Reference · Insurance
Colorado Regulation 10-1-1: External Consumer Data, Algorithms, and Predictive Models in Insurance
3 CCR 702-10, Regulation 10-1-1, amended effective 15 October 2025
Colorado Regulation 10-1-1 sets governance and risk management requirements for insurers that use external consumer data and information sources (ECDIS), or algorithms and predictive models that use ECDIS. It is promulgated under §§ 10-1-109 and 10-3-1104.9, C.R.S.3 CCR 702-10 · Section 1 Section 10-3-1104.9 was added by SB 21-169, which the Governor signed on 6 July 2021.SB 21-169 The regulation took effect for life insurers on 14 November 2023, and the amendment effective 15 October 2025 extended it to private passenger automobile insurers and health benefit plan insurers.3 CCR 702-10 · Section 11Division notice
Life, auto and health insurers that use external consumer data are in scope
Section 3 applies the regulation to all insurers authorized in Colorado that offer individually issued life insurance, private passenger automobile insurance or health benefit plans.3 CCR 702-10 · Section 3 The framework obligations attach to those that use ECDIS, or algorithms and predictive models that use ECDIS.3 CCR 702-10 · Section 5.A An insurer that uses none files an officer-signed attestation instead, within one month of the effective date and on 1 December each year. An insurer that starts using ECDIS later files the annual compliance report before it does.3 CCR 702-10 · Sections 6.E, 6.F
Colorado's framework predates the NAIC Model Bulletin, which the NAIC adopted on 4 December 2023, and the NAIC lists Colorado among the four states that govern insurer AI through insurance-specific rules of their own.NAIC map
External consumer data is defined line by line
ECDIS is a data or information source used to supplement or supplant traditional underwriting factors or other insurance practices, or to establish lifestyle indicators used in insurance practices. The listed examples are credit scores, social media habits, locations, purchasing habits, home ownership, educational attainment, licensures, civil judgments, court records, consumer-generated Internet of Things data, biometric data, and any insurance risk scores derived from such sources by the insurer or a third party.3 CCR 702-10 · Section 4.D
Each line adds its own point. For life insurers the list adds occupation without a direct relationship to mortality, morbidity or longevity risk; for auto insurers, the Internet of Things data includes telematics; for health benefit plan insurers, ECDIS excludes an individual's medical records.3 CCR 702-10 · Section 4.D.1 to 4.D.3
Section 5 requires a fourteen-part framework aimed at unfair discrimination by race
Section 5.A requires a risk-based governance and risk management framework designed to determine whether the use of ECDIS, algorithms and predictive models potentially results in unfair discrimination with respect to race, and to remediate it if detected through the quantitative testing the Division establishes.3 CCR 702-10 · Section 5.A Its fourteen components:
- Documented governing principles (5.A.1), oversight by the board or a board committee (5.A.2), senior management responsibility and accountability with regular reporting (5.A.3), and a documented cross-functional governance group drawn from legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing and customer service (5.A.4).3 CCR 702-10 · Section 5.A.1 to 5.A.4
- For health benefit plan insurers, a provider acting on the insurer's behalf remains ultimately responsible for decisions to modify or deny prior-authorization or concurrent review requests that ECDIS-based tools inform (5.A.5).3 CCR 702-10 · Section 5.A.5
- Documented policies and procedures with assigned roles for design, development, testing, deployment, use and ongoing monitoring, including a supervision and training program (5.A.6); complaint and inquiry protocols that give consumers what they need to act on an adverse decision, for which carriers may use existing grievance and appeal procedures (5.A.7); and risk assessment and prioritization processes (5.A.8).3 CCR 702-10 · Section 5.A.6 to 5.A.8
- A documented, up-to-date inventory, including version control, of every ECDIS, algorithm and predictive model in use, with a detailed description, clearly stated purpose and the outputs generated (5.A.9), and a documented explanation of any material change in that inventory and its rationale (5.A.10).3 CCR 702-10 · Section 5.A.9, 5.A.10
- A documented description of the quantitative testing conducted to detect unfair discrimination, with methodology, assumptions, results and remediation steps (5.A.11), and of ongoing performance monitoring, accounting for model drift (5.A.12).3 CCR 702-10 · Section 5.A.11, 5.A.12
- A documented process for selecting third-party vendors and other external resources, including the intended use of what they supply (5.A.13), and comprehensive annual reviews of the framework and its documentation (5.A.14).3 CCR 702-10 · Section 5.A.13, 5.A.14
- When third parties are involved, the insurer remains responsible for every Section 5.A requirement, including producing the documents the Division requests; vendors may supply those documents directly to the Division on the insurer's behalf.3 CCR 702-10 · Section 5.B
- Every component is available on request: for life insurers from 1 December 2024 and annually thereafter, and for auto and health benefit plan insurers from 1 July 2026 and annually thereafter.3 CCR 702-10 · Section 5.C
The testing description was waived for two life reporting cycles
Section 5.A.11 depends on testing requirements the Division sets. In Revised Bulletin B-10.004, reissued on 22 October 2025, the Division said it had not yet adopted a regulation establishing that testing, and it waived the testing description for the life insurers' annual reports due 1 December 2024 and 1 December 2025 only. The bulletin says later annual reports are expected to include a description of the testing conducted, and that every other requirement of the regulation remains in effect.Bulletin B-10.004 · Section III
Two reporting timetables, one officer attestation
- A narrative progress report on Section 5, identifying the areas still under development, the difficulties encountered and the expected completion dates: due 1 June 2024 for life insurers and 1 December 2025 for auto and health benefit plan insurers.3 CCR 702-10 · Section 6.A
- An annual compliance report summarizing compliance with Section 5 and naming the title and qualifications of each individual responsible, with the Section 5 requirements each covers: from 1 December 2024 for life insurers and from 1 July 2026 for auto and health benefit plan insurers, annually thereafter.3 CCR 702-10 · Sections 6.B, 6.C
- The annual report is signed by an officer attesting to compliance, runs to no more than ten pages including an executive summary, and addresses Sections 5.A.1 through 5.A.13. An insurer unable to attest submits a corrective action plan instead.3 CCR 702-10 · Section 6.D
- All reports are filed in SERFF as an Annual Report filing, one filing per insurer.3 CCR 702-10 · Section 6.G Documents disclosed under the regulation are subject to the confidentiality provision of § 10-3-1104.9(3)(d), C.R.S.3 CCR 702-10 · Section 7
- Noncompliance may draw civil penalties, cease and desist orders, or suspension or revocation of license.3 CCR 702-10 · Section 9
Control mapping
What a reviewer expects to be able to see.
| Obligation | What the system must do | Evidence a reviewer expects |
|---|---|---|
| Inventory with version control (5.A.9) | Keep an up-to-date inventory of every ECDIS, algorithm, and predictive model with description, purpose, outputs, and versions | The inventory, its version history, and the date of last update |
| Material changes (5.A.10) | Document each material change to the inventory and the rationale for it | Change log with dates, approvers, and stated rationale |
| Quantitative testing (5.A.11) | Describe the testing conducted under the Division's requirements, with methodology, assumptions, results, and remediation | Testing reports and remediation records per model |
| Ongoing monitoring (5.A.12) | Describe ongoing performance monitoring of algorithms and predictive models, accounting for model drift | Monitoring procedure and its operating records |
| Third parties (5.A.13, 5.B) | Document vendor selection and oversight and retain the ability to produce vendor documentation on request | Selection records, contracts, and the documentation vendors have supplied |
| Annual officer-attested report (6.B to 6.D) | File the ten-page report in SERFF on the line-of-business date, signed by an officer, or a corrective action plan | SERFF filing record, signed attestation, and the responsible-individual list |
Key dates
Timeline, drawn to scale
Regulation 10-1-1: the life timetable and the auto and health timetable
- 6 July 2021SB 21-169 signed, adding § 10-3-1104.9, C.R.S.
- 14 November 2023Regulation 10-1-1 takes effect for life insurers.
- 4 December 2023NAIC adopts the Model Bulletin on the Use of AI Systems by Insurers.
- 1 June 2024Life insurers' narrative progress report due.
- 1 December 2024Life insurers: framework available on request and first annual officer-attested report due.
- 15 October 2025Amended regulation takes effect, adding private passenger auto insurers and health benefit plan insurers.
- 22 October 2025Division reissues Bulletin B-10.004, waiving the testing description for the 2024 and 2025 life reports only.
- 1 December 2025Auto and health benefit plan insurers' narrative progress report due.
- 1 July 2026Auto and health benefit plan insurers: framework available on request and first annual officer-attested report due.
- 1 December 2026Life insurers' annual compliance report due, the first after the reports Bulletin B-10.004 covered.
Sources cited
- ×223 CCR 702-10, Colorado Regulation 10-1-1, as amended effective 15 October 2025 (Code of Colorado Regulations, PDF)
- ×1SB 21-169, Restrict Insurers' Use Of External Consumer Data (Colorado General Assembly)
- ×1Colorado Division of Insurance, Notice of Adoption: Amended Regulation 10-1-1 (20 August 2025)
- ×1NAIC, Implementation of NAIC Model Bulletin (PDF, status as of 8 October 2026)
- ×2Colorado Division of Insurance, Revised Bulletin B-10.004 on the quantitative testing reporting requirement (reissued 22 October 2025, PDF)
Common gaps
Where insurers most often fall short when the Division asks.
- An inventory without version control. Section 5.A.9 names version control. A list of models with no record of which version was in use when is half the requirement.
- Changes with no rationale. Section 5.A.10 asks for the rationale behind each material change as well as the change itself. A change log copied from a deployment system records what changed and leaves out why.
- Monitoring that cannot describe drift. Section 5.A.12 names model drift explicitly. A monitoring description that covers uptime and error rates and omits performance decay leaves the named item unanswered.
- Vendor documentation the insurer cannot produce. Section 5.B keeps the insurer responsible for production. If the vendor holds the documentation and the contract gives no route to it, the request lands on the insurer regardless.
- A 2026 life report planned on the waiver. Bulletin B-10.004 waived the testing description for the 2024 and 2025 life reports only.Bulletin B-10.004 · Section III A life insurer that plans its 1 December 2026 report on the same basis needs the Division's current position in writing.
- Auto and health insurers still on the life timetable. The 1 July 2026 date for auto and health benefit plan insurers has passed. Their framework is now available on request and their annual report cycle has begun.
Related
Last reviewed October 11, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.