Update, October 2026: After this post was published, Colorado repealed and replaced SB 24-205 before it took effect. Governor Polis signed SB 26-189 on May 14, 2026, and the new law takes effect January 1, 2027. SB 26-189 removes the risk management program and annual impact assessment requirements described below. It replaces them with narrower duties covering consumer notice, explanations after adverse decisions, human review and recordkeeping. Insurers that comply with C.R.S. §10-3-1104.9 are still deemed compliant, and Colorado’s insurance-specific requirements under §10-3-1104.9 remain in place.
Colorado has been the most consequential state in U.S. insurance AI regulation for nearly three years, and in 2026, its requirements are reaching their fullest form. Any carrier writing business in Colorado, or using AI systems that affect Colorado policyholders, needs to understand two distinct legal frameworks operating in parallel: the Division of Insurance regulation under C.R.S. §10-3-1104.9, and the Colorado Artificial Intelligence Act (SB 205), effective June 30, 2026.
This is not a single compliance requirement. It is a layered governance obligation with different scopes, enforcement authorities, and operational implications for P&C carriers, auto insurers, and health benefit plans alike.
The Insurance-Specific Foundation: C.R.S. §10-3-1104.9
Colorado’s insurance-specific AI governance framework predates SB 205 by several years. The Division of Insurance adopted rules under C.R.S. §10-3-1104.9 that prohibit the use of external consumer data sources and predictive models resulting in unfair discrimination. The statute’s core requirement is quantitative testing for disparate impact, including data and models that are facially neutral, and the obligation applies even when an insurer does not believe its system discriminates.
Initially, the implementing regulation applied only to life insurers. Effective October 15, 2025, the scope expanded significantly: C.R.S. §10-3-1104.9 now applies to private passenger automobile insurance and health benefit plans as well.¹ For P&C carriers, this is material. Auto insurers writing in Colorado are now subject to ongoing quantitative bias testing under an existing, enforceable regulation, not a voluntary bulletin or a future effective date.
The regime includes documentation and management requirements, annual reporting to the Division, and governance obligations placing oversight responsibility at a senior management level. Colorado also released a draft proposed regulation on quantitative testing methodologies for external data sources in underwriting, though as of early 2026 that draft remained pending.²
Colorado SB 205: The Broader AI Governance Act
On May 17, 2024, Governor Polis signed SB 205, making Colorado the first state to enact comprehensive legislation governing AI systems across industries. Formally titled the Colorado Anti-Discrimination in AI Law (ADAI), it requires both developers and deployers of high-risk AI systems to use reasonable care to protect consumers from algorithmic discrimination.³
The original effective date was February 1, 2026. On August 28, 2025, Governor Polis signed SB 25B-004, pushing all operative dates back five months to June 30, 2026. Every substantive obligation remains unchanged. The delay provides preparation time without altering the compliance bar.⁴
SB 205 applies when an AI system makes or substantially influences a “consequential decision,” defined to include insurance coverage determinations, premium calculations, and claims processing. Any AI system that affects whether a policy is issued, what it costs, or how a claim is handled is likely within scope.
What Insurers Must Do by June 30, 2026
Carriers using AI in Colorado operations have six specific obligations as deployers under SB 205:
Risk Management Policy and Program: Deployers must implement a documented risk management policy covering how the organization identifies, documents, and mitigates risks of algorithmic discrimination. This must be an iterative process planned, implemented, and regularly updated over the lifecycle of each AI system.⁵
Annual Impact Assessments: Deployers must complete an initial impact assessment before deploying a high-risk AI system, with annual assessments thereafter. Each assessment must evaluate the system’s purpose, known discrimination risks, data inputs, and mitigation measures.
Pre-Decision Consumer Notice: Before a high-risk AI system makes or substantially contributes to a consequential decision affecting a Colorado consumer, the deployer must notify the consumer that AI is involved, describe the system’s purpose, provide contact information, and explain the consumer’s right to opt out of profiling where applicable.⁶
Adverse Decision Disclosure: When a consumer receives an adverse outcome from a high-risk AI decision, the deployer must provide notice describing the nature of the decision and how the consumer can appeal, correct inaccurate data, or request human review.
Website Disclosures: Deployers must maintain publicly accessible disclosures describing how they deploy high-risk AI systems. These are consumer-facing and regulator-accessible, not internal governance artifacts.
Documentation Retention: Records must be retained for the longer of the period the AI system is in use or three years after discontinuation. The Attorney General may require developers to produce documentation within 90 days of a request.
The Insurer Exemption and its Catch
SB 205 includes a specific exemption for insurers: a carrier in full compliance with C.R.S. §10-3-1104.9 and the implementing rules adopted by the Insurance Commissioner is deemed in full compliance with the ADAI.⁷
This is significant, but not a free pass. The exemption only applies if the carrier is actually in compliance with §10-3-1104.9, and that regulation now covers auto and health lines, not just life. Carriers without documented governance programs and quantitative testing processes under §10-3-1104.9 cannot rely on the exemption. And for AI systems used in insurance contexts not yet covered by the Division’s implementing rules, SB 205 obligations may still apply directly.
Documentation as the Compliance Asset
Across both frameworks, documentation functions as an affirmative defense. Under SB 205, there is a rebuttable presumption that a deployer used reasonable care if it complied with the Act’s requirements. Building that compliance record (i.e., AI system inventories, impact assessments, bias testing results, governance policies, vendor documentation) is how carriers establish that presumption.
The Attorney General may require developers to disclose documentation within 90 days of a request. Division of Insurance examiners can request governance materials during market conduct reviews. This documentation is not internal paperwork. It is the record carriers will be asked to produce.
What This Means for Carriers Operating in Colorado
Carriers using AI in Colorado auto, life, or health lines who have not yet implemented quantitative disparate impact testing under §10-3-1104.9 are operating out of compliance with existing regulation today, not just future law. That is the more immediate concern.
For carriers building toward SB 205 compliance, the June 30, 2026 deadline is specific and narrow. The Baker Botts analysis of the implementation delay advised carriers to use the five-month extension to complete AI system inventories, draft NIST-aligned policies and impact assessment templates, and pilot documentation processes.⁸
Colorado has built the most demanding insurance AI governance environment in the country. The NAIC bulletin remains relevant there, but it is the floor, not the standard.
Frequently Asked Questions About Colorado’s Insurance AI Law
What was Colorado SB 24-205?
Colorado SB 24-205, known as the Colorado AI Act, was signed on May 17, 2024, as the first comprehensive state law regulating high-risk AI systems across industries. Its effective date was delayed to June 30, 2026, and it was repealed and replaced by SB 26-189 before it took effect.
What is Colorado SB 26-189?
SB 26-189 is Colorado’s replacement AI law, signed on May 14, 2026. It regulates automated decision-making technology that materially influences consequential decisions, including insurance decisions. It requires consumer notice, a plain-language explanation after an adverse decision, access to and correction of personal data, human review where commercially reasonable, and records kept for at least three years.
When does Colorado’s AI law take effect?
Most of SB 26-189 takes effect January 1, 2027, and applies to consequential decisions made on or after that date. The Colorado Attorney General enforces the law and is developing implementing rules.
Does Colorado’s AI law apply to insurers?
Insurance decisions are covered consequential decisions under SB 26-189. However, insurers that comply with Colorado’s insurance-specific AI rules under C.R.S. §10-3-1104.9 are deemed compliant for the practice of insurance. Insurers’ use of automated tools in employment decisions is still covered by the broader law.
What is C.R.S. §10-3-1104.9?
C.R.S. §10-3-1104.9 is Colorado’s insurance-specific law prohibiting insurers from using external consumer data and predictive models in ways that result in unfair discrimination. The Division of Insurance’s implementing rules require governance, documentation, quantitative testing for unfair discrimination, and annual reporting to the Division.
Which lines of insurance do Colorado’s AI rules cover?
Colorado’s implementing regulation under §10-3-1104.9 originally applied to life insurers. Effective October 15, 2025, it expanded to private passenger automobile insurance and health benefit plans.
About WaterStreet
About WaterStreet Company: WaterStreet provides cloud-based policy administration software for small to mid-size P&C carriers. Our platform is designed to support the governance, documentation, and workflow requirements carriers increasingly need to meet regulatory expectations in an AI-driven environment.
Contact Us to see a demo or learn more!
Sources:
- Buchanan Ingersoll & Rooney, When Algorithms Underwrite: Insurance Regulators Demanding Explainable AI Systems (October 2025)
- Mayer Brown, New York State Department of Financial Services Adopts AI Guidance (July 2024)
- Colorado Attorney General, ADAI Rulemaking Overview (2024)
- Baker Botts, Colorado AI Act Implementation Delayed (September 2025)
- Colorado SB 24-205, Text of Enacted Legislation (leg.colorado.gov)
- Colorado SB 24-205, §§ 6-1-1703, 6-1-1704 (Deployer Obligations)
- Colorado SB 24-205, §6-1-1709 (Exemptions for Insurers)
- Baker Botts, Colorado AI Act Implementation Delayed (September 2025)
