UPDATE – DECEMBER 2025:
Regulation 10-1-1 remains in effect and requires life insurers to adopt governance and risk management frameworks designed to prevent unfair discrimination in the use of AI, algorithms, and consumer data.
ORIGINAL COMPANY NEWS RELEASE:
Colorado Commissioner Approves Regulation 10-1-1 for Insurers
While New York City positions itself as a focal point for AI regulation in the U.S., another state takes the lead. The Commissioner of the Colorado Division of Insurance, operating under the Department of Regulatory Agencies, has officially adopted Regulation 10-1-1, outlining Governance and Risk Management Framework Requirements for Life Insurers’ Utilization of External Consumer Data and Information Sources, Algorithms, and Predictive Models. This regulation mandates that life insurers authorized to operate in Colorado establish and maintain a risk-based governance structure. A risk management framework is also required when employing external consumer data and information sources, algorithms, and predictive models.
Understanding Regulation 10-1-1 for Insurers
Under Regulation 10-1-1, insurers are compelled to document governing principles that articulate values and objectives while demonstrating how algorithms and predictive models, utilizing external consumer data and information sources, are reasonably designed to prevent unfair discrimination. Oversight of this framework must rest with the board of directors or a board committee. Senior management holds responsibility and accountability for the overall strategy, providing direction governing the use of algorithms and predictive models, ensuring clear lines of communication, and delivering regular reporting. A documented cross-functional governance group must be established, comprising representatives from key areas including legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer services.
Risk Management and Model Controls
Insurers must document policies and procedures covering the full model lifecycle. This includes design, development, testing, deployment, and ongoing monitoring of algorithms and predictive models.
The regulation requires continuous testing of models and data sources. Insurers must also implement controls to address identified risks. In addition, employees involved in designing, using, or monitoring these systems must receive appropriate training and education.
Reporting Requirements
Regulation 10-1-1 includes detailed reporting requirements. Insurers must submit a narrative report describing progress toward compliance by June 1, 2024. They must also file an annual narrative report confirming ongoing compliance with the regulation.
If an insurer cannot attest to compliance, it must submit a corrective action plan. Insurers that qualify for an exemption must file an annual exemption report by December 1, confirming that they do not use external consumer data, algorithms, or predictive models covered by the regulation.
The regulation took effect on November 14, 2023.
Need Help?
For insights into how Colorado’s Regulation 10-1-1 could impact your business, BABL AI provides independent audits, risk assessments, and compliance guidance.
