Colorado's First AI Model Compliance Reports Come Due

Colorado private passenger auto and health benefit insurers pulled into scope by an October 15, 2025 rule expansion file their first annual AI model compliance report under Division of Insurance Regulation 10-1-1 by July 1, 2026, a governance and testing-documentation regime life insurers have run since 2023 (Colorado DOI; Bevaya, 2026).

Two Colorado AI Laws, and Only One Has an Actual Deadline This Month

Colorado's broader AI statute has spent 2026 in a state most compliance officers would call unworkable. Senate Bill 24-205, the Colorado Artificial Intelligence Act, was supposed to take effect February 1, 2026, then got pushed to June 30, 2026 by SB 25B-004, signed August 28, 2025 (Hunton Andrews Kurth, August 2025). It arrived at that date still nominally on the books, but with its enforcement paused by a federal court in ongoing litigation and its replacement already signed and waiting in the wings (Available Law, June 2026). Governor Jared Polis signed SB 26-189 on May 14, 2026, repealing and reenacting the entire framework, stripping out the duty-of-care standard and mandatory algorithmic impact assessments that made the original law notable, and setting a new effective date of January 1, 2027 (Norton Rose Fulbright, May 2026). For six months, Colorado's flagship AI law has been simultaneously in force, unenforced, and scheduled for replacement.

None of that is the compliance event that matters to a model-owning actuary this month. Colorado's insurance-specific AI oversight runs on a separate, older track: C.R.S. Section 10-3-1104.9, enacted by SB21-169 in 2021, and its implementing rule, Division of Insurance Regulation 10-1-1, adopted for life insurers effective November 14, 2023. That regulation required an initial compliance progress report by June 1, 2024 and annual compliance attestations beginning December 1, 2024 for any life insurer using external consumer data and predictive models (WaterStreet Company, 2026). It has nothing to do with SB 24-205's duty of care or SB 26-189's disclosure framework. It is a standing Division of Insurance rule with its own filing calendar, and on October 15, 2025 the Division extended its scope to private passenger auto and health benefit plan insurers for the first time (Bevaya, 2026). Those newly covered carriers filed an interim progress report by December 1, 2025 and now owe their first full annual compliance report by July 1, 2026 (WaterStreet Company, 2026). That is the actual first-cycle filing this article is about, and it is due while the state's more famous AI law is still working out what it even is.

What the First-Cycle Filing Actually Requires

Regulation 10-1-1 does not ask a carrier to certify that its models are unbiased. It asks the carrier to prove it has a system capable of finding out. The rule requires a board-approved, written governance framework documenting how external consumer data and predictive models are designed, deployed, and monitored to prevent unfair discrimination, plus a current model inventory with version control and documentation of material changes, written testing protocols that include quantitative bias and discrimination analysis, and a documented consumer complaint and appeals process for anyone affected by an algorithmic decision (Bevaya, 2026). For health benefit insurers specifically, the rule adds a human-in-the-loop requirement: a licensed provider must retain ultimate responsibility whenever a model informs a coverage decision, so the filing has to show that a person, not the model, made the call (Bevaya, 2026). None of this is new machinery for the life insurers who have been filing under this regime since 2023. It is entirely new for auto and health carriers whose compliance functions may never have built a model inventory to a regulatory-audit standard before.

The quantitative testing piece remains the regime's soft spot. The Division circulated a draft rule in September 2023 proposing Bayesian Improved First Name Surname Geocoding, a RAND Corporation method for estimating an applicant's race from name and address data, as the required disparate-impact test, and that draft has never been finalized (Forbes, June 2026). Actuaries pushed back on the method's error rate, and the Division responded with a waiver exempting insurers from the quantitative testing requirement in the December 2024 and December 2025 attestation cycles (Forbes, June 2026). The July 2026 filing therefore looks less like a bias-audit result and more like a documentation deliverable: prove the governance structure, the model inventory, and the testing protocol exist, without yet having to hand over quantitative proof that the outputs clear a fairness threshold. That gap will not stay open indefinitely, and a carrier that treats this cycle as the permanent bar rather than a placeholder is setting up next year's filing to look like a scramble.

Who Actually Signs the Filing

Regulation 10-1-1's language is deliberately job-title-agnostic. It requires senior management accountability and a documented cross-functional governance group, not a named signatory role, which in practice pushes the compilation work onto whoever owns the model, typically the pricing or underwriting actuary maintaining the algorithm, while legal and compliance own the submission itself and the response if the Division or Attorney General requests supporting records (Bevaya, 2026). That split creates a real documentation gap of its own: an actuary who can explain a model's variables and validation results in an actuarial memo is not automatically producing the governance narrative, version-control log, and complaint-process description a compliance filing needs, and a compliance officer assembling the filing is not positioned to verify that the underlying testing protocol actually reflects how the model performs in production. The two functions have to co-author the artifact, which is a coordination cost most carriers have not had to budget for on an annual cycle before this year.

The Third-Party Vendor Gap

The accountability problem gets sharper once a model was not built in-house. The most recent NAIC survey of the private passenger auto market identified 2,531 distinct AI and machine learning models across 193 responding insurers, of which roughly 60% were developed internally and roughly 40%, more than one model in three, came from more than 70 third-party vendors (NAIC, December 2022). That same survey found 88% of the responding auto insurers use, plan to use, or are exploring AI or machine learning models somewhere in their operations (NAIC, December 2022). Regulation 10-1-1 does not soften the filing burden for vendor-built models. Its position, echoed almost verbatim in the NAIC's own Model Bulletin, is that outsourcing the model does not outsource the accountability: the carrier that deploys a vendor's underwriting or claims model is the one that has to produce the governance narrative, testing evidence, and complaint-process documentation for it, whether or not the vendor is willing to hand over the underlying validation work (Bevaya, 2026; WaterStreet Company, 2026).

That is where the first-cycle filing is likely to expose the widest gap. A carrier's model inventory can list a vendor product accurately, but the written testing protocol the regulation demands has to describe how that model was validated for bias, and most vendor contracts signed before this rule existed were not written to guarantee the carrier audit rights or documentation access sufficient to produce DOI-grade evidence on demand. An actuary trying to complete the filing for an in-house pricing model can usually walk into the validation folder; an actuary trying to complete it for a vendor-sourced underwriting model may be asking a vendor's product team for testing artifacts that were never generated in a form a regulator would accept. The NAIC's Third-Party Data and Models Working Group is drafting a model law, anticipated later in 2026, that would extend licensing-style oversight to the vendors themselves (Fenwick, 2026), which would eventually close this gap from the supply side. Until that law exists, the burden sits entirely with the carrier filing the report, a dynamic this site has traced in the broader push toward a NAIC third-party vendor registry.

A Two-Standard Burden Layered on the NAIC Bulletin

Colorado's regime and the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers look similar on paper and diverge in ways that matter operationally. The NAIC bulletin, adopted in some form by 23 states plus the District of Columbia as of late 2025, is principle-based guidance without a fixed statutory filing date: it expects a written AI systems program covering governance, risk management, third-party oversight, and consumer notice, and enforcement runs through market conduct examinations rather than an annual report to a specific office (Fenwick, 2026). The NAIC reinforced that examination channel in January 2026 by launching a pilot of its AI Systems Evaluation Tool across 12 states, an effort to standardize how examiners assess an insurer's AI governance during a routine exam rather than through a stand-alone filing (WaterStreet Company, 2026). Colorado's Regulation 10-1-1 is the opposite structure: a hard annual deadline, a specific list of required artifacts tied to specific lines of business, and a filing that exists independent of whether an examiner ever opens a market conduct review.

A carrier licensed in Colorado and a dozen bulletin-adopting states is not filing one governance program twice. It is maintaining two documentation sets on two clocks, with two different definitions of what counts as an in-scope AI system and two different evidentiary bars for what "testing" has to show, even though the underlying model portfolio is identical. That duplication is the practical cost the debate over bias-audit methodology has obscured: the harder operational question was never whether disparate-impact testing should exist, it was how many parallel versions of the same governance file an actuary has to maintain to satisfy regulators who agree on the principle and disagree on the paperwork, a burden this site examined from the multi-state side in its coverage of the state AI law patchwork forcing carriers into four compliance regimes.

Why This Filing Cycle Becomes the Template

Colorado is currently the only state with a live, dated, statutorily backed AI model compliance report for insurers rather than exam-based guidance, which makes its artifact list the closest thing the industry has to a worked example of what an insurance AI compliance filing looks like in practice. State insurance departments drafting their own rules tend to start from whatever already has an operating history, not from a bulletin that has never produced a completed filing anyone can point to. The Colorado Division of Insurance's 2022 partnership with the algorithmic auditing firm ORCAA, framed at the time as a step toward ensuring "big data is used responsibly by insurers" (Colorado Division of Insurance, 2022), gave the Division four years to build internal capacity for reviewing exactly this kind of filing before the first auto and health reports landed. Other states building AI oversight capacity from scratch in 2026 do not have that head start, which raises the odds they lean on Colorado's artifact list, its governance-plus-inventory-plus-testing-protocol structure, rather than inventing their own from the NAIC bulletin's more abstract language.

For a carrier's actuarial and model-risk functions, the practical move is to build the documentation set Colorado already requires as the default template, not a Colorado-specific exception. A model inventory with version control, a written testing protocol describing validation methodology in terms a non-actuary reviewer can audit, and a governance narrative naming who is accountable for a vendor-built model are artifacts that satisfy Colorado's July filing and give a carrier a head start on whatever a second or third state copies from it. Carriers that build this documentation only after a state mandates it will keep re-deriving the same governance narrative under a new deadline every time another department adopts its own version of Regulation 10-1-1, a pattern that tracks the broader model-governance discipline this site covered in its analysis of rate-filing governance for AI pricing model drift.