Colorado's First AI Model Compliance Reports Come Due

Colorado private passenger auto and health benefit insurers file their first annual AI model compliance report under Division of Insurance Regulation 10-1-1 by July 1, 2026, pulled into scope by an October 15, 2025 rule expansion. Life insurers have run the regime since 2023 (Colorado DOI; Bevaya, 2026).

The deadline is dated, statutory and unrelated to the state's better-known AI statute, which has spent 2026 in force, unenforced and already scheduled for replacement.

Key Takeaways

• July 1, 2026 is the first full annual compliance report for auto and health carriers, following an interim progress report due December 1, 2025. The regime is Regulation 10-1-1, not the Colorado Artificial Intelligence Act.
• 2,531 distinct AI and machine learning models sat across 193 responding private passenger auto insurers in the NAIC's survey, roughly 40% of them sourced from more than 70 third-party vendors.
• The quantitative bias test is waived. The Division's draft BIFSG methodology has never been finalized, and waivers covered the December 2024 and December 2025 attestation cycles, so this filing proves process, not outcomes.
• 23 states plus the District of Columbia have adopted the NAIC Model Bulletin in some form, but it carries no filing date and is enforced through market conduct exams instead.
• Senate Bill 26-189, signed May 14, 2026, repealed and reenacted Colorado's flagship AI law with a January 1, 2027 effective date, which is why the insurance rule is the only live deadline.

Two Colorado AI Laws, and Only One Has a July Deadline

Colorado's broad AI statute has spent 2026 in a state most compliance officers would call unworkable. Senate Bill 24-205 was to take effect February 1, 2026, then moved to June 30, 2026 by SB 25B-004, signed August 28, 2025 (Hunton Andrews Kurth, August 2025). It reached that date with enforcement paused in federal litigation and its replacement already signed.

Governor Jared Polis signed SB 26-189 on May 14, 2026, repealing and reenacting the framework, removing the duty-of-care standard and mandatory algorithmic impact assessments, and setting a new effective date of January 1, 2027 (Norton Rose Fulbright, May 2026).

None of that is the event a model-owning actuary faces this month. Colorado's insurance-specific oversight runs on an older track: C.R.S. Section 10-3-1104.9, enacted by SB21-169 in 2021, and Regulation 10-1-1, effective for life insurers November 14, 2023, with an initial progress report due June 1, 2024 and annual attestations from December 1, 2024 (WaterStreet Company, 2026).

The rule does not ask a carrier to certify that its models are unbiased. It asks the carrier to prove it has a system capable of finding out: a board-approved written governance framework, a current model inventory with version control and documented material changes, written testing protocols including quantitative bias analysis, and a documented consumer complaint and appeals process. Health benefit insurers must additionally show that a licensed provider, not the model, made any coverage decision.

The Vendor Share of the Model Inventory

The accountability problem sharpens once a model was not built in-house. The NAIC's private passenger auto survey identified 2,531 distinct AI and machine learning models across 193 responding insurers, roughly 60% developed internally and roughly 40%, more than one model in three, sourced from more than 70 third-party vendors (NAIC, December 2022). The same survey found 88% of respondents use, plan to use, or are exploring such models somewhere in their operations.

Regulation 10-1-1 does not soften the filing burden for those models. Its position, echoed in the NAIC's own Model Bulletin, is that outsourcing the model does not outsource the accountability. The carrier deploying a vendor's underwriting or claims model produces the governance narrative, the testing evidence and the complaint-process documentation for it.

That lands the work on the actuary who owns the model, while legal and compliance own the submission. An actuary who can defend a model's variables and validation results in an actuarial memorandum is not thereby producing a version-control log or a governance narrative, and a compliance officer assembling the filing cannot verify that the stated testing protocol reflects production behavior. On an in-house pricing model, the actuary opens the validation folder. On a vendor-sourced model, the actuary is asking a product team for artifacts that were never generated in a form a regulator would accept, under contracts written before the rule existed.

What the filing proves is narrower than it looks. The Division circulated a draft rule in September 2023 proposing Bayesian Improved First Name Surname Geocoding as the required disparate-impact test; actuaries challenged its error rate, the method was never finalized, and the Division waived the quantitative testing requirement for the December 2024 and December 2025 cycles (Forbes, June 2026). The July report is therefore a documentation deliverable rather than a bias-audit result, and a carrier that treats this cycle's bar as permanent is setting up next year's filing as a scramble.

Two Standards, One Model Portfolio

Colorado's regime and the NAIC Model Bulletin look similar on paper and diverge where it costs money. The bulletin, adopted in some form by 23 states plus the District of Columbia as of late 2025, is principle-based guidance with no fixed filing date, assessed through market conduct examinations (Fenwick, 2026). The NAIC reinforced that channel in January 2026 with a 12-state pilot of its AI Systems Evaluation Tool (WaterStreet Company, 2026). Regulation 10-1-1 is the opposite structure.

A carrier licensed in Colorado and a dozen bulletin-adopting states is not filing one governance program twice. It maintains two documentation sets on two clocks, with two definitions of what counts as an in-scope AI system and two evidentiary bars for what testing has to show, against an identical model portfolio.

The vendor gap will eventually close from the supply side. The NAIC's Third-Party Data and Models Working Group is drafting a model law that would extend licensing-style oversight to vendors themselves, a direction this site has traced in the push toward a NAIC third-party vendor registry. Until that law exists, the duplication is the cost the bias-audit debate has overshadowed: the operational question was never whether disparate-impact testing should exist, but how many parallel versions of the same governance file one actuary maintains for regulators who agree on the principle and differ on the paperwork, a burden examined from the multi-state side in the state AI law patchwork.