AI Compliance for Colorado Insurance Companies: SB 24-205 + Division of Insurance Rules

Colorado insurance companies are in a unique compliance position. They face **two separate AI governance regimes** simultaneously: 1. **SB 24-205 (Colorado AI Act)** — Applies to all businesses using AI for consequential decisions. Insurance is explicitly listed as a consequential decision domain. 2. **Colorado Division of Insurance (DOI) AI Governance Rules** — Industry-specific regulations governing how insurers use AI and predictive models in underwriting, rating, and claims. Compliance with one does not satisfy the other. Insurance companies must implement governance that addresses both — or risk enforcement from both the AG and the DOI.

Related: SB 24-205 compliance guide · bias audit process · impact assessment requirements

**Underwriting AI:** - Risk scoring algorithms - Automated underwriting engines - Predictive models for policy approval/denial - Pricing and rating algorithms **Claims AI:** - Automated claims triage and routing - Fraud detection algorithms - Claims valuation models - Subrogation prediction tools **Customer-Facing AI:** - Chatbots handling policy inquiries - Automated policy recommendations - Dynamic pricing engines - Customer retention prediction models Every one of these systems makes or substantially assists in "consequential decisions" under SB 24-205 if it affects policy terms, pricing, claims outcomes, or coverage for Colorado consumers.

**Bias audits:** Test every AI system for discriminatory outcomes across all protected classes. Insurance-specific concern: Proxy variables like zip code, credit score, and education level frequently correlate with race and ethnicity. **Consumer disclosures:** Inform policyholders when AI is used in underwriting, claims, or pricing decisions. Provide adverse action notices when AI contributes to unfavorable outcomes (higher premiums, denied claims, coverage restrictions). **AG notification:** Report algorithmic discrimination incidents to the Colorado AG within 90 days. Insurance companies also have DOI reporting obligations. **Impact assessments:** Document the purpose, data inputs, risk level, and potential impact of each AI system used in insurance operations. **Record retention:** Maintain all compliance documentation for 3+ years. Insurance companies typically already have longer retention requirements under state insurance law.

The Colorado Division of Insurance has issued specific guidance on AI and predictive model governance: **Model validation:** Insurers must validate that AI models used in rating and underwriting produce actuarially sound results that don't unfairly discriminate. **Transparency requirements:** Insurers must be able to explain how AI-driven decisions are made, particularly for adverse actions. **Prohibited variables:** Certain variables cannot be used in insurance AI models if they serve as proxies for protected classes without actuarial justification. **Filing requirements:** Some AI-driven rating plans require DOI filing and approval before use. **Consumer complaint handling:** Insurers must have processes for consumers to challenge AI-driven insurance decisions, beyond what SB 24-205 requires. CO-AIMS covers the SB 24-205 layer comprehensively. For DOI-specific filing and actuarial requirements, work with your compliance counsel in conjunction with CO-AIMS's evidence documentation.

Insurance AI faces a specific bias challenge: many actuarially relevant variables are correlated with protected classes. **Examples:** - **Credit score** → correlated with race and ethnicity (well-documented disparities) - **Zip code** → correlated with race (residential segregation patterns) - **Education level** → correlated with race and socioeconomic status - **Occupation** → correlated with gender and race - **Homeownership status** → correlated with race and age These variables may have genuine predictive power for insurance risk, but their use can produce racially disparate pricing and coverage outcomes. SB 24-205 doesn't ban these variables, but it requires that their use be tested for disparate impact and documented. CO-AIMS runs proxy analysis as part of bias auditing — identifying which input features correlate with protected classes and measuring their impact on outcome disparities.

**Immediate (Now):** 1. Inventory all AI systems used in underwriting, claims, pricing, and customer service 2. Classify each as high-risk (consequential decision) or standard 3. Draft and publish your AI risk management policy **Before June 30, 2026:** 4. Run bias audits on all high-risk AI systems 5. Implement consumer disclosure notices for AI-driven decisions 6. Establish AG notification and DOI reporting procedures 7. Complete impact assessments for each high-risk system 8. Set up evidence retention (3+ year minimum) **Ongoing:** 9. Monthly automated bias checks on underwriting and pricing AI 10. Quarterly full audits with documented results 11. Annual impact assessment updates 12. Generate evidence bundles for regulatory inquiries CO-AIMS handles steps 4-12 automatically. Implementation time: 1-2 weeks for most insurance operations.