Wire

State AI Regulation Tracker

Colorado

Reviewed Aug 18, 2026 Markdown →

Colorado regulates insurer AI under its own law, SB 21-169, and the regulation that implements it, Amended Regulation 10-1-1 (3 CCR 702-10), rather than the NAIC model bulletin. Every place its text departs from the NAIC model bulletin, Dec 2023 is set out below, with the evidence on both sides.

On this page

What's different

The national model vs Colorado
Point-by-point comparison of the NAIC model bulletin and Colorado's own text. Each row links to the evidence on both sides.
NAIC model Colorado
Quantitative testing — Test for race bias before you rely on the model
Annual compliance report — Officer-signed report, every Dec 1 or Jul 1
If you use none of it — Attestation every Dec 1, even if you use none
Prior-auth decisions — A provider must own the prior-auth call
Governance committee A committee is suggested, not required Standing committee, functions named in the rule
Framework review No review cadence set Whole framework reviewed once a year
Vendor accountability Due diligence expected You answer to the Division, not the vendor
Lines covered Every insurer in the state Life, private auto and health only
Carve-outs No carve-outs Title, surety and most commercial are out

Click a row for the evidence on both sides. An em dash means that instrument says nothing on the point.

Related coverage

3 selected items · Reviewed Aug 24, 2026

What we compared it with

Reviewed Aug 18, 2026

SB 21-169 was signed in 2021, two years before the NAIC adopted the model text, and Regulation 10-1-1 has been in force since 2023, amended effective October 15, 2025. The two regimes grew up separately; neither is a version of the other.

Every difference, with both texts

9 found

Unless a difference says otherwise, everything below applies to individual life, private passenger auto, health plans.

Colorado is the only jurisdiction that makes insurers run a test. The framework must detect unfair discrimination with respect to race through quantitative testing set by the Division, and remediate what it finds.

Show the exact wording Hide the exact wording

Not in the model bulletin

The model bulletin never asks for a test: "quantitative" 0 hits, "disparate" 0 hits, and "race" 0 hits as a whole word (the only substring match is "traceability"). §3.2 asks for "bias analysis and minimization" and names no method, metric or threshold. Word-boundary counts over the 9-page, 28,577-character text, pypdf, 2026-08-18.

Colorado 3 CCR 702-10 §5.A

…must establish a risk-based governance and risk management framework that facilitates and supports policies, procedures, systems, and controls designed to determine whether the use of such ECDIS, algorithms, and predictive models potentially result in unfair discrimination with respect to race and remediate unfair discrimination, if detected through quantitative testing requirements established by the Division.

Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

Colorado turns the governance program into a filing: an annual report of no more than ten pages, signed by an officer, filed in SERFF, with a corrective action plan required from anyone who cannot attest.

Show the exact wording Hide the exact wording

Not in the model bulletin

The model bulletin creates no filing: "attest" 0 hits, "SERFF" 0 hits, and no scheduled report of any kind. Its only document hook is SECTION 4, which describes what a regulator may request during an investigation or market conduct action. Word-boundary counts, pypdf, 2026-08-18.

Colorado 3 CCR 702-10 §6.D

These reports must be signed by an officer attesting to compliance with this regulation. In the event an insurer is unable to attest to compliance with this regulation, the insurer must submit to the Division a corrective action plan. This report shall be no more than ten (10) pages including an executive summary and address Sections 5.A.1. through 5.A.13.

Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

Colorado also reaches insurers that use none of this technology. They are exempt from the framework but must still file an officer-signed attestation saying so, every December 1.

Show the exact wording Hide the exact wording

Not in the model bulletin

The model bulletin places no obligation on an insurer that does not use AI systems. It opens by addressing decisions "made or supported by" the technology, and no filing, notice or attestation appears anywhere in the text ("attest" 0 hits, pypdf, 2026-08-18).

Colorado 3 CCR 702-10 §6.E

Insurers that do not use ECDIS or algorithms and/or predictive models that use ECDIS are exempt from the requirements described in Section 5 and must submit to the Division within one month of the effective date of this regulation and on December 1 annually thereafter an attestation signed by an officer indicating that the insurer does not use ECDIS or algorithms and/or predictive models that use ECDIS.

Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

For health benefit plans, Colorado fixes who owns the decision: a provider acting for the insurer must be ultimately responsible when these systems inform a denial or modification of prior authorization.

Applies only to health plans.

Show the exact wording Hide the exact wording

Not in the model bulletin

"prior authorization" 0 hits in the model bulletin (pypdf, 2026-08-18). The model treats "the extent to which humans are involved in the final decision-making process" as one of five factors that set how strong controls should be (Section 3 introduction, pp.4-5), and never assigns a decision to a named role.

Colorado 3 CCR 702-10 §5.A.5

Health benefit plan insurers shall ensure that a provider acting on behalf of the insurer is ultimately responsible for the decisions made when ECDIS, or algorithms or predictive models that use ECDIS, are used to inform decisions to modify, or deny requests by a covered person or a covered person's provider for authorization prior to, or concurrent with, the provision of health care services to a covered person.

Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

The model suggests a committee and lists disciplines a company might include. Colorado requires a documented cross-functional group and names the functions, adding marketing and customer service to the model's list.

Show the exact wording Hide the exact wording

NAIC model bulletin §2.0 introduction and §2.3(a), p.5

…in developing its governance framework, the Insurer should consider addressing the following items: … The formation of centralized, federated, or otherwise constituted committees comprised of representatives from appropriate disciplines and units within the Insurer, such as business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance, and legal.

Colorado 3 CCR 702-10 §5.A.4

Documented cross-functional ECDIS, algorithm, and predictive model governance group composed of representatives from key functional areas including legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, as applicable.

Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

Colorado puts the whole framework on an annual clock. The model bulletin asks for monitoring and reporting protocols but sets no review cadence for the program itself.

Show the exact wording Hide the exact wording

NAIC model bulletin §2.3(d), p.6

Monitoring, auditing, escalation, and reporting protocols and requirements.

Colorado 3 CCR 702-10 §5.A.14

Documented comprehensive annual reviews of the governance structure and risk management framework and updates to the required documentation to ensure its continued accuracy and relevance.

The word "annual" appears three times in the model bulletin and every occurrence is a reference to the Corporate Governance Annual Disclosure Model Act (#305) in the legal-basis section, not a cadence for the AIS Program. pypdf, 2026-08-18.

Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

Using a vendor changes nothing about who answers to the Division, and Colorado says so on the face of the rule. It also lets the vendor hand documents to the Division directly on the insurer's behalf.

Show the exact wording Hide the exact wording

NAIC model bulletin §4.1, p.7

Due diligence and the methods employed by the Insurer to assess the third party and its data or AI Systems acquired from the third party to ensure that decisions made or supported from such AI Systems that could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the Insurer itself.

Colorado 3 CCR 702-10 §5.B

If an insurer uses third-party vendors and other external resources …, the insurer remains responsible for ensuring all requirements in Section 5.A. are met, including the production of any documents or information that the Division deems necessary to ensure compliance with regulatory requirements. … Insurers may satisfy requests for documentation and information by third-party vendors providing the requested documents or information directly to the Division on behalf of the insurer.

Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

The regulation reaches three lines of business. The model bulletin reaches every insurer in the state, whatever it writes.

Show the exact wording Hide the exact wording

NAIC model bulletin Section 3, p.4

all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an "AIS Program") for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices.

Colorado 3 CCR 702-10 §3

This regulation shall apply to all insurers authorized to do business in the state of Colorado and offering the following types of insurance: A. Individually issued life insurance; B. Private passenger automobile insurance; and C. Health benefit plans.

Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

The statute behind the regulation excludes title, surety and most commercial insurance outright, so those insurers sit outside the Colorado regime entirely rather than merely outside the three regulated lines.

Show the exact wording Hide the exact wording

NAIC model bulletin Section 1, p.1

to remind all Insurers that hold certificates of authority to do business in the state that decisions or actions impacting consumers that are made or supported by advanced analytical and computational technologies, including Artificial Intelligence (AI) Systems … must comply with all applicable insurance laws and regulations.

Colorado C.R.S. 10-3-1104.9(6)

NOTWITHSTANDING ANY PROVISION OF THIS SECTION TO THE CONTRARY, THIS SECTION DOES NOT APPLY TO: (a) TITLE INSURANCE …; (b) BONDS EXECUTED BY QUALIFIED SURETY COMPANIES …; OR (c) INSURERS ISSUING COMMERCIAL INSURANCE POLICIES; EXCEPT THAT THIS SECTION DOES APPLY TO INSURERS THAT ISSUE BUSINESS OWNERS' POLICIES OR COMMERCIAL GENERAL LIABILITY POLICIES, WHICH … HAVE ANNUAL PREMIUMS OF TEN THOUSAND DOLLARS OR LESS.

SB 21-169, codified at C.R.S. 10-3-1104.9 · retrieved 2026-08-18

What the regulator asks for

5 items · 4 yearly
  • report Every December 1

    A compliance report against Section 5, naming the title and qualifications of each person responsible and which requirement each one owns.

    Life insurers using ECDIS, or algorithms and predictive models that use ECDIS

    3 CCR 702-10 §6.B · read it · hide
    Life insurers that are using ECDIS … must submit to the Division on December 1, 2024 and annually thereafter a report summarizing compliance with the requirements in Section 5 and the title and qualifications of each individual responsible for ensuring compliance along with the specific requirement(s) from Section 5 for which that individual is responsible.

    Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

  • report Every July 1

    The same compliance report as life insurers file, on a different date. The first one was due July 1, 2026.

    Private passenger automobile and health benefit plan insurers using ECDIS

    3 CCR 702-10 §6.C · read it · hide
    Private passenger automobile insurers and health benefit plan insurers that are using ECDIS … must submit to the Division on July 1, 2026 and annually thereafter a report summarizing compliance with the requirements in Section 5 and the title and qualifications of each individual responsible for ensuring compliance…

    Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

  • attestation Every December 1

    An officer signs a statement that the company uses none of this technology. Not filing it is the same failure as not filing a report.

    Insurers in the three regulated lines that do not use ECDIS

    3 CCR 702-10 §6.E · read it · hide
    …must submit to the Division within one month of the effective date of this regulation and on December 1 annually thereafter an attestation signed by an officer indicating that the insurer does not use ECDIS or algorithms and/or predictive models that use ECDIS.

    Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

  • filing annual

    Everything goes through SERFF under the Annual Report filing type, one filing per insurer, with the description naming Regulation 10-1-1. Group filings are not accepted.

    Every insurer filing anything under Section 6

    3 CCR 702-10 §6.G · read it · hide
    All reports required by this Section 6 shall be submitted in SERFF using Annual Report as the filing type. Separate filings shall be used for each insurer. The filing description shall indicate that the report is being submitted pursuant to Colorado Insurance Regulation 10-1-1.

    Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

  • documentation on-request

    Beyond the ten-page report, every component of the framework itself has to be producible to the Division on request from the dates below onward.

    All insurers subject to Section 5

    3 CCR 702-10 §5.C · read it · hide
    For life insurers, all components of the governance structure and risk management framework required by Section 5 must be available upon request by the Division pursuant to § 10-3-1104.9(4), C.R.S. on December 1, 2024, and annually thereafter. For private passenger automobile and health benefit plan insurers, … on July 1, 2026, and annually thereafter.

    Amended Regulation 10-1-1 (3 CCR 702-10) · retrieved 2026-08-18

The NAIC's examination tool. Colorado is one of twelve states trialling the NAIC's AI Systems Evaluation Tool, the questionnaire regulators are building for AI examinations. The trial runs from March to September 2026 and is about how examiners will work, not a new duty on insurers. Source ↗

If you write in more than one state

A program built to satisfy the model bulletin will not satisfy Colorado, and the gap is not a matter of degree. Two things are missing from it by construction: a quantitative test for race-based unfair discrimination, and a calendar filing. If Colorado is on the licence list, those two drive the schedule and the model-bulletin states ride along behind them. The one trap is the exemption: a company that uses none of this technology in Colorado still files, every December 1.

Based on

Sources read

Not legal advice. How this tracker is sourced →

Compare with another state

California Own rules 6 differences · 2 standing obligations New York Own rules 9 differences · 6 standing obligations Texas Own rules 6 differences · 2 standing obligations

Or go back to the table of all 51 jurisdictions.