Insurers' use of external consumer data and information sources, algorithms, and predictive models - unfair discrimination prohibited - rules - stakeholder process required - investigations - definitions - repeal
C.R.S. § 10-3-1104.9
in effect10-3-1104.9. Insurers' use of external consumer data and information sources, algorithms, and predictive models - unfair discrimination prohibited - rules - stakeholder process required - investigations - definitions - repeal. (1) In addition to the methods and practices prohibited pursuant to section 10-3-1104 (1)(f), an insurer shall not, with regard to any insurance practice:
(a) Unfairly discriminate based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression; or
(b) Pursuant to rules adopted by the commissioner, use any external consumer data and information sources, as well as any algorithms or predictive models that use external consumer data and information sources, in a way that unfairly discriminates based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression.
(2) (a) The commissioner shall adopt rules for the implementation of this section.
(b) The commissioner shall engage in a stakeholder process prior to the adoption of rules for any type of insurance that includes carriers, producers, consumer representatives, and other interested parties. The commissioner shall hold stakeholder meetings for stakeholders of different types of insurance to ensure sufficient opportunity to consider factors and processes relevant to each type of insurance. The commissioner shall provide notice of stakeholder meetings on the division website, and stakeholder meetings shall be open to the public.
(3) (a) After the stakeholder process described in subsection (2) of this section, the commissioner shall adopt rules for specific types of insurance, by insurance practice, which rules establish means by which an insurer may demonstrate, to the extent practicable, that it has tested whether its use of external consumer data and information sources, as well as algorithms or predictive models using external consumer data and information sources, unfairly discriminates based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression. The rules shall not become effective until January 1, 2023, at the earliest, for any type of insurance, and the commissioner shall consider solvency impacts, if any, to insurers in adopting the rules.
(b) Rules adopted pursuant to this section must require each insurer to:
(I) Provide information to the commissioner concerning the external consumer data and information sources used by the insurer in the development and implementation of algorithms and predictive models for a particular type of insurance and insurance practice;
(II) Provide an explanation of the manner in which the insurer uses external consumer data and information sources, as well as algorithms and predictive models using external consumer data and information sources, for the particular type of insurance and insurance practice;
(III) Establish and maintain a risk management framework or similar processes or procedures that are reasonably designed to determine, to the extent practicable, whether the insurer's use of external consumer data and information sources, as well as algorithms and predictive models using external consumer data and information sources, unfairly discriminates based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression;
(IV) Provide an assessment of the results of the risk management framework or similar processes or procedures and actions taken to minimize the risk of unfair discrimination, including ongoing monitoring; and
(V) Provide an attestation by one or more officers that the insurer has implemented the risk management framework or similar processes or procedures appropriately on a continuous basis.
on;
(IV) Provide an assessment of the results of the risk management framework or similar processes or procedures and actions taken to minimize the risk of unfair discrimination, including ongoing monitoring; and
(V) Provide an attestation by one or more officers that the insurer has implemented the risk management framework or similar processes or procedures appropriately on a continuous basis.
(c) The rules adopted by the commissioner pursuant to this section must include provisions establishing:
(I) A reasonable period of time for insurers to remedy any unfairly discriminatory impact in an algorithm or predictive model; and
(II) The ability of insurers to use external consumer data and information sources, as well as algorithms or predictive models using external consumer data and information sources, that have been previously assessed by the division and found not to be unfairly discriminatory.
(d) Documents, materials, and other information in the possession or control of the division that are obtained by, created by, or disclosed to the commissioner or any other person pursuant to this section or any rules adopted pursuant to this section are recognized as proprietary and containing trade secrets. All such documents, materials, and other information are confidential and privileged; are not subject to disclosure under the "Colorado Open Records Act", part 2 of article 72 of title 24, or other open records, freedom of information, sunshine, or similar law of this state; are not subject to subpoena; and are not subject to discovery or admissible in evidence in any private civil action. However, the commissioner may use the documents, materials, or other information in the furtherance of any regulatory or legal action brought as part of the commissioner's official duties. The commissioner shall not otherwise make the documents, materials, or other information public without the prior written consent of the insurer from which the documents, materials, or other information was obtained. The commissioner may make data publicly available in an aggregated or de-identified format in a manner deemed appropriate by the commissioner.
(4) Pursuant to section 10-3-1106, the commissioner may examine and investigate an insurer's use of an external consumer data and information source, algorithm, or predictive model in any insurance practice. Insurers shall cooperate with the commissioner and the division in any examination or investigation under this section.
(5) (a) In the report submitted by the department of regulatory agencies to the legislative committees of reference during the first two weeks of each regular legislative session, pursuant to part 2 of article 7 of title 2, the division shall include:
(I) Information concerning any rules adopted pursuant to this section;
(II) Information concerning any changes in insurance rates that have resulted from the prohibitions described in subsection (1) of this section;
(III) A summary of the stakeholder engagement process described in subsection (2)(b) of this section; and
(IV) A description of data sources, if any, discussed during the stakeholder engagement process, which data sources insurers may use to comply with this section.
(b) This subsection (5) is repealed, effective July 1, 2025.
(6) Notwithstanding any provision of this section to the contrary, this section does not apply to:
(a) Title insurance, as defined in section 10-11-102 (8);
(b) Bonds executed by qualified surety companies pursuant to part 3 of article 4 of this title 10; or
(c) Insurers issuing commercial insurance policies; except that this section does apply to insurers that issue business owners' policies or commercial general liability policies, which business owners' policies or commercial general liability policies have annual premiums of ten thousand dollars or less.
(7) Nothing in this section:
companies pursuant to part 3 of article 4 of this title 10; or
(c) Insurers issuing commercial insurance policies; except that this section does apply to insurers that issue business owners' policies or commercial general liability policies, which business owners' policies or commercial general liability policies have annual premiums of ten thousand dollars or less.
(7) Nothing in this section:
(a) Requires an insurer to collect from an applicant or policyholder the race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression of an individual; or
(b) May be construed to:
(I) Prohibit the use of, or require life, annuity, long-term care, or disability insurers to test, medical, family history, occupational, disability, or behavioral information related to a specific individual, which information, based on actuarially sound principles, has a direct relationship to mortality, morbidity, or longevity risk unless such information is otherwise included in the testing of an algorithm or predictive model that also uses external consumer data and information sources;
(II) Prohibit the use of, or require life, annuity, long-term care, or disability insurers to test, traditional underwriting factors being used for the exclusive purpose of determining insurable interest or eligibility for coverage unless such factors are otherwise included in the testing of an algorithm or predictive model that also uses external consumer data and information sources;
(III) Amend, modify, or supersede section 10-3-1104 (1)(f)(III) or (1)(f)(IV); or
(IV) Prohibit the use of or require the testing of longstanding and well-established common industry practices in settling claims or traditional underwriting practices unless such practices or factors are otherwise included in the testing of an algorithm or predictive model that also uses external consumer data and information sources.
(8) As used in this section, unless the context otherwise requires:
(a) "Algorithm" means a computational or machine learning process that informs human decision making in insurance practices.
(b) (I) "External consumer data and information source" means a data or an information source that is used by an insurer to supplement traditional underwriting or other insurance practices or to establish lifestyle indicators that are used in insurance practices. "External consumer data and information source" includes credit scores, social media habits, locations, purchasing habits, home ownership, educational attainment, occupation, licensures, civil judgments, and court records.
(II) The commissioner may promulgate rules to further define "external consumer data and information source" for particular lines of insurance and insurance practices.
(c) "Insurance practice" means marketing, underwriting, pricing, utilization management, reimbursement methodologies, and claims management in the transaction of insurance.
(d) "Predictive model" means a process of using mathematical and computational methods that examine current and historical data sets for underlying patterns and calculate the probability of an outcome.
(e) "Unfairly discriminate" and "unfair discrimination" include the use of one or more external consumer data and information sources, as well as algorithms or predictive models using external consumer data and information sources, that have a correlation to race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression, and that use results in a disproportionately negative outcome for such classification or classifications, which negative outcome exceeds the reasonable correlation to the underlying insurance practice, including losses and costs for underwriting.
Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-10.docx#10-3-1104.9Fetched: 10/6/2026