Colorado has been the most consequential state in U.S. insurance AI regulation for nearly three years, and in 2026, its requirements are reaching their fullest form. Any carrier writing business in Colorado, or using AI systems that affect Colorado policyholders, needs to understand two distinct legal frameworks operating in parallel: the Division of Insurance regulation under C.R.S. §10-3-1104.9, and the Colorado Artificial Intelligence Act (SB 205), effective June 30, 2026.
This is not a single compliance requirement. It is a layered governance obligation with different scopes, enforcement authorities, and operational implications for P&C carriers, auto insurers, and health benefit plans alike.
The Insurance-Specific Foundation: C.R.S. §10-3-1104.9
Colorado’s insurance-specific AI governance framework predates SB 205 by several years. The Division of Insurance adopted rules under C.R.S. §10-3-1104.9 that prohibit the use of external consumer data sources and predictive models resulting in unfair discrimination. The statute’s core requirement is quantitative testing for disparate impact, including data and models that are facially neutral, and the obligation applies even when an insurer does not believe its system discriminates.
Initially, the implementing regulation applied only to life insurers. Effective October 15, 2025, the scope expanded significantly: C.R.S. §10-3-1104.9 now applies to private passenger automobile insurance and health benefit plans as well.¹ For P&C carriers, this is material. Auto insurers writing in Colorado are now subject to ongoing quantitative bias testing under an existing, enforceable regulation, not a voluntary bulletin or a future effective date.
The regime includes documentation and management requirements, annual reporting to the Division, and governance obligations placing oversight responsibility at a senior management level. Colorado also released a draft proposed regulation on quantitative testing methodologies for external data sources in underwriting, though as of early 2026 that draft remained pending.²
Colorado SB 205: The Broader AI Governance Act
On May 17, 2024, Governor Polis signed SB 205, making Colorado the first state to enact comprehensive legislation governing AI systems across industries. Formally titled the Colorado Anti-Discrimination in AI Law (ADAI), it requires both developers and deployers of high-risk AI systems to use reasonable care to protect consumers from algorithmic discrimination.³
The original effective date was February 1, 2026. On August 28, 2025, Governor Polis signed SB 25B-004, pushing all operative dates back five months to June 30, 2026. Every substantive obligation remains unchanged. The delay provides preparation time without altering the compliance bar.⁴
SB 205 applies when an AI system makes or substantially influences a “consequential decision,” defined to include insurance coverage determinations, premium calculations, and claims processing. Any AI system that affects whether a policy is issued, what it costs, or how a claim is handled is likely within scope.
What Insurers Must Do by June 30, 2026
Carriers using AI in Colorado operations have six specific obligations as deployers under SB 205:
Risk Management Policy and Program: Deployers must implement a documented risk management policy covering how the organization identifies, documents, and mitigates risks of algorithmic discrimination. This must be an iterative process planned, implemented, and regularly updated over the lifecycle of each AI system.⁵
Annual Impact Assessments: Deployers must complete an initial impact assessment before deploying a high-risk AI system, with annual assessments thereafter. Each assessment must evaluate the system’s purpose, known discrimination risks, data inputs, and mitigation measures.
Pre-Decision Consumer Notice: Before a high-risk AI system makes or substantially contributes to a consequential decision affecting a Colorado consumer, the deployer must notify the consumer that AI is involved, describe the system’s purpose, provide contact information, and explain the consumer’s right to opt out of profiling where applicable.⁶
Adverse Decision Disclosure: When a consumer receives an adverse outcome from a high-risk AI decision, the deployer must provide notice describing the nature of the decision and how the consumer can appeal, correct inaccurate data, or request human review.
Website Disclosures: Deployers must maintain publicly accessible disclosures describing how they deploy high-risk AI systems. These are consumer-facing and regulator-accessible, not internal governance artifacts.
Documentation Retention: Records must be retained for the longer of the period the AI system is in use or three years after discontinuation. The Attorney General may require developers to produce documentation within 90 days of a request.
The Insurer Exemption and its Catch
SB 205 includes a specific exemption for insurers: a carrier in full compliance with C.R.S. §10-3-1104.9 and the implementing rules adopted by the Insurance Commissioner is deemed in full compliance with the ADAI.⁷
This is significant, but not a free pass. The exemption only applies if the carrier is actually in compliance with §10-3-1104.9, and that regulation now covers auto and health lines, not just life. Carriers without documented governance programs and quantitative testing processes under §10-3-1104.9 cannot rely on the exemption. And for AI systems used in insurance contexts not yet covered by the Division’s implementing rules, SB 205 obligations may still apply directly.
Documentation as the Compliance Asset
Across both frameworks, documentation functions as an affirmative defense. Under SB 205, there is a rebuttable presumption that a deployer used reasonable care if it complied with the Act’s requirements. Building that compliance record (i.e., AI system inventories, impact assessments, bias testing results, governance policies, vendor documentation) is how carriers establish that presumption.
The Attorney General may require developers to disclose documentation within 90 days of a request. Division of Insurance examiners can request governance materials during market conduct reviews. This documentation is not internal paperwork. It is the record carriers will be asked to produce.
What This Means for Carriers Operating in Colorado
Carriers using AI in Colorado auto, life, or health lines who have not yet implemented quantitative disparate impact testing under §10-3-1104.9 are operating out of compliance with existing regulation today, not just future law. That is the more immediate concern.
For carriers building toward SB 205 compliance, the June 30, 2026 deadline is specific and narrow. The Baker Botts analysis of the implementation delay advised carriers to use the five-month extension to complete AI system inventories, draft NIST-aligned policies and impact assessment templates, and pilot documentation processes.⁸
Colorado has built the most demanding insurance AI governance environment in the country. The NAIC bulletin remains relevant there, but it is the floor, not the standard.
About WaterStreet
About WaterStreet Company: WaterStreet provides cloud-based policy administration software for small to mid-size P&C carriers. Our platform is designed to support the governance, documentation, and workflow requirements carriers increasingly need to meet regulatory expectations in an AI-driven environment.
Contact Us to see a demo or learn more!
Sources:
- Buchanan Ingersoll & Rooney, When Algorithms Underwrite: Insurance Regulators Demanding Explainable AI Systems (October 2025)
- Mayer Brown, New York State Department of Financial Services Adopts AI Guidance (July 2024)
- Colorado Attorney General, ADAI Rulemaking Overview (2024)
- Baker Botts, Colorado AI Act Implementation Delayed (September 2025)
- Colorado SB 24-205, Text of Enacted Legislation (leg.colorado.gov)
- Colorado SB 24-205, §§ 6-1-1703, 6-1-1704 (Deployer Obligations)
- Colorado SB 24-205, §6-1-1709 (Exemptions for Insurers)
- Baker Botts, Colorado AI Act Implementation Delayed (September 2025)
