# Colorado SB 21-169 and Regulation 10-1-1: Protecting Consumers from Unfair Discrimination in Insurance Practices (SB21-169, C.R.S. § 10-3-1104.9) and Colorado Insurance Regulation 10-1-1 (3 CCR 702-10)

Source: https://www.bankingnewsai.com/ai-regulation/documents/co-sb21-169
Last updated: Oct 5, 2026

Colorado SB 21-169, signed July 6, 2021 and codified at C.R.S. § 10-3-1104.9, prohibits insurers from unfairly discriminating on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression, including through external consumer data and information sources (ECDIS), algorithms and predictive models. The Division of Insurance implements it through Regulation 10-1-1 (3 CCR 702-10), effective November 14, 2023 and amended effective October 15, 2025, which requires life, private passenger auto and health benefit plan insurers using ECDIS to maintain a board-overseen governance and risk management framework and file annual compliance reports. It is an insurance law, not a banking law: banks are affected only through bank-owned insurers, and its quantitative testing standard is still unfinished.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/colorado-ai-act) |
| Type | Statute |
| Status | In force |
| Published | Jul 6, 2021 |
| Applies to | Insurers authorized in Colorado: Regulation 10-1-1 covers individually issued life insurance, private passenger automobile insurance and health benefit plans. It does not regulate bank lending, deposits or payments; it reaches a bank only through an insurance affiliate or subsidiary that is itself an authorized Colorado insurer. Title insurance, surety bonds and insurers of exempt commercial policyholders are excluded by the statute |
| Official text | https://doi.colorado.gov/for-consumers/sb21-169-protecting-consumers-from-unfair-discrimination-in-insurance-practices |

## Key points

- SB 21-169 (signed July 6, 2021) bars unfair discrimination on the listed protected classes in any insurance practice and, under rules adopted by the Commissioner, bars use of an external data source, algorithm or predictive model that unfairly discriminates; rules could not take effect before January 1, 2023.
- The statute requires the Commissioner's rules to make each insurer provide information on its external data sources, explain how it uses them, maintain a risk management framework reasonably designed to detect unfair discrimination, assess results and remediation, and attest to implementation; the Division may examine an insurer's use of external data sources.
- Regulation 10-1-1 §3 applies to insurers authorized in Colorado offering individually issued life insurance, private passenger automobile insurance and health benefit plans; ECDIS (§4.D) includes credit scores, social media habits, locations, purchasing habits, education, occupation, telematics and other IoT data, biometric data, and risk scores derived from them.
- §5.A requires a risk-based governance and risk management framework with 14 documented components, including board or board-committee oversight, a cross-functional governance group, a model and ECDIS inventory with version control, quantitative testing documentation, ongoing monitoring that accounts for model drift, and annual review.
- §5.B makes the insurer responsible for third-party vendors' ECDIS, algorithms and models, which must be covered by a documented selection and oversight process; vendors may supply documents directly to the Division on the insurer's behalf.
- Dates: life insurers' frameworks had to be available to the Division by December 1, 2024; auto and health insurers' by July 1, 2026 (§5.C); annual officer-signed compliance reports are due December 1 for life insurers and July 1, 2026 and annually for auto and health (§6.B–C); insurers not using ECDIS file an attestation each December 1 (§6.E).
- §6.D: reports must be signed by an officer attesting to compliance, run to no more than 10 pages, and an insurer unable to attest must submit a corrective action plan; §9 allows civil penalties, cease and desist orders and licence suspension or revocation.
- The Regulation's duty to remediate unfair discrimination 'detected through quantitative testing requirements established by the Division' depends on a testing regulation; the Division's SB21-169 page still shows a draft quantitative testing regulation for life underwriting rather than an adopted one.

## What changed for banks

SB 21-169 was the first US statute to put insurers' use of algorithms and external data under a mandatory governance and testing regime. For banks it matters less as law than as a template: the Division's framework (board oversight, inventory, vendor oversight, drift monitoring, an officer attestation) previews the controls state regulators are likely to expect of AI in credit, and the amended 2025 regulation extended the regime from life insurance to private passenger auto and health benefit plans. It sits alongside, not inside, Colorado's general AI statutes.

## Use cases it governs

- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [Fair lending & discrimination](https://www.bankingnewsai.com/ai-regulation/by-use-case#fair-lending)

## What does Colorado SB 21-169 and Regulation 10-1-1 require of insurers, and does it apply to banks?

Colorado SB 21-169 and its implementing Regulation 10-1-1 require insurers authorized in Colorado that sell individual life, private passenger auto or health benefit plan coverage and use external consumer data and information sources (ECDIS), algorithms or predictive models to build a documented, board-overseen governance and risk management framework designed to detect and remediate unfair discrimination on the statute's protected classes. Insurers must keep an inventory of ECDIS and models, document quantitative testing, monitor performance including drift, oversee vendors, and file an annual officer-signed compliance report with the Division of Insurance; insurers that use no ECDIS must file an annual attestation by December 1. The law governs insurers, not banks, so a bank is covered only through an authorized insurance affiliate, but the framework is a useful benchmark for bank AI governance.

| Rule | Authority | What it requires | Status | Source |
| --- | --- | --- | --- | --- |
| C.R.S. § 10-3-1104.9 / SB 21-169 — Prohibition | [Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/colorado-ai-act) | Insurers may not unfairly discriminate on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression, including through ECDIS, algorithms or predictive models. | Signed July 6, 2021 | [Colorado SB 21-169 and Regulation 10-1-1](https://www.bankingnewsai.com/ai-regulation/documents/co-sb21-169) |
| Regulation 10-1-1 §3 — Applicability | [Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/colorado-ai-act) | Applies to authorized insurers offering individually issued life insurance, private passenger automobile insurance and health benefit plans. | Effective November 14, 2023; amended October 15, 2025 | [official text](https://doi.colorado.gov/for-consumers/sb21-169-protecting-consumers-from-unfair-discrimination-in-insurance-practices) |
| Regulation 10-1-1 §5.A — Governance and risk management framework | [Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/colorado-ai-act) | Maintain a risk-based framework with board oversight, senior management accountability, a cross-functional governance group, documented policies, complaint handling, an ECDIS and model inventory, quantitative testing documentation, drift monitoring and an annual review. | Life insurers from December 1, 2024; auto and health from July 1, 2026 | [official text](https://doi.colorado.gov/for-consumers/sb21-169-protecting-consumers-from-unfair-discrimination-in-insurance-practices) |
| Regulation 10-1-1 §5.B — Third-party vendors | [Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/colorado-ai-act) | The insurer remains responsible for vendors' ECDIS, algorithms and predictive models and must document a selection and oversight process; vendors may give the Division documents directly. | In force since October 15, 2025 (amended text) | [official text](https://doi.colorado.gov/for-consumers/sb21-169-protecting-consumers-from-unfair-discrimination-in-insurance-practices) |
| Regulation 10-1-1 §6.A — Progress narrative | [Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/colorado-ai-act) | Insurers using ECDIS at the regulation's effective date file a narrative report on progress toward compliance. | June 1, 2024 for life; December 1, 2025 for auto and health | [official text](https://doi.colorado.gov/for-consumers/sb21-169-protecting-consumers-from-unfair-discrimination-in-insurance-practices) |
| Regulation 10-1-1 §6.B–D — Annual compliance report | [Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/colorado-ai-act) | File a report of up to 10 pages summarizing compliance with §5, signed by an officer attesting to compliance, or a corrective action plan if unable to attest. | December 1, 2024 and annually for life; July 1, 2026 and annually for auto and health | [official text](https://doi.colorado.gov/for-consumers/sb21-169-protecting-consumers-from-unfair-discrimination-in-insurance-practices) |
| Regulation 10-1-1 §6.E — Non-use attestation | [Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/colorado-ai-act) | Insurers that do not use ECDIS or algorithms or models using ECDIS file an officer-signed attestation of non-use. | Annually by December 1 | [official text](https://doi.colorado.gov/for-consumers/sb21-169-protecting-consumers-from-unfair-discrimination-in-insurance-practices) |
| Regulation 10-1-1 §9 — Enforcement | [Colorado AI Act](https://www.bankingnewsai.com/ai-regulation/colorado-ai-act) | Noncompliance can bring civil penalties, cease and desist orders and licence suspension or revocation under Colorado insurance law, subject to due process. | In force | [official text](https://doi.colorado.gov/for-consumers/sb21-169-protecting-consumers-from-unfair-discrimination-in-insurance-practices) |

The statute directs the Commissioner to adopt rules after a stakeholder process, line of business by line of business, and says the rules may not take effect before January 1, 2023. The Division's first regulation, effective November 14, 2023, covered life insurers; the amended Regulation 10-1-1, effective October 15, 2025, extended the governance framework to private passenger automobile insurers and health benefit plan insurers. The Division's own page records that it has also held stakeholder meetings on health and auto, issued a data call to the ten largest auto insurers by 2023 direct written premium, and circulated draft quantitative testing regulations for life underwriting, one from the Division in September 2023 and one from the American Council of Life Insurers in June 2024.

The regulation's 'quantitative testing requirements established by the Division' are the missing piece: the governance framework is in force, but the page we checked still shows the quantitative testing rule for life underwriting as a draft. Until a test is adopted, insurers can document governance and testing methodology but cannot point to a regulator-set standard for what unfair discrimination looks like numerically.

For banks the regulation is relevant by analogy and by affiliation. A bank holding company with an insurance subsidiary writing life, auto or health coverage in Colorado is within it. A bank's own credit models are not, and Colorado's general AI statutes address lending separately. New York's insurance circular letter on AI and external consumer data addresses similar ground for insurers.

### What this means in practice

- If the group includes a Colorado-authorized life, auto or health insurer, confirm someone owns the §5 framework and the annual December 1 (life) and July 1 (auto and health) filings.
- Use §5.A's 14 components as a checklist for bank AI governance: board oversight, a cross-functional group, an inventory with version control, drift monitoring and an annual review.
- Review bank-affiliated insurance products that use credit scores, telematics or other ECDIS for race-correlation risk before a quantitative testing standard is finalised.
- Make vendor contracts support regulator access: the regulation lets vendors give the Division documents directly, which only works if the contract requires cooperation.
- Track the Division's SB21-169 page for an adopted quantitative testing regulation and for any further amendments.

## FAQ

### Does Colorado SB 21-169 apply to banks?

No, not directly. SB 21-169 and Regulation 10-1-1 govern insurers authorized in Colorado, in life, private passenger auto and health benefit plan lines. A bank is affected only if it owns or operates an authorized Colorado insurer, and its loan underwriting is governed by other law.

### When does Colorado Regulation 10-1-1 take effect?

The regulation took effect November 14, 2023 and was amended effective October 15, 2025. Life insurers had to have their governance framework available by December 1, 2024. Private passenger auto and health benefit plan insurers had to have theirs available and file their first compliance reports by July 1, 2026.

### What are the penalties under Colorado Regulation 10-1-1?

Section 9 of the regulation says noncompliance may result in sanctions available under Colorado insurance law, which include civil penalties, cease and desist orders, and suspension or revocation of a licence, subject to due process. It does not state a fixed dollar amount.

### How does Colorado SB 21-169 compare with the Colorado AI Act?

SB 21-169 is sector-specific: it regulates insurers' use of external consumer data and algorithms under the Division of Insurance. The Colorado AI Act (SB 24-205, since replaced by SB 26-189) is a general statute on high-risk AI systems in consequential decisions such as lending; the two are separate laws.

## Related documents

- [Colorado AG proposed ADMT rules](https://www.bankingnewsai.com/ai-regulation/documents/co-ag-admt-proposed-rules-2026) — Proposed Automated Decision-Making Technology and Conversational AI Service Rules (Notice of Rulemaking Hearing) (Aug 11, 2026)
- [HB 26-1263](https://www.bankingnewsai.com/ai-regulation/documents/co-hb26-1263) — Conversational Artificial Intelligence Service Operator Requirements (Chatbot Safety Act) (May 29, 2026)
- [SB 26-189](https://www.bankingnewsai.com/ai-regulation/documents/co-sb26-189) — Automated Decision-Making Technology Act (repeal and reenactment of the Colorado AI Act) (May 14, 2026)
- [SB 25B-004](https://www.bankingnewsai.com/ai-regulation/documents/co-sb25b-004) — Artificial Intelligence Consumer Protections — delay of effective date to June 30, 2026 (Aug 28, 2025)
- [SB 24-205](https://www.bankingnewsai.com/ai-regulation/documents/co-sb24-205) — Consumer Protections for Artificial Intelligence (Colorado Artificial Intelligence Act) (May 17, 2024)
- [SB 947](https://www.bankingnewsai.com/ai-regulation/documents/ca-sb-947-2026) — Employment: Automated Decision Systems (No Robo Bosses Act) (Sep 30, 2026)
- [Bailey: Frontier AI and the Question of Governance (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/boe-bailey-frontier-ai-governance-2026) — Frontier AI and the Question of Governance — Governor Andrew Bailey (Sep 30, 2026)
- [AB 1609](https://www.bankingnewsai.com/ai-regulation/documents/ca-ab-1609-2026) — Customer Service Chatbots (Right to Human Customer Service Act) (Sep 28, 2026)

Last reviewed Oct 5, 2026. Cite the official text (https://doi.colorado.gov/for-consumers/sb21-169-protecting-consumers-from-unfair-discrimination-in-insurance-practices) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/co-sb21-169
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.