What does Colorado SB 21-169 and Regulation 10-1-1 say about AI in banking?

What are the key points of Colorado SB 21-169 and Regulation 10-1-1?

• SB 21-169 (signed July 6, 2021) bars unfair discrimination on the listed protected classes in any insurance practice and, under rules adopted by the Commissioner, bars use of an external data source, algorithm or predictive model that unfairly discriminates; rules could not take effect before January 1, 2023.
• The statute requires the Commissioner's rules to make each insurer provide information on its external data sources, explain how it uses them, maintain a risk management framework reasonably designed to detect unfair discrimination, assess results and remediation, and attest to implementation; the Division may examine an insurer's use of external data sources.
• Regulation 10-1-1 §3 applies to insurers authorized in Colorado offering individually issued life insurance, private passenger automobile insurance and health benefit plans; ECDIS (§4.D) includes credit scores, social media habits, locations, purchasing habits, education, occupation, telematics and other IoT data, biometric data, and risk scores derived from them.
• §5.A requires a risk-based governance and risk management framework with 14 documented components, including board or board-committee oversight, a cross-functional governance group, a model and ECDIS inventory with version control, quantitative testing documentation, ongoing monitoring that accounts for model drift, and annual review.
• §5.B makes the insurer responsible for third-party vendors' ECDIS, algorithms and models, which must be covered by a documented selection and oversight process; vendors may supply documents directly to the Division on the insurer's behalf.
• Dates: life insurers' frameworks had to be available to the Division by December 1, 2024; auto and health insurers' by July 1, 2026 (§5.C); annual officer-signed compliance reports are due December 1 for life insurers and July 1, 2026 and annually for auto and health (§6.B–C); insurers not using ECDIS file an attestation each December 1 (§6.E).
• §6.D: reports must be signed by an officer attesting to compliance, run to no more than 10 pages, and an insurer unable to attest must submit a corrective action plan; §9 allows civil penalties, cease and desist orders and licence suspension or revocation.
• The Regulation's duty to remediate unfair discrimination 'detected through quantitative testing requirements established by the Division' depends on a testing regulation; the Division's SB21-169 page still shows a draft quantitative testing regulation for life underwriting rather than an adopted one.

What did Colorado SB 21-169 and Regulation 10-1-1 change for banks?

SB 21-169 was the first US statute to put insurers' use of algorithms and external data under a mandatory governance and testing regime. For banks it matters less as law than as a template: the Division's framework (board oversight, inventory, vendor oversight, drift monitoring, an officer attestation) previews the controls state regulators are likely to expect of AI in credit, and the amended 2025 regulation extended the regime from life insurance to private passenger auto and health benefit plans. It sits alongside, not inside, Colorado's general AI statutes.

What does Colorado SB 21-169 and Regulation 10-1-1 require of insurers, and does it apply to banks?

Colorado SB 21-169 and its implementing Regulation 10-1-1 require insurers authorized in Colorado that sell individual life, private passenger auto or health benefit plan coverage and use external consumer data and information sources (ECDIS), algorithms or predictive models to build a documented, board-overseen governance and risk management framework designed to detect and remediate unfair discrimination on the statute's protected classes. Insurers must keep an inventory of ECDIS and models, document quantitative testing, monitor performance including drift, oversee vendors, and file an annual officer-signed compliance report with the Division of Insurance; insurers that use no ECDIS must file an annual attestation by December 1. The law governs insurers, not banks, so a bank is covered only through an authorized insurance affiliate, but the framework is a useful benchmark for bank AI governance.

The statute directs the Commissioner to adopt rules after a stakeholder process, line of business by line of business, and says the rules may not take effect before January 1, 2023. The Division's first regulation, effective November 14, 2023, covered life insurers; the amended Regulation 10-1-1, effective October 15, 2025, extended the governance framework to private passenger automobile insurers and health benefit plan insurers. The Division's own page records that it has also held stakeholder meetings on health and auto, issued a data call to the ten largest auto insurers by 2023 direct written premium, and circulated draft quantitative testing regulations for life underwriting, one from the Division in September 2023 and one from the American Council of Life Insurers in June 2024.

The regulation's 'quantitative testing requirements established by the Division' are the missing piece: the governance framework is in force, but the page we checked still shows the quantitative testing rule for life underwriting as a draft. Until a test is adopted, insurers can document governance and testing methodology but cannot point to a regulator-set standard for what unfair discrimination looks like numerically.

For banks the regulation is relevant by analogy and by affiliation. A bank holding company with an insurance subsidiary writing life, auto or health coverage in Colorado is within it. A bank's own credit models are not, and Colorado's general AI statutes address lending separately. New York's insurance circular letter on AI and external consumer data addresses similar ground for insurers.

WHAT THIS MEANS IN PRACTICE

• If the group includes a Colorado-authorized life, auto or health insurer, confirm someone owns the §5 framework and the annual December 1 (life) and July 1 (auto and health) filings.
• Use §5.A's 14 components as a checklist for bank AI governance: board oversight, a cross-functional group, an inventory with version control, drift monitoring and an annual review.
• Review bank-affiliated insurance products that use credit scores, telematics or other ECDIS for race-correlation risk before a quantitative testing standard is finalised.
• Make vendor contracts support regulator access: the regulation lets vendors give the Division documents directly, which only works if the contract requires cooperation.
• Track the Division's SB21-169 page for an adopted quantitative testing regulation and for any further amendments.