AI and data in life insurance underwriting

Insurers increasingly use algorithms and outside data to decide who can skip the medical exam and at what price. Regulators have responded with rules rather than bans. Colorado's SB21-169 and Regulation 10-1-1 require life insurers using external consumer data to govern it and test it for unfair discrimination. The National Association of Insurance Commissioners (NAIC) adopted a model bulletin on AI in December 2023, and a growing number of states have adopted it. New York has its own circular letter.

How data and models enter underwriting

Traditional underwriting relied on the application, an exam and labs, and medical records. Many insurers now add automated steps, covered more fully in accelerated underwriting: approval without an exam:

• Database checks: MIB codes, prescription histories, motor vehicle records and public records (see The MIB report: what insurers know about your history and how insurers check your prescription history).
• Predictive models: an algorithm uses those inputs to estimate relative mortality and decide whether to approve instantly, request more evidence, or route the file to a person.
• Other external data: some insurers or vendors use consumer or credit-based attributes in scores; see do life insurers check your credit?.
• Newer sources: some programs use data from wearables or electronic health records, with the applicant's consent (see wearables and wellness programs in life insurance).

Supporters point to faster decisions and less invasive testing, as discussed in jobs in life insurance: hiring, layoffs and automation and life insurance startups and what they changed. The concerns are that models can be hard to explain, can be trained on data that carries historical bias, and can use proxies for protected traits. The rules below respond to that.

Colorado: SB21-169 and Regulation 10-1-1

Colorado enacted Senate Bill 21-169 in 2021, codified at C.R.S. § 10-3-1104.9. It prohibits insurers from using external consumer data and information sources (ECDIS), and algorithms or predictive models that use them, in ways that unfairly discriminate based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression (Colorado Division of Insurance).

The Division of Insurance implemented the law for life insurers first, with Regulation 10-1-1 (3 CCR 702-10), "Governance and Risk Management Framework Requirements for Life Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models." According to a Willkie Farr & Gallagher summary of the adopted rule:

• It became effective on November 14, 2023, and all required governance components had to be available on request by December 1, 2024.
• ECDIS is defined broadly to include credit scores, social media habits, locations, purchasing habits, educational attainment, court records, consumer-generated Internet of Things data, biometric data, and risk scores derived from them.
• Insurers must have board oversight, written policies, a model inventory, vendor-selection processes, a documented description of testing for unfair discrimination, and an annual review.
• Insurers remain responsible for third-party vendors' data and models.

The Division later issued guidance on quantitative testing for life insurers (Bulletin B-10.004, October 2024, according to published reports) and, per law-firm reporting, amended the regulation effective October 15, 2025 to extend similar governance requirements to private passenger auto and health benefit plan insurers. Check the Division's site for the current text and bulletins.

The NAIC model bulletin

The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023 (law-firm reports date it December 4). A bulletin is not a statute: each state's insurance department decides whether to issue it. It reminds insurers that decisions made or supported by AI must comply with existing law, such as unfair trade practice and unfair discrimination rules, and it expects insurers to maintain a written AI Systems program covering governance, risk management, internal audit, and oversight of third-party data and systems. It also tells insurers that regulators may ask for documentation during exams.

States began adopting it in 2024; early adopters included Alaska, Connecticut, Illinois, Nevada, New Hampshire, Pennsylvania, Vermont and Washington, according to law-firm tallies. Trade-press counts as of mid-2026 put the number of adopting states at roughly two dozen, with others in process. The NAIC publishes an adoption map; check it and your state's insurance department for current status. See AI regulation in insurance: Colorado, the NAIC bulletin and New York for the wider picture.

New York

The New York Department of Financial Services issued Insurance Circular Letter No. 7 on July 11, 2024, on the use of AI systems and external consumer data in underwriting and pricing. It expects insurers not to use such data or systems unless they can show through an assessment that the guidelines are not unfairly or unlawfully discriminatory, and it expects disclosure to applicants that such systems or vendor data are used (NY DFS). See New York for state basics.

What this means for you

1. You may not be told a model was involved. In most states there is no blanket rule requiring it, though New York expects disclosure.
2. Adverse decisions still have notice rights. If a consumer report contributed to a decline or higher price, the Fair Credit Reporting Act's notice and dispute rights apply (see how life insurance underwriting works).
3. Ask for a human review. If an automated process declines you or sets a high rate, ask the agent whether an underwriter can review the file and what evidence would help. A fully underwritten application with an exam can sometimes produce a better class.
4. Check the records the model used. Errors in prescription, MIB or driving records feed the model, so request your reports.
5. Complain if you suspect unfair treatment. Your state insurance department takes complaints; see how to file a complaint against a life insurer.

A hypothetical walk-through

Say a 33-year-old applies online for a term policy. The insurer pulls her prescription history and MIB record, a model scores the file, and she receives an instant offer without an exam. A different applicant with a hospital record gets routed to a human underwriter who requests medical records and takes weeks. The same insurer served both, using different paths. Under Colorado's rule, if the insurer used external data models, it would have to show it governs and tests them for unfair discrimination. The scenario is illustrative.

Key takeaways

• Insurers use databases, scores and predictive models to speed up underwriting, and some include external consumer data.
• Colorado's Regulation 10-1-1, effective November 14, 2023, was the first binding governance rule for life insurers using this data.
• The NAIC's December 2023 model bulletin is guidance that individual states adopt; about two dozen had by mid-2026.
• New York's July 2024 circular letter adds testing and disclosure expectations.
• You keep your FCRA rights, and you can ask for review, request your reports, and complain to your state regulator.