Colorado AI Regulation (SB21-169)
Colorado Regulation 10-1-1: AI Governance for Life, Auto, and Health Insurers
Colorado requires insurers that use external consumer data, and the algorithms and models built on it, to run a board-overseen governance and risk management framework. Auto and health insurers had to have theirs in place by July 1, 2026. If AI agents take part in underwriting, pricing, or claims, the framework has to cover them too.
What Is Colorado Regulation 10-1-1?
Colorado Regulation 10-1-1 implements SB21-169. It requires life, private passenger auto, and health benefit plan insurers that use external consumer data and information sources (ECDIS), and the algorithms and predictive models that use them, to run a governance and risk management framework: board oversight, an inventory, testing for unfair discrimination, ongoing monitoring, and annual reporting to the Division of Insurance.
Lumenova AI is an agentic AI governance platform that keeps the records this framework runs on while agents work: the inventory, the limits each agent operates under, test results, and a decision record for every action. Your actuarial, compliance, and legal teams still own the testing method and the report.
Regulation 10-1-1 is separate from Colorado’s general AI law. SB 26-189, signed May 14, 2026, replaces the Colorado AI Act (SB 24-205) from January 1, 2027, with notice, explanation, and human-review duties for automated decisions.
Key Dates
- Jul 2021Colorado enacted its first major algorithm-related law to bar insurers from using predictive models or algorithms that unfairly discriminate against protected classes.
- 14 Nov 2023Regulation 10-1-1 takes effect for life insurers.
- 1 Dec 2024Life insurers file their first annual compliance report, which will be repeated annually on December 1.
- 1 Jul 2026Auto and health insurers have the full framework available on request and file their first annual compliance report.
- 1 Jan 2027SB 26-189 takes effect and replaces the Colorado AI Act.
CORE CHECKS
What Regulation 10-1-1 Asks Insurers to Show
Life, private passenger auto, and health benefit plan insurers in Colorado must have this framework in place and report on it every year.
Board Oversight
The board or a board committee oversees the framework, senior management is accountable for it, and written policies assign roles to a cross-functional governance group.
AI Components Inventory
An up-to-date inventory of the external data sources in use and the algorithms and predictive models that use them, with a description and version history for each.
Testing and Monitoring
Testing to detect unfair discrimination against protected classes, remediation when testing finds it, and ongoing monitoring of how the algorithms and models perform.
Third-Party Oversight
A documented process for selecting and overseeing the vendors that supply external data, algorithms, or models.
Consumer Complaints
A process for consumer complaints and inquiries after an adverse decision.
Annual Review and Reporting
A full review of the framework each year, and an annual compliance report naming the person responsible for each requirement.
How Lumenova AI Supports Your Regulation 10-1-1 Framework
Agents on the inventory, with the data they reach
Register each agent under its use case with owner, approver, and risk tier, next to the MCP servers, tools, and data sources it may reach.
Limits before the decision
Write what an agent may do in underwriting, pricing, or claims as policy that runs before the action, with version history for your governance group.
Testing you can report on
Evaluate agents for bias and accuracy before launch and in production, and check automated scores against your own reviewers before you report on them.
A trace behind every adverse decision
Each decision record keeps the policy evaluated, the outcome, and the input the agent sent, so a consumer complaint can be traced to what the agent did.
Evidence for the annual report
Decision records and evaluation results export as CSV or JSON for your testing, annual review, and compliance report.
Vendor agents tested too
Probe third-party agents from the outside and keep the request and response behind each finding for your vendor oversight file.
How to Get Ready
- List every model, algorithm, and agent that touches a Colorado consumer decision, with the external data each one uses;
- Name an owner and an approver for each, and record the approval on the use case;
- Write each agent’s limits as policy, and test the policy before it binds;
- Decide what you’ll need to show when a consumer disputes an adverse decision;
- Run unfair-discrimination testing on the records your agents produce in production;
- Plan the annual review around records you can export.
Frequently Asked Questions
Insurers authorized in Colorado that offer individual life insurance, private passenger auto insurance, or health benefit plans and use external consumer data and information sources, or algorithms and predictive models that use them. Life insurers have been covered since November 14, 2023, and auto and health insurers since October 15, 2025.
The regulation covers algorithms and predictive models that use external consumer data in insurance practices, and it doesn’t carve out agents. An agent that uses that data, or calls a model that does, in underwriting, pricing, or claims belongs in your inventory and testing like any other model. Lumenova AI registers those agents, limits what they may do, and records each decision.
A summary of how the insurer meets each governance and risk management requirement, with the title and qualifications of the person responsible for each one. Life insurers file by December 1 each year, and auto and health insurers filed their first report by July 1, 2026. Lumenova AI supplies the inventory, test results, and decision records the report draws on.
Lumenova AI evaluates agents and models for bias and fairness before launch and in production, and keeps the results with each use case. Your actuarial and compliance teams choose the testing method the Division expects and draw on those results and the decision records to run it.
No. Regulation 10-1-1 implements SB21-169 and applies to insurers. The Colorado AI Act (SB 24-205) never took effect: SB 26-189, signed May 14, 2026, replaced it with a narrower law on automated decision-making that takes effect January 1, 2027. Check with counsel how the two apply to your lines of business.