Colorado Keeps the Strictest Insurance AI Regime

Colorado continues to regulate insurance AI through its own law, SB21-169, and subsequent rulemaking on the testing of external consumer data and algorithms, rather than adopting the NAIC Model Bulletin. For carriers operating across state lines, Colorado remains the most demanding regime to plan around, and a preview of where unfair-discrimination testing requirements may head elsewhere.

The state’s approach is distinct in two ways. First, it requires carriers to test external consumer data and complex algorithms for unfair discrimination before deployment and on an ongoing basis. The rulemaking does not just ask for a policy; it asks for evidence that the data and models actually produce non-discriminatory outcomes. Second, Colorado has layered on additional disclosure and recourse obligations through SB 26-189, which takes effect January 1, 2027. The new law requires pre-use notice, 30-day adverse-outcome notice, human review, and data correction rights for consumers whose decisions are materially influenced by automated systems.

This makes Colorado a practical benchmark for multi-state carriers. A compliance program built to Colorado’s standard is likely to exceed the NAIC baseline, which means it can be rolled out nationally as a ceiling. The reverse is not true. A program built only to the NAIC Model Bulletin may satisfy most states, but it will not satisfy Colorado’s notice, testing, and recourse requirements. Carriers that treat Colorado as an exception rather than a standard will find themselves rebuilding workflows at the last minute.

The immediate operational impact is on three functions: underwriting, pricing, and claims. Any system that materially influences a consumer decision in Colorado must be documented, tested for bias, and supported by a consumer-facing appeal or correction path. That includes algorithms that do not look like AI in the popular sense, such as rules-based scoring or external data overlays. The legal trigger is the decision, not the technology. Even legacy systems that were built before SB21-169 may need to be re-examined if they are still used to sort, price, or deny coverage.

Carriers should expect Colorado’s rulemaking to continue evolving. The Division of Insurance has been active in interpreting SB21-169, and the transition to SB 26-189 will add new compliance deadlines through 2027. The carriers that stay ahead will treat Colorado as a permanent test bed for the rest of the country, not as a one-off filing requirement.

The lesson for other states is that the policy direction is clear even if the details differ. Regulators are converging on a set of expectations: know your models, test them for discriminatory outcomes, tell consumers when a decision is automated, and give them a way to challenge it. Colorado is further down that path than most. Carriers that solve for Colorado now will have reusable answers for California, New York, and any state that follows with similar rules. The reverse is not true.

We cover how state-level differences affect multi-state carriers in our guide to AI governance in insurance, and the full rule change is explained in our breakdown of Colorado SB 26-189.