United States - Colorado - AI in Insurance (SB 21-169)

Overview

Colorado Senate Bill 21-169, officially titled "Restrict Insurers' Use Of External Consumer Data," represents a landmark piece of legislation in the United States, specifically designed to address the ethical implications and potential for bias in the application of artificial intelligence and big data within the insurance sector. Enacted on July 6, 2021, the bill prohibits insurers from engaging in practices that result in unfair discrimination based on a comprehensive list of protected characteristics, including race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression. This legislative action acknowledges the transformative potential of advanced data analytics and algorithmic models in insurance, while simultaneously recognizing the inherent risks of perpetuating or exacerbating societal biases if these technologies are left unchecked. The General Assembly explicitly found that while such tools can streamline processes, their accuracy and reliability can vary, and some models may lack a sufficient rationale for their use in insurance practices, potentially leading to significant negative impacts on the availability and affordability of insurance for protected classes.

The core objective of SB 21-169 is to safeguard Colorado consumers from discriminatory outcomes that may arise from the use of external consumer data and information sources (ECDIS), as well as the algorithms and predictive models that rely on them, in insurance rating, underwriting, claims, and other business practices. By mandating rigorous oversight and requiring insurers to actively demonstrate the fairness of their systems, Colorado has positioned itself at the forefront of regulating AI in a critical industry. The bill directs the Colorado Commissioner of Insurance to develop and adopt specific rules to implement these protections, emphasizing a collaborative stakeholder process to ensure practical and effective compliance. This proactive regulatory stance aims to foster innovation responsibly, ensuring that technological advancements in insurance serve all consumers equitably, without inadvertently creating new barriers or disadvantages for vulnerable populations.

Definitions

Central to the understanding and implementation of Colorado SB 21-169 are several key definitions that delineate the scope and intent of the legislation. "External Consumer Data and Information Sources (ECDIS)" refers broadly to data and information sources utilized by insurers to supplement or replace traditional underwriting factors. This can encompass a wide array of non-traditional data points, such as credit scores, social media habits, purchasing patterns, homeownership status, educational achievements, court records, and other factors that may not have a direct, established correlation to traditional insurance risk factors like mortality, morbidity, or longevity. The inclusion of ECDIS in the bill highlights the legislature's concern with the expanding universe of data points insurers might leverage, and the potential for these novel data streams to introduce or amplify biases.

The concept of "Unfair Discrimination" is precisely defined within the context of the bill. It refers to any discriminatory practice based on an individual's race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression in any insurance practice. This explicit enumeration of protected characteristics underscores the bill's commitment to fundamental rights and equality. Furthermore, an "Insurance Practice" is broadly interpreted to include various aspects of the insurance business, such as rating, underwriting, claims processing, and other related business operations. This comprehensive scope ensures that the anti-discrimination mandate applies across the entire lifecycle of an insurance product and customer interaction. Finally, "Algorithms and Predictive Models" are understood as the sophisticated computational systems that process and analyze ECDIS to inform and drive these insurance practices, forming the technological backbone that the legislation seeks to regulate for fairness and transparency.

Governance and Institutional Framework

The governance and institutional framework for Colorado SB 21-169 primarily vests authority and responsibility with the Colorado Commissioner of Insurance and the Division of Insurance (DOI) within the Department of Regulatory Agencies (DORA). The bill explicitly directs the Commissioner to adopt comprehensive rules for specific types of insurance and insurance practices. These rules are crucial for establishing the practical means by which an insurer can demonstrate that its use of external data sources, algorithms, and predictive models does not unfairly discriminate against individuals based on protected characteristics. This delegation of rulemaking authority to the DOI underscores the need for specialized expertise in navigating the complexities of insurance regulation and emerging technologies. The DOI is tasked with translating the broad principles of the bill into actionable requirements for the industry, ensuring that the legislative intent is effectively implemented through detailed regulatory guidance.

A critical component of this framework is the mandated stakeholder engagement process. SB 21-169 requires the Insurance Commissioner to work collaboratively with various stakeholders, including insurance companies, insurance agents/producers, consumer representatives, and other interested parties, before adopting any rules. This consultative approach is designed to gather diverse perspectives, address practical implementation challenges, and foster a shared understanding of the regulatory objectives. Separate stakeholder meetings are conducted for different types of insurance, such as life, auto, and health, and for specific insurance practices like underwriting, marketing, and claims management. This iterative and inclusive process aims to develop rules that are both effective in preventing discrimination and feasible for insurers to implement, while also considering potential solvency impacts. The DOI also includes information concerning these rules and the stakeholder process in its annual "State Measurement for Accountable, Responsive, and Transparent (SMART) Government Act" report to legislative committees.

Key Focus Areas

Colorado SB 21-169's key focus areas revolve around the prevention of unfair discrimination and the establishment of robust accountability mechanisms for insurers utilizing AI and big data. The legislation unequivocally prohibits insurers from unfairly discriminating based on protected characteristics, including race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression, in any insurance practice. This prohibition extends to both direct consideration of these characteristics and the indirect use of external consumer data and information sources (ECDIS), algorithms, and predictive models that have the result of unfairly discriminating. This results-oriented approach is critical, acknowledging that even seemingly neutral data or models can produce biased outcomes. The bill places the onus on insurers to ensure their systems are free from such discriminatory impacts.

To achieve this, the bill mandates several crucial requirements for insurers. They must establish and maintain a comprehensive risk management framework specifically designed to determine, to the extent practicable, whether their use of ECDIS, algorithms, and predictive models unfairly discriminates. This framework must include ongoing monitoring to identify and mitigate risks of discrimination. Insurers are also required to provide an explanation of how they use external data sources for particular types of insurance and practices. Furthermore, they must submit an assessment of the results of their risk management framework, detailing actions taken to minimize discrimination risks. A key accountability measure is the requirement for an attestation by the insurer's chief risk officer, confirming the appropriate and continuous implementation of the risk management framework. The legislation also provides for a reasonable period for insurers to remedy any identified unfairly discriminatory impacts, and allows for the use of previously assessed and approved external data sources by the Division of Insurance.

Implementation Framework

The implementation framework for Colorado SB 21-169 is a multi-stage process, primarily driven by the Colorado Division of Insurance (DOI) through the adoption of specific regulations. While the bill was signed into law on July 6, 2021, it stipulated that the rules adopted under it would not become effective until January 1, 2023, at the earliest, allowing sufficient time for the stakeholder process and rule development. The DOI has adopted Colorado Insurance Regulation 10-1-1, which serves as the primary implementing regulation. This regulation establishes the governance and risk management framework requirements for insurers' use of external consumer data and information sources (ECDIS), algorithms, and predictive models. The implementation is being rolled out in phases, initially focusing on specific lines of insurance.

For instance, an initial version of Regulation 10-1-1 focusing on life insurers' use of AI became effective on November 14, 2023. This regulation sets forth detailed requirements for life insurers, including specific reporting obligations such as initial progress reports due by June 1, 2024, and comprehensive compliance reports by December 1, 2024, with annual reports thereafter. The DOI has continued its stakeholder engagement process to extend these regulatory requirements to other insurance lines. An amended Regulation 10-1-1, which expands the governance and risk management framework requirements to include private passenger automobile insurers and health benefit plan insurers, has been formally adopted and will become effective on October 15, 2025. This phased approach allows the DOI to tailor regulations to the unique characteristics and data practices of different insurance sectors, ensuring a comprehensive and adaptable regulatory landscape for AI in insurance.

Monitoring and Evaluation

Monitoring and evaluation under Colorado SB 21-169 are integral to ensuring ongoing compliance and assessing the effectiveness of the anti-discrimination measures. Insurers are subject to explicit reporting requirements designed to provide the Division of Insurance (DOI) with the necessary information to oversee their use of external consumer data and information sources (ECDIS), algorithms, and predictive models. For insurers that do not use ECDIS or algorithms/predictive models that rely on ECDIS in any insurance practice, Colorado Insurance Regulation 10-1-1 requires an annual attestation to be filed with the Division by December 1st. This attestation, signed by an officer of the insurer, must unambiguously state non-use and is submitted through the SERFF system.

For insurers that do utilize these technologies, the monitoring framework is more extensive. Life insurers, for example, were required to submit an initial progress report by June 1, 2024, detailing their steps toward compliance with Regulation 10-1-1. A comprehensive compliance report, summarizing adherence to governance and risk management requirements, is due by December 1, 2024. This report must include the titles and qualifications of individuals responsible for compliance and be signed by an officer attesting to compliance. Subsequently, annual reports are mandated starting December 1, 2025, to ensure continuous adherence to the regulation. Beyond insurer-specific reporting, the Division of Insurance itself is required to include specific information in its annual "State Measurement for Accountable, Responsive, and Transparent (SMART) Government Act" report to legislative committees. This includes details concerning any rules adopted under the act, information on changes in insurance rates resulting from the act's prohibitions, and a summary of the stakeholder process, including a description of data sources insurers may use to comply. This dual reporting mechanism ensures both industry accountability and governmental transparency regarding the implementation and impact of SB 21-169.

Penalties, Liability, and Appeals

Colorado SB 21-169 primarily focuses on proactive measures and corrective actions rather than explicitly detailing a schedule of penalties or a specific appeals process within the text of the bill itself. The legislation mandates that the rules adopted by the Commissioner of Insurance must include provisions establishing a reasonable period of time for insurers to remedy any unfairly discriminatory impact found in their use of external data sources, algorithms, or predictive models. This emphasis on remediation highlights a regulatory philosophy centered on achieving compliance and correcting adverse outcomes, rather than immediately imposing punitive measures. The expectation is that insurers will establish robust risk management frameworks to identify and address potential discrimination, with the Division of Insurance overseeing these efforts.

While specific penalties are not outlined in the bill, non-compliance with the requirements set forth by SB 21-169 and its implementing regulations (such as Colorado Insurance Regulation 10-1-1) would typically fall under the existing enforcement powers of the Colorado Division of Insurance for violations of state insurance law. These powers generally include the ability to issue cease and desist orders, levy administrative fines, suspend or revoke licenses, and compel restitution to harmed consumers, depending on the severity and persistence of the non-compliance. The bill's requirement for insurers to take corrective action to address any discovered consumer harms underscores a principle of accountability. Any appeals regarding regulatory decisions or enforcement actions would likely follow established administrative procedures within the Colorado Department of Regulatory Agencies and potentially the state court system, as is common for insurance regulatory matters. The focus remains on preventing discrimination through robust governance and risk management, with the underlying threat of regulatory action for failure to meet these obligations.

Relationship to Other Instruments

Colorado SB 21-169 operates in close conjunction with, and serves as the foundational legal authority for, Colorado Insurance Regulation 10-1-1 (3 CCR 702-10). This regulation, titled "Governance And Risk Management Framework Requirements For Life Insurers', Private Passenger Automobile Insurers, And Health Benefit Plan Insurers' Use Of External Consumer Data And Information Sources, Algorithms, And Predictive Models," is the primary implementing instrument for the bill. SB 21-169 directed the Commissioner of Insurance to adopt rules, and Regulation 10-1-1 is the direct fulfillment of that mandate. The regulation provides the granular detail and specific requirements that insurers must follow to comply with the broader anti-discrimination principles established in the original Senate Bill. For example, while SB 21-169 broadly requires a risk management framework, Regulation 10-1-1 specifies the components of such a framework, including documentation, testing, and reporting requirements.

Furthermore, SB 21-169 and its subsequent regulations build upon existing anti-discrimination laws and consumer protection statutes within Colorado. The bill reinforces and extends the principles of fair treatment to the evolving landscape of AI and big data in insurance, ensuring that technological advancements do not undermine fundamental rights. It explicitly prohibits unfair discrimination based on protected characteristics that are generally recognized under civil rights laws. By specifically addressing the use of external consumer data and algorithmic models, SB 21-169 provides a modern legal framework tailored to the unique challenges posed by these technologies, complementing broader state and federal anti-discrimination mandates that may not have explicitly contemplated AI-driven practices. The legislation also interacts with other regulatory requirements by recognizing that documents and information obtained by the Division of Insurance concerning insurer compliance are proprietary and contain trade secrets, allowing for their use in regulatory actions while making aggregated or de-identified data publicly available.

International Alignment

Colorado SB 21-169 represents a pioneering effort within the United States to regulate the use of artificial intelligence and big data in insurance underwriting, particularly concerning the prevention of unfair discrimination. While the bill itself is a state-level initiative, its groundbreaking nature has positioned Colorado as a leader in this emerging regulatory domain, drawing attention from other jurisdictions both domestically and potentially internationally. The legislation is often cited as the first state law to formally adopt a regulation specifically dedicated to insurance algorithms. This proactive stance contrasts with, or complements, approaches in other states and countries which might rely on broader ethical guidelines, existing anti-discrimination laws, or more general data protection frameworks.

Domestically, the regulatory momentum initiated by Colorado aligns with discussions and cautionary warnings issued by regulators in other states, such as New York, Connecticut, and Washington, D.C., who have urged carriers to demonstrate the fairness of their models and data. This indicates a growing recognition across the U.S. of the need for robust AI governance and compliance measures within the insurance sector. While direct international alignment with specific foreign regulations is not explicitly stated in the available sources, Colorado's approach shares common objectives with global initiatives aimed at responsible AI development, transparency, and bias mitigation. The principles of non-discrimination and accountability embedded in SB 21-169 resonate with broader international dialogues on AI ethics and regulation, suggesting a conceptual alignment even without formal cross-border agreements. The bill's focus on transparency, risk management, and the protection of fundamental rights reflects a global trend towards ensuring that AI systems are developed and deployed in a manner that upholds societal values.

Implementation Timeline

Compliance Checklist

Sources and References