AI Regulation Tracker / State rulemaking
Colorado Extends Its Insurer AI Antidiscrimination Rules to Auto and Health
Colorado's Amended Regulation 10-1-1, adopted under SB21-169, expands the insurer governance and risk management framework for algorithms and predictive models beyond life insurers to private passenger auto and health benefit plan insurers. It took effect October 15, 2025, and insurers must be ready to show compliance beginning July 1, 2026.
Colorado has been ahead of the rest of the country on insurer use of AI since it passed Senate Bill 21-169 in 2021. That law told insurers they are accountable for the external consumer data, algorithms, and predictive models they use, and that those systems cannot unfairly discriminate on the basis of a protected class. Regulation 10-1-1 is how the Division turned that statute into an operating framework. It first landed on life insurers, who have been living under it since late 2023.
On August 20, 2025, the Division adopted an amended version of that regulation and pushed the same framework out to two more lines of business. In the Division's own words, the rule now sets requirements for "insurers authorized to do business in Colorado and offering individual life insurance, private passenger automobile insurance, and/or health benefit plans that use external consumer data and information sources (ECDIS), as well as algorithms and predictive models that use ECDIS, in any insurance practice." The Division also stated plainly that "This amended regulation is effective on October 15, 2025."
What the regulation actually requires
The core of the rule is Section 5, the governance and risk management framework. It does not hand you a specific algorithm to run or ban a particular data source. It requires you to build and document a program that controls how these systems get designed, used, and monitored, and that can show your work if the Division asks.
Three obligations sit at the center of it. First, a risk-based governance framework that lets the insurer determine whether its use of external data and its algorithms and predictive models produces unfair discrimination, and that remediates any unfair discrimination the insurer finds through testing. Second, oversight of that framework by the insurer's board or an appropriate board committee, so accountability is not buried three levels down in a data team. Third, a current inventory of the external consumer data sources in use, with a description of each, its purpose, the outputs it generates, and version control as things change.
None of that is optional, and none of it is a one-time exercise. The Division built the rule around ongoing testing and documentation, which is why the compliance obligation is framed as evidence you have to be able to produce, not a certificate you file once and forget.
The timeline that matters right now
The amended rule became effective October 15, 2025. Before that, auto and health insurers had a first checkpoint: a narrative report due to the Division by December 1, 2025 summarizing their progress toward meeting the Section 5 requirements. That was a progress narrative, not full compliance.
The harder date is July 1, 2026. From that point forward, private passenger auto and health benefit plan insurers must be able to make evidence of compliance with the amended regulation available to the Division upon request. As of today, that date has passed. If you are a covered insurer, you are now inside the window where the Division can ask to see the framework, the inventory, and the testing, and expect a real answer.
Why a Colorado insurance rule matters outside Colorado
If you are a US CPA or a finance leader who does not work for a Colorado insurer, this is still worth your attention, and not as trivia. SB21-169 and Regulation 10-1-1 are the most developed working model in the country for governing AI and predictive models in a regulated financial business. When other states and the National Association of Insurance Commissioners look for a template on algorithmic accountability, this is the one already running in production with real deadlines attached.
The structure Colorado chose travels well beyond insurance. A documented governance framework, board-level oversight, a live inventory of the data and models in use, and testing you can evidence on request is the same shape that AI governance is taking across regulated finance. If your organization uses external data or predictive models in any decision that touches consumers, the Colorado framework is a fair preview of the questions a regulator will eventually ask you, whatever your state or sector.
What to do now
If you are inside a covered Colorado insurer, treat July 1, 2026 as live and confirm you can actually produce what Section 5 requires: the documented framework, the board oversight record, the ECDIS inventory, and the testing results that show whether your models discriminate and what you did about it. If any of those exist only as intentions, close the gap now, because the obligation is to show evidence on request, not to promise it.
If you are outside Colorado, read the rule as a benchmark. Map where your own organization uses external data and predictive models, ask who owns the governance for them, and check whether you could produce an inventory and a testing record if a regulator asked. The point is not to comply with a Colorado rule you are not subject to. The point is that the questions in this rule are the ones coming for everyone who runs models in a regulated setting.
Questions professionals are asking
Is this a binding regulation or just guidance?
It is a binding state regulation. Amended Regulation 10-1-1 was adopted by the Colorado Commissioner of Insurance under SB21-169 and creates enforceable governance, inventory, and reporting obligations for covered insurers. It is not advisory guidance.
Which insurers does the amended rule now cover?
Insurers authorized to do business in Colorado that offer individual life insurance, private passenger automobile insurance, or health benefit plans and that use external consumer data, algorithms, or predictive models in any insurance practice. The amendment added private passenger auto and health benefit plan insurers to a framework that previously reached only life insurers.
What are the key dates?
The amended regulation became effective October 15, 2025. Auto and health insurers had to submit a narrative progress report by December 1, 2025. Evidence of compliance must be available to the Division upon request beginning July 1, 2026.
What does the framework require insurers to do?
Section 5 requires a documented, risk-based governance and risk management framework to determine and remediate unfair discrimination from external data, algorithms, and predictive models; board or board-committee oversight of that framework; and a current inventory of the external consumer data sources in use, including their purpose, outputs, and version history.
Does this affect insurers or finance teams outside Colorado?
Not as a direct legal duty. Only insurers doing business in Colorado in the covered lines are subject to the rule. But SB21-169 and Regulation 10-1-1 are the leading US model for governing AI and predictive models in a regulated financial business, so other states, the NAIC, and finance leaders in other sectors watch it as a template.
RELATED BRIEFINGS
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal, accounting, or audit advice. Confirm how any regulation applies to your situation with qualified professionals in the relevant jurisdiction.