Amended Regulation 10-1-1 is eleven sections long and cites something else in almost every operative sentence. Reading it as a summary produces a compliance plan that is wrong in ways an examiner will find, because the duty is never where the heading suggests.
Eight cross-references inside the SB 21-169 rule are followed below, each to the place it actually arrives. Three arrive somewhere narrower than the instrument that sent you, one arrives at a document that does not exist, and one sends an insurer taking up ECDIS to a subsection written for a different line of business.
The Code of Colorado Regulations records adoption on 19 August 2025 under eDocket 2025-00162, with publication in the Colorado Register on 25 September 2025. Effect followed on 15 October 2025. The Secretary of State’s editor’s note records an entire-rule replacement of the life-only text that had applied since 14 November 2023, not a partial amendment.
Section 5.A narrows the statute’s nine characteristics to race alone
SB 21-169, codified at C.R.S. 10-3-1104.9, prohibits insurers from using external consumer data and information sources, or algorithms and predictive models that use them, in a way that unfairly discriminates on the basis of race, colour, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression. Nine characteristics.
Section 5.A of the SB 21-169 rule then describes what the framework has to detect. Controls must be “designed to determine whether the use of such ECDIS, algorithms, and predictive models potentially result in unfair discrimination with respect to race and remediate unfair discrimination, if detected through quantitative testing requirements established by the Division.”
Race appears once in the entire regulation, and it appears there. Earlier drafts of the amendment proposed the wider statutory set, and the version the Commissioner adopted kept the single characteristic, a narrowing that outside counsel noted at the time.
Section 4.O of the rule carries the reference one hop further. Unfair discrimination takes the meaning set out at C.R.S. 10-3-1104.9(8)(e), which is an effects test: use of external consumer data or a model built on it that correlates with a protected characteristic and produces “a disproportionately negative outcome for such classification or classifications, which negative outcome exceeds the reasonable correlation to the underlying insurance practice, including losses and costs for underwriting.” Correlation plus disproportionate effect, with no intent element and no need for a complainant.
SB 21-169 therefore runs two duties at different widths. The statutory prohibition covers nine characteristics and is enforceable on its own terms under C.R.S. 10-3-1104.9(1)(a); the documented framework the Division reads is scoped to one. An insurer that tests only for race satisfies the rule and remains exposed under the statute, which is an uncomfortable place to file from and worth stating explicitly in the framework’s governing principles.
Section 5.A.11 cites Division testing requirements that remain unadopted
ECDIS testing is the component most insurers assume is the hard one. Section 5.A.11 requires a “documented description of quantitative testing conducted pursuant to requirements established by the Division,” including methodology, assumptions, results and the steps taken to address unfairly discriminatory outcomes.
ECDIS testing requirements from the Division do not exist. No quantitative testing regulation has been adopted for life, automobile or health. The Division’s published implementation page shows a draft for life underwriting released on 28 September 2023.
An alternative draft came from the American Council of Life Insurers on 17 June 2024. A data call went to the ten largest private passenger automobile insurers, and the most recent dated stakeholder meeting listed is 18 April 2025. Seventeen months have passed since that meeting without an adopted rule.
Filing against a component that cites a missing instrument is a drafting position, not a blank. State the testing performed, the method and its version, the groups compared, the thresholds applied, the results and what changed as a consequence, then record that the Division has not prescribed a method. An empty Section 5.A.11 entry reads as an admission of no testing at all.
Section 6.D reads thirteen components and leaves the fourteenth unfiled
Fourteen components make up the SB 21-169 framework, listed at Section 5.A.1 through 5.A.14. Governing principles, board or board committee oversight, senior management accountability, a cross-functional governance group, the health insurer provider requirement, documented design and monitoring policies, complaint handling, risk prioritisation, the inventory, change explanation, testing, drift monitoring, vendor selection, and annual review of the framework itself.
ECDIS reporting scope is narrower, and Section 6.D fixes it: “This report shall be no more than ten (10) pages including an executive summary and address Sections 5.A.1. through 5.A.13.”
Component 14 falls outside that range. Documented annual reviews of the governance structure and risk management framework are mandatory under Section 5.A, and the ten-page filing does not have to address them. Every count of “thirteen components” in circulation is a count of the report’s scope mistaken for a count of the framework, and an insurer that builds to thirteen has a missing control rather than a shorter filing.
Sections 6.B and 6.C split covered insurers across two annual calendars
SB 21-169 commentary has settled on a single date, and that date applies to two lines out of three. Section 6.C requires private passenger automobile insurers and health benefit plan insurers using ECDIS to file “on July 1, 2026 and annually thereafter” a report summarising compliance with Section 5, with the title and qualifications of each individual responsible for each requirement.
Section 6.B governs life insurers, and sets a different date: “December 1, 2024 and annually thereafter.” The amendment left the original life dates in place rather than harmonising them, so a life insurer’s annual cycle runs to 1 December and always has. Section 6.A does the same for the progress report, which was due 1 June 2024 for life insurers and 1 December 2025 for the two new lines.
Section 5.C adds a third obligation that is not a filing at all. All components of the framework must be “available upon request by the Division” from 1 December 2024 for life insurers and 1 July 2026 for automobile and health benefit plan insurers, which is a production duty sitting alongside the ten-page summary rather than inside it.
ECDIS users reading this in late 2026 face a specific calendar. The 1 July 2026 filing has passed and the next automobile and health report is due 1 July 2027. The live date is 1 December 2026: the life insurer annual report under Section 6.B, and the annual non-user attestation under Section 6.E.
Section 6.F routes every new ECDIS user through the life insurer provision
ECDIS non-users are exempted by Section 6.E, on condition of an officer-signed attestation filed within one month of the effective date, so by 15 November 2025, and on 1 December each year after that.
Section 6.F covers the insurer that later changes its mind. An insurer not using ECDIS at the effective date but planning to “must submit to the Division the report specified in Section 6.B. prior to the use of ECDIS.”
Section 6.B is the life insurer provision. A health benefit plan insurer adopting a credit-based variable in 2027 is directed by the text to the subsection that governs life insurers on a December calendar, not to the Section 6.C report written for its own line. The practical answer is to file the Section 5 compliance report in the form Section 6.D prescribes and note the cross-reference, since the content of 6.B and 6.C is identical and only the dates differ.
Section 5.A.5 assigns prior authorisation responsibility to a provider, not a reviewer
ECDIS use in health benefit plans carries one component the other two lines do not. Section 5.A.5 requires them to “ensure that a provider acting on behalf of the insurer is ultimately responsible for the decisions made when ECDIS, or algorithms or predictive models that use ECDIS, are used to inform decisions to modify, or deny requests by a covered person or a covered person’s provider for authorization prior to, or concurrent with, the provision of health care services.”
Four limits sit inside that sentence. Responsibility rests with a provider as defined in C.R.S. 10-16-102, not a reviewer or an appeals analyst; it attaches to decisions to modify or deny, not to approvals; it covers prior and concurrent authorisation, not retrospective review; and the trigger is a model that informs the decision, which is a lower bar than a model that makes it.
Documentation should therefore name the provider role, the authorisation types in scope and the point in the workflow where the provider’s judgement enters. A general statement that humans review adverse determinations does not answer Section 5.A.5.
Section 4.D defines ECDIS three times, and telematics appears once
External consumer data is not defined once for the state. Section 4.D writes three definitions, one per line, and the lists differ in ways that matter to an inventory.
All three share credit scores, social media habits, locations, purchasing habits, home ownership, educational attainment, licensures, civil judgments, court records, biometric data, consumer-generated Internet of Things data, and insurance risk scores derived from any of them.
The life definition alone adds “occupation that does not have a direct relationship to mortality, morbidity or longevity risk,” a qualifier that makes occupation conditional rather than listed. The automobile definition alone specifies “consumer-generated Internet of Things data including telematics data.” And the health definition alone carries an exclusion: “ECDIS does not include an individual’s medical records.”
ECDIS registers cannot be pooled across a multi-line group. The same vendor score is in scope for one subsidiary and outside it for another, and Section 5.A.9 requires the inventory to carry version control and a stated purpose for each entry, which means the line of business has to be an attribute of the record rather than a folder it sits in.
Section 9 borrows sanctions from the wider insurance code
Enforcement is where the regulation stops citing itself. Section 9 provides that noncompliance “may result in the imposition of any sanctions made available in the Colorado statutes pertaining to the business of insurance, or other laws, which include the imposition of civil penalties, issuance of cease and desist orders, and/or suspensions or revocations of license, subject to the requirements of due process.”
No schedule, no per-violation figure, no cap. The exposure is whatever the insurance code allows, which makes the officer attestation under Section 6.D the sharpest instrument in the rule: an officer signs a statement of compliance, and an insurer unable to attest must file a corrective action plan instead. Section 7 sends anything disclosed, including SERFF submissions, to the confidentiality protection in C.R.S. 10-3-1104.9(3)(d).
The draft testing regulation supplies BIFSG, a two-stage threshold and a loose attribution
ECDIS testing under Section 5.A.11 points nowhere today, and the Division’s draft shows where it was heading. Numbered 10-2-xx rather than as an amendment to 10-1-1, the draft applies to life underwriting and estimates race and ethnicity using Bayesian Improved First Name Surname Geocoding, which it describes as “the statistical methodology developed by the RAND corporation.”
Provenance is worth getting right, because Section 5.A.11 asks for methodology and assumptions. RAND developed Bayesian Improved Surname Geocoding, which combines surname frequency with the racial composition of a geocoded area.
The first-name extension is Ioan Voicu’s work at the Office of the Comptroller of the Currency, circulated in 2016 and published in Statistics and Public Policy in 2018, reporting gains in accuracy and coverage over the surname-only method with the largest improvement for non-Hispanic Black individuals. An insurer recording a method version needs the second citation, not the first.
Two tests run in the draft, across four categories: Hispanic, Black, Asian Pacific Islander and White. Each test has two stages, and collapsing them is the common error. Approval testing asks whether approval rates differ by estimated group at a p-value below 0.05, and then whether the difference in approval rates is five percentage points or greater.
Premium testing asks whether the premium rate per $1,000 of face amount differs at a p-value below 0.05, and then whether that difference is 5% or greater. Percentage points in the first test, percent in the second.
Clearing both stages triggers the second-level variable testing set out at Section 8 of the draft: two regression models, one including the race and ethnicity variable and one without, run to identify which ECDIS inputs drive the disparity. Reporting would have begun 1 April 2024 and continued annually, with the first report covering application and premium data through 31 December 2023.
Three instruments outside SB 21-169 shape the 2026 file
Other states did not follow Colorado. The NAIC’s own implementation map, status as of 1 April 2026, records 23 states plus the District of Columbia as having adopted the model bulletin on the use of artificial intelligence systems by insurers, with Nebraska issuing guidance rather than adopting, and California, Colorado, New York and Texas running separate regimes. Counts of 24 and 25 in circulation come from secondary trackers with different cut-off dates.
Colorado is meanwhile inside the NAIC’s evaluation pilot. The AI Systems Evaluation Tool has run from 2 March 2026 through September 2026 across twelve states, California, Colorado, Connecticut, Florida, Iowa, Louisiana, Maryland, Pennsylvania, Rhode Island, Vermont, Virginia and Wisconsin, with four exhibits covering the extent of AI deployment, the governance framework, high-risk systems and the underlying data, and responses protected under the administering state’s confidentiality rules.
Federal pressure is aimed at a different Colorado law. Executive Order 14365, signed 11 December 2025, directs the Attorney General to establish an AI Litigation Task Force to challenge state AI laws, and singles out “a new Colorado law banning ‘algorithmic discrimination’.” That is the consumer-facing statute, since repealed and reenacted by Senate Bill 26-189, and not SB 21-169.
The order’s preserved state topics do not name insurance. Its reverse-preemption rule aside, the McCarran-Ferguson Act bars only an Act of Congress from displacing a state insurance law unless that Act specifically relates to the business of insurance, and no federal AI statute exists to test, which leaves any challenge to Colorado’s insurance instruments resting on constitutional grounds rather than on the order itself.
What each cross-reference obliges an insurer to write down
| Cross-reference | Where it lands | What the file needs |
| Section 5.A to “race” | Narrower than the nine characteristics in C.R.S. 10-3-1104.9 | Testing scope stated, with the statutory gap acknowledged |
| Section 5.A.11 to Division requirements | No adopted testing regulation for any line | Method, version, groups, thresholds, results, plus a note on the absence |
| Section 6.D to 5.A.1 through 5.A.13 | Excludes component 14 | Annual framework review evidenced outside the ten-page report |
| Section 6.B and 6.C | Two calendars, December for life and July for auto and health | One calendar per legal entity and line |
| Section 6.F to Section 6.B | The life insurer report, whatever the line | Section 5 report in the Section 6.D format, with the mismatch noted |
| Section 5.A.5 to “provider” | C.R.S. 10-16-102, modify or deny only | Named provider role in the prior and concurrent authorisation path |
| Section 4.D to three lists | Different ECDIS scope per line | Line of business as a field on every inventory record |
| Section 9 to the insurance code | Unscheduled civil penalties and licence action | Officer attestation, or a corrective action plan |
Govern365.ai holds this as linked records rather than a document rebuilt each filing season. Each model and data source sits once in an AI system inventory carrying its version, its vendor, the lines of business it touches and its testing history, so the entity-level and line-level views come out of the same register and the December and July reports are exports rather than projects.
Reuse is the argument for structuring it that way. The same records answer the governance expectations in the NAIC bulletin states, the four exhibits in the evaluation pilot, and the documentation duties an insurer operating in Europe meets under the EU AI Act, which is why our guide to bias risk detection and testing treats a testing artefact as one record with several readers. Insurers writing to the NAIC framework in other states can start from our NAIC AI model bulletin checklist and map it onto the Colorado fourteen.
Frequently Asked Questions
What does Colorado SB 21-169 require?
SB 21-169 prohibits insurers from using external consumer data and information sources, algorithms and predictive models in a way that unfairly discriminates on nine protected characteristics, and requires a documented risk management framework, with the Commissioner directed to adopt rules by insurance type after a stakeholder process.
Which insurers does amended Regulation 10-1-1 cover?
Insurers authorised in Colorado offering individually issued life insurance, private passenger automobile insurance or health benefit plans, from 15 October 2025. The Code of Colorado Regulations records adoption on 19 August 2025; the Division’s own notice page gives 20 August.
How many framework components are there?
Fourteen, at Section 5.A.1 through 5.A.14. The ten-page report under Section 6.D addresses only 5.A.1 through 5.A.13, so the annual framework review in component 14 is required but sits outside the filing.
When is the compliance report due?
Life insurers file on 1 December annually under Section 6.B. Private passenger automobile and health benefit plan insurers file on 1 July annually under Section 6.C, starting 1 July 2026. Reports go through SERFF as an Annual Report filing, one per insurer, signed by an officer.
Does the regulation require testing for all protected characteristics?
No. Section 5.A scopes the framework to unfair discrimination with respect to race, while the statutory prohibition in C.R.S. 10-3-1104.9 covers nine characteristics, so the filed framework is narrower than the underlying liability.
Has Colorado adopted a quantitative testing regulation?
No adopted testing regulation exists for life, automobile or health. A Division draft for life underwriting was published on 28 September 2023, and an industry alternative followed on 17 June 2024. The most recent dated stakeholder activity is April 2025.
What method did the draft testing regulation use?
Bayesian Improved First Name Surname Geocoding, estimating Hispanic, Black, Asian Pacific Islander and White probabilities from first name, surname and geocoded address, then comparing disapproval rates and premium per $1,000 of face amount against White applicants.
What threshold did the draft set?
Two stages. A p-value below 0.05, and then a difference of five percentage points or more in approval rates, or a difference of 5% or more in the premium rate per $1,000 of face amount, before second-level variable testing applies.
What counts as ECDIS in Colorado?
Credit scores, social media habits, locations, purchasing habits, home ownership, educational attainment, licensures, civil judgments, court records, biometric data, consumer-generated Internet of Things data and derived insurance risk scores. Telematics is named for automobile insurers, qualified occupation for life insurers, and medical records are excluded for health benefit plans.
Do health insurers have an extra duty?
Yes. Section 5.A.5 requires a provider acting on behalf of the insurer to be ultimately responsible for decisions to modify or deny prior or concurrent authorisation requests where ECDIS or a model using it informs the decision.
Does an insurer that uses no ECDIS have to file anything?
Yes. Section 6.E requires an officer-signed attestation, filed within one month of the effective date and on 1 December annually thereafter, and Section 6.F requires the Section 5 compliance report before the insurer starts using ECDIS.
Is SB 21-169 the same as the Colorado AI Act?
No. SB 21-169 is an insurance statute in force with an adopted regulation. The consumer-facing Colorado AI Act was repealed and reenacted by Senate Bill 26-189, covered in our Colorado AI Act compliance guide, and it is that law, not SB 21-169, that Executive Order 14365 names.
