Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models

3 CCR 702-10, Regulation 10-1-1

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 11 months, effective 15 October 2025.

An AI sector rules rule binding private bodies.

As of 23 September 2026.

What it requires

Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.
This duty reaches every insurer authorized to do business in Colorado that offers individually issued life insurance, private passenger automobile insurance, or a health benefit plan and uses an external consumer data and information source, or an ECDIS-based algorithm or predictive model, in any insurance practice.
If you do not use an external consumer data and information source or an ECDIS-based algorithm or predictive model, file a signed officer attestation to that effect with the Division instead.
File a compliance report with the Division on SERFF: annually by December 1 if you are a life insurer, and annually by July 1 if you are a private passenger automobile insurer or a health benefit plan insurer.
Make every component of your governance and risk management framework available to the Division on request.

If you get it wrong

Criminal exposureNo

Who enforces it

Enforcement body

Colorado Division of Insurance, under the Commissioner of Insurance

What it reaches

How the hook was established

express

What makes it apply

Operator establishment

Obligation class

Governance, DPIA, Reporting

What it makes you log

Who may demand the log

Regulator

What the log must hold

Decision basis

Logging duty

Section 5.A requires documented governing principles, a documented cross-functional governance group, and quantitative testing results showing whether the insurer's use of ECDIS, algorithms, or predictive models results in unfair discrimination with respect to race.

Kind: Explicit
As of: 23 September 2026
Provision: Regulation 10-1-1, Section 5.A.1 through 5.A.13
Trigger: automated_decisions

Who checks it

Audit expectation

periodic

Who audits it

Self, Regulator

Where the report goes

Filed with regulator, Produced on request

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

An insurer authorized to do business in Colorado that offers individually issued life insurance, private passenger automobile insurance, or a health benefit plan, and that uses an external consumer data and information source (ECDIS), or an algorithm or predictive model that uses one, in any insurance practice, must establish a documented, risk-based governance and risk management framework, including a cross-functional governance group, designed to determine through quantitative testing whether that use results in unfair discrimination with respect to race, and to remediate any discrimination detected.

An insurer that does not use ECDIS instead files a signed officer attestation. The Division of Insurance adopted the original version of this regulation for life insurers alone effective November 14, 2023, under the authority of C.R.S. 10-1-109 and 10-3-1104.9; this amended version, effective October 15, 2025, extends the same framework to private passenger automobile insurers and health benefit plan insurers, with a July 1, 2026 deadline for those two lines' first compliance report.

When LexLint raises it

high_risk_decisions
provides_financial_services

Read the law

Code of Colorado Regulations, 3 CCR 702-10, Regulation 10-1-1, Colorado Secretary of State

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app