Colorado amended Regulation 10-1-1: govern it or attest you don't

Colorado's amended Regulation 10-1-1 (3 CCR 702-10) requires every insurer authorized in Colorado that offers individually issued life insurance, private passenger auto insurance or health benefit plans to do one of two things. If it uses external consumer data and information sources, or algorithms and predictive models that use them, in any insurance practice, it must run a documented, risk-based governance and risk management framework with fourteen components and report on it each year. If it uses none, it must file an attestation signed by an officer saying so, every 1 December. The amended rule took effect on 15 October 2025; the original covered life insurers only (3 CCR 702-10, Colorado Secretary of State). Either way the insurer needs to know, system by system, what it uses, which is what Botminds' AI Governance & Model Inventory keeps.

What is Colorado amended Regulation 10-1-1?

It is the Colorado Division of Insurance's governance rule under Senate Bill 21-169, which Governor Polis signed on 6 July 2021 and which is codified at C.R.S. § 10-3-1104.9. The statute bars insurers from using external consumer data, algorithms or predictive models in ways that unfairly discriminate on protected characteristics, and has the Commissioner adopt rules after stakeholder meetings, which the Division has run separately for life, auto and health insurance (Colorado Division of Insurance). Regulation 10-1-1 is the governance half of that work; the quantitative testing half is a separate rule that is still a draft.

The first version, effective 14 November 2023, covered life insurers. The Division announced the amended regulation in a notice dated 20 August 2025, describing it as establishing requirements for insurers “offering individual life insurance, private passenger automobile insurance, and/or health benefit plans” that use ECDIS, and stating: “This amended regulation is effective on October 15, 2025” (Notice of adoption). On the NAIC's adoption map, Colorado is one of four states listed with insurance-specific AI regulation rather than the NAIC model bulletin, which 29 jurisdictions had adopted as of 8 October 2026 (NAIC map).

Who must comply with Colorado's AI insurance regulation, and with what data?

Insurers authorized in Colorado that offer individually issued life insurance, private passenger auto insurance or health benefit plans. Within those insurers, the rule reaches external consumer data and information sources, known as ECDIS, and the algorithms and predictive models that use them, in any insurance practice, not only underwriting. Homeowners, commercial and group life business sit outside it.

ECDIS is defined line by line. For each line it means data used to supplement or supplant traditional underwriting factors or other insurance practices, or to establish lifestyle indicators, and it lists examples including credit scores, social media habits, locations, purchasing habits, home ownership, educational attainment, licensures, civil judgments, court records, consumer-generated Internet of Things data, biometric data and risk scores derived from them. The auto definition adds telematics; the life definition adds occupation without a direct relationship to mortality, morbidity or longevity risk; and for health plans, ECDIS “does not include an individual’s medical records.”

Govern it, or attest you don't: the two paths

An insurer in scope takes one of two paths, and the choice is a statement an officer signs. If it does not use ECDIS, or algorithms or models that use ECDIS, it is exempt from the framework but must file an officer-signed attestation “within one month of the effective date of this regulation and on December 1 annually thereafter” (section 6.E). The Division's guidance says the attestation must “unambiguously state the insurer does not use any ECDIS, or any algorithm or predictive model that uses ECDIS,” and is filed through SERFF as an annual report or certification (Colorado DOI).

If it does use them, it builds the framework and reports. And an insurer that attests to non-use and later plans to use ECDIS must file the full compliance report before it starts (section 6.F). That is where the attestation becomes risky: it is only as reliable as the insurer's knowledge of what its vendors' products do. A claims or underwriting platform that adds a feature trained on credit or telematics data can turn a non-user into a user by release. An officer signing the attestation should be able to point to an inventory that would have caught it.

The 14 components of the governance framework

Section 5.A requires a “risk-based governance and risk management framework” designed to determine whether the use of ECDIS and the models that use it potentially results in unfair discrimination with respect to race, and to remediate it if detected through the Division's quantitative testing requirements. The framework must include fourteen components:

Components 9, 10 and 12 are an inventory discipline: every source and model in use, with versions, purposes and outputs, every material change explained, and monitoring that accounts for drift. Component 13 and section 5.B extend it to vendors, which is why a vendor's model trained on external data belongs on the insurer's inventory even though the insurer did not build it. Our inventory template maps these components to fields.

What changed in the amended regulation? The 2023 rule against the 2025 rule

Five things changed besides scope. The definitions now run line by line. A fourteenth component was added for health plans' prior authorization decisions. The data policies must now ensure ECDIS is “credible, relevant, and appropriate for its intended purpose.” The risk assessment component became documented policies and processes rather than a rubric. And the testing component now ties the description of quantitative testing to requirements the Division is to set, which means to a testing rule that has not yet been adopted.

What are the deadlines? Reports, attestations and the dates by line

The rule sets different calendars for life insurers and for auto and health insurers. Life insurers filed a progress report by 1 June 2024 and have filed an annual compliance report each 1 December since 2024. Auto and health insurers already using ECDIS when the amendment took effect owed a narrative progress report by 1 December 2025, must have every framework component available to the Division on 1 July 2026, and file a compliance report that day and annually after (sections 5.C, 6.A and 6.C).

Each compliance report must give “the title and qualifications of each individual responsible for ensuring compliance” and the requirement each is responsible for, must be signed by an officer attesting to compliance, and must be no more than ten pages with an executive summary. An insurer that cannot attest files a corrective action plan instead (section 6.D). Reports go through SERFF, one filing per insurer (section 6.G).

Is quantitative testing required yet?

Not yet in the annual report. The framework requires a description of quantitative testing done under requirements the Division sets, and the Division has not set them. Its Revised Bulletin B-10.004 therefore suspends the testing part of the report for the current period, and says so in terms quoted in full in Colorado's life insurance quantitative testing requirements(Revised Bulletin B-10.004).

The waiver is dated. It covers only the annual reports due on 1 December 2024 and 1 December 2025, and tells insurers that later reports are expected to describe the testing they conducted. As of late October 2026 the Division's draft testing rule, first released for informal comment on 28 September 2023, was still a draft, and whether the Division will extend the waiver to the report due 1 December 2026 was not public. Life insurers should be ready to describe the testing they do; the methods are covered in Colorado's life insurance quantitative testing requirements.

Who signs what under Colorado's rule?

The rule names roles, not just a committee. The board or a board committee oversees; senior management is accountable; a cross-functional group governs; each requirement in section 5 has a named individual responsible, whose title and qualifications go into the report; an officer signs. For health plans, a provider is ultimately responsible for authorization decisions informed by ECDIS or models.

How does Colorado's 2026 AI law, SB26-189, affect insurers?

Mostly by deferring to this rule. SB26-189, signed on 14 May 2026, repeals and reenacts the consumer protections created by SB 24-205 as rules on automated decision-making technology used in “consequential decisions,” which include decisions on insurance, and most of it takes effect on 1 January 2027 (Colorado General Assembly). The act itself says insurers and affiliates “that are subject to the requirements of section 10-3-1104.9 are in compliance with this part 17 in the practice of insurance” (SB26-189, C.R.S. § 6-1-1708(1)(a)).

Two points keep it from being a free pass. An insurer not deemed compliant under that clause must give the act's notice and disclosure of its use of covered technology in insurance decisions, and the clause does not limit the act's reach over an insurer's use of the technology in its own hiring and employment. The act also adds a power for the Commissioner to adopt or update rules on notices and disclosures from insurers to consumers, effective on passage. For insurers, Regulation 10-1-1 remains the rule to meet.

Preparing for 1 December with AI Governance & Model Inventory

The work is the same on both paths: know what you use. In AI Governance & Model Inventory, the rule mapper maps each system to the rules of each state and line where it is used, Colorado's regulation among them, and keeps the list of open gaps; the AI finder reads vendor contracts, release notes and invoices for AI and data features nobody filed; and a drafting agent prepares the annual report and attestation from the register for an officer to sign. The agents never sign and never send.

In the sample insurer used across these guides, Calder Ridge Insurance Group, a fictional carrier writing personal auto and term life among other lines, the vendor view showed a life underwriting vendor whose test evidence was partial because one state's test was missing, which is the kind of gap a report owner needs to see before the officer signs. Our vendor guide shows how vendor evidence is requested under the contract.

AI Governance & Model Inventory: vendor evidence behind an annual report

Every system and its source on one register

Questions people ask

When did Colorado's amended Regulation 10-1-1 take effect?

On 15 October 2025. The Division adopted it in August 2025 and announced it in a notice dated 20 August 2025; the original regulation, for life insurers only, took effect on 14 November 2023.

Does Colorado regulation 10-1-1 apply to homeowners insurance?

No. It applies to insurers offering individually issued life insurance, private passenger auto insurance and health benefit plans. Homeowners insurers fall outside this regulation, though the statute's ban on unfairly discriminatory use of external data and models is not limited to the lines the regulation names.

What if we do not use ECDIS at all?

File an attestation, signed by an officer, by 1 December each year stating that the insurer uses no ECDIS and no algorithm or predictive model that uses ECDIS. If you later plan to use them, file the full compliance report before you start.

Is Colorado's AI law the same as the insurance regulation?

No. SB26-189 is a general law on automated decision-making technology, effective mostly from 1 January 2027. It deems insurers subject to C.R.S. § 10-3-1104.9 compliant in the practice of insurance, so Regulation 10-1-1 remains their main AI rule in Colorado.

Who reviews the annual report?

The Colorado Division of Insurance, through SERFF. Documents disclosed under the regulation are subject to the confidentiality provision of C.R.S. § 10-3-1104.9(3)(d), and the Division may ask to see any component of the framework.