In insurance, you have to prove the model is fair.

Insurance is where AI-fairness law is most mature — because insurers have priced risk with data and models for a century, and regulators know it. Two things now bind, and neither is waiting on a future AI Act: Colorado’s SB 21-169, which makes life insurers affirmatively prove their algorithms don’t proxy for race, and the NAIC Model Bulletin, adopted by more than half the states, which requires every insurer to govern and test its AI.

Colorado: the proof burden

SB 21-169, implemented through Regulation 10-1-1, has been in effect since November 14, 2023. Life insurers using external consumer data, algorithms, or predictive models must maintain a board-level governance and risk-management framework, test for and prevent unfair discrimination (disparate impact) against protected classes, and file an annual attestation each December 1. The crucial shift is the burden: an insurer can’t defend a neutral-looking model by pointing out it never used race as an input — it has to affirmatively demonstrate the outcomes don’t disproportionately harm protected groups once legitimate risk factors are accounted for. The detailed quantitative-testing rule stalled (the Division waived quantitative reporting for the 2024 and 2025 filings), but the governance duty and the attestation are live, and Colorado extended similar governance obligations toward auto and health insurers through 2025.

The NAIC bulletin: the national floor

The NAIC Model Bulletin on the Use of AI Systems by Insurers (adopted December 2023) has now been taken up by more than half the states — 24-plus jurisdictions and counting. It requires every insurer to maintain a written AI Systems (AIS) Program: a governance structure with clear accountability, risk management including validation and testing for discriminatory outcomes, third-party vendor oversight with contractual audit rights, documentation of data and development, and consumer transparency. It isn’t a statute — it’s regulatory guidance enforced through market-conduct examinations — but for a multi-state insurer it is effectively a national baseline.

Vendor accountability is the sharp edge

Both regimes put the liability on the insurer even when the model belongs to a vendor. “The vendor built it” is not a defense in Colorado, and the NAIC bulletin makes vendor due diligence and audit rights an explicit expectation. That turns model procurement into a compliance decision: your contracts need audit rights, your files need the vendor’s validation evidence, and your governance program has to treat a bought model exactly as if you built it.

The federal-preemption wrinkle

In December 2025 the federal government stood up a task force to challenge state AI laws — but the McCarran-Ferguson Act shields state insurance regulation from federal preemption absent an act of Congress. That makes these insurance rules among the most durable AI laws on the books: they’re unlikely to be swept away by the federal preemption push that clouds other state AI statutes.

If you want to see where AI accountability law is going, look at insurance, where it already arrived. The duty isn’t to avoid using models — it’s to govern them, test them, and be able to prove they’re fair, including the ones you bought.

This briefing is general information from Sentinel Assurance Group, not legal advice. Regulatory dates and requirements change — we maintain these briefings, but verify against primary sources and counsel before acting. Last reviewed July 22, 2026.

See how a Gap Assessment maps your exposure →