Law / United States / 
Colorado
Amended Regulation 10-1-1 (2025), Governance and Risk Management Framework for Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models
3 CCR 702-10, Regulation 10-1-1
In force since .
An AI sector rules rule binding private bodies.
- Criminal exposure
- No
- Enforcement body
- Colorado Division of Insurance, under the Commissioner of Insurance
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, DPIA, Reporting
- Audit expectation
- periodic
- Who audits it
- Self, Regulator
- Where the report goes
- Filed with regulator, Produced on request
What it requires
- Establish a documented, risk-based governance and risk management framework, including a cross-functional governance group drawing on legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, designed to determine through quantitative testing whether your use of an external consumer data and information source, or an algorithm or predictive model that uses one, results in unfair discrimination with respect to race, and to remediate any discrimination detected.NIST AI RMFGOVERN 1.4NIST AI RMFMEASURE 2.11
- This duty reaches every insurer authorized to do business in Colorado that offers individually issued life insurance, private passenger automobile insurance, or a health benefit plan and uses an external consumer data and information source, or an ECDIS-based algorithm or predictive model, in any insurance practice.
- If you do not use an external consumer data and information source or an ECDIS-based algorithm or predictive model, file with the Division instead an attestation, signed by an officer, to that effect within one month of the regulation's effective date and on December 1 every year after that.
- File a compliance report with the Division on SERFF: annually by December 1 if you are a life insurer, and annually by July 1 if you are a private passenger automobile insurer or a health benefit plan insurer.NIST AI RMFGOVERN 1.1
- Make every component of your governance and risk management framework available to the Division on request, as of December 1 each year if you are a life insurer and as of July 1 each year if you are a private passenger automobile or health benefit plan insurer.
- If you do not use an external consumer data and information source or an ECDIS-based algorithm or predictive model as of the effective date but later plan to, submit the compliance report described in Section 6.B to the Division before you start using one.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- GOVERN 1.4The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.
- MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-09Information Security
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- 1.1Board Structure & Oversight
- 1.2Risk Management
- 3.5Post-deployment Monitoring
- 4.1System Documentation
- 4.2Risk Disclosure
- 4.3Incident Reporting
1 more
- 4.5Third-Party System Access
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
Section 5.A requires documented governing principles, a documented cross-functional governance group, and quantitative testing results showing whether the insurer's use of ECDIS, algorithms, or predictive models results in unfair discrimination with respect to race.
- Kind
- Explicit
- As of
- Provision
- Regulation 10-1-1, Section 5.A.1 through 5.A.13
- Trigger
- automated_decisions
What this law does
An insurer authorized to do business in Colorado that offers individually issued life insurance, private passenger automobile insurance, or a health benefit plan, and that uses an external consumer data and information source (ECDIS), or an algorithm or predictive model that uses one, in any insurance practice, must establish a documented, risk-based governance and risk management framework, including a cross-functional governance group, designed to determine through quantitative testing whether that use results in unfair discrimination with respect to race, and to remediate any discrimination detected.
An insurer that does not use ECDIS instead files a signed officer attestation. The Division of Insurance adopted the original version of this regulation for life insurers alone effective , under the authority of C.R.S. 10-1-109 and 10-3-1104.9; this amended version, effective , extends the same framework to private passenger automobile insurers and health benefit plan insurers, with a deadline for those two lines' first compliance report.
When LexLint raises it
When your app profile says your app is an insurer.
Back to the example · Lint your app
Page updated .