Law / United States / 
Colorado
SB 21-169 (2021), Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models
In force since .
An AI sector rules rule binding private bodies.
- Enforcement body
- Colorado Commissioner of Insurance and the Division of Insurance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not unfairly discriminate based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression, in any insurance practice.NIST AI RMFMEASURE 2.11
- Where the Commissioner of Insurance has adopted implementing rules for your type of insurance and practice, do not use an external consumer data and information source, or an algorithm or predictive model that uses one, in a way that unfairly discriminates on those same grounds.NIST AI RMFMEASURE 2.11
- Cooperate with the Commissioner and the Division of Insurance in any examination or investigation of your use of an external consumer data and information source, algorithm, or predictive model.NIST AI RMFGOVERN 1.1
- This duty does not reach title insurance, a surety bond, or most commercial insurance policies; it does reach a business owners' policy or a commercial general liability policy with an annual premium of ten thousand dollars or less.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are documented.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Subsection (4) lets the Commissioner examine and investigate an insurer's use of an external consumer data and information source, algorithm or predictive model in any insurance practice and requires insurers to cooperate. The Act names no log or record and states no retention period; an insurer asked to explain its use of a model in an examination can do so only from what it kept. Subsection (3)(b) directs the Commissioner to adopt rules that will require each insurer to provide information on the data sources used, an explanation of the use, a risk management framework, an assessment of its results including ongoing monitoring, and an officer attestation; the Act itself states none of those as an insurer duty.
- Kind
- Implicit
- As of
- Provision
- C.R.S. 10-3-1104.9(4), as enacted by SB 21-169
- Trigger
- automated_decisions
Why the legislator wanted it
Section 1(2)(b), the legislative declaration.
- As of
- Quote
- (b) After notice and rule-making by the commissioner of insurance, require insurers that use external consumer data and information sources, algorithms, and predictive models to control for, or otherwise demonstrate that such use does not result in, unfair discrimination.
- Source link
- https://leg.colorado.gov/sites/default/files/2021a_169_signed.pdf
- Source kind
- Recital
- Purpose
- accountability_demonstration
What this law does
An insurer may not unfairly discriminate based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression in any insurance practice, and, once the Commissioner of Insurance adopts implementing rules for a type of insurance, may not use an external consumer data and information source (ECDIS), or an algorithm or predictive model that uses one, in a way that has that same discriminatory effect.
The duty does not reach title insurance, a surety bond, or most commercial insurance policies, though it does reach a business owners' or commercial general liability policy carrying an annual premium of ten thousand dollars or less. The Commissioner's implementing rules for a given insurance type are Division of Insurance Regulation 10-1-1 (3 CCR 702-10), held as its own instrument in this topic.
When LexLint raises it
When your app profile says your app is an insurer.
Back to the example · Lint your app
Page updated .