Colorado Artificial Intelligence Act for Insurance

Key obligations

• documentation→ developerC.R.S. § 6-1-1702

  On and after January 1, 2027, make available to each deployer of a covered automated decision-making technology (ADMT), in a form understandable to the deployer and protective of trade secrets, a statement of the system's intended and known harmful or inappropriate uses, the categories of data (including personal data) used to train it, its known limitations and risks, instructions for appropriate use, monitoring, and meaningful human review, and the information the deployer needs to satisfy its disclosure duties under § 6-1-1704; developers must also notify deployers of material updates and retain compliance records for at least three years.

  Deadline: From January 1, 2027

• disclosure→ deployerC.R.S. § 6-1-1704(1)–(2)

  Before using a covered ADMT to materially influence a consequential decision, provide a clear and conspicuous notice to the consumer that automated decision-making technology is or will be used in a consequential decision affecting them, with instructions for obtaining further information; a prominent public notice kept reasonably accessible at points of consumer interaction satisfies this requirement.

  Deadline: Before decision

• disclosure→ deployerC.R.S. § 6-1-1704(3)

  When a covered ADMT materially influences a consequential decision that results in an adverse outcome, provide the consumer, within 30 days of the decision, a plain-language description of the decision and the role the ADMT played, a simple process to request additional information (the system's name, version, developer, and the types, categories, and sources of personal data used), and an explanation of the consumer's correction and human-review rights under § 6-1-1705.

  Deadline: Within 30 days of adverse outcome

• consumer right→ deployerC.R.S. § 6-1-1705(1)

  On request from a consumer who experiences an adverse outcome, provide instructions to access and correct factually incorrect or materially inaccurate personal data used in the consequential decision (consistent with C.R.S. § 6-1-1306) and an opportunity for meaningful human review and reconsideration of the decision to the extent commercially reasonable; correction is not required for opinions, predictions, scores, or protected evaluations.

  Deadline: On consumer request

• governance→ deployerC.R.S. § 6-1-1703

  Retain, for at least three years after a consequential decision, the records reasonably necessary to demonstrate compliance with Part 17 of article 1 of title 6 — including covered-ADMT version identifiers, changelogs, and documentation of material mitigation changes.

  Deadline: Retain 3 years

Recommended next steps

1. Inventory AI systems used in insurance workflows that may fall within Colorado Artificial Intelligence Act's scope.
2. Map each system against the obligations above and identify the responsible role (developer vs deployer).
3. Adopt a structured framework — see NIST AI RMF and ISO/IEC 42001 — to demonstrate due care and produce audit-ready evidence.
4. Document obligations satisfied and gaps in a single register, refreshed at the cadence required by the law (typically annual).

Frequently asked questions