AI regulation in insurance: Colorado, the NAIC bulletin and New York

There is no single federal law on how life insurers may use artificial intelligence. The rules come from state insurance regulators: Colorado has a regulation aimed specifically at life insurers' use of algorithms and outside data, the National Association of Insurance Commissioners (NAIC) adopted a model bulletin in December 2023 that a growing number of states have issued, and New York's Department of Financial Services issued a circular letter in July 2024. All of them work through existing anti-discrimination and unfair practices laws rather than banning AI.

Status as of October 4, 2026. This area is changing quickly; check your state insurance department for its current position.

Why regulators care

Modern underwriting can use more than your application and exam. Insurers and vendors may draw on prescription histories, credit-based or consumer-marketing data, motor vehicle records, and predictive models that score the data. Used well, this can speed up approval (see accelerated underwriting: approval without an exam and AI and data in life insurance underwriting). The concern is that a model can use data that stands in for a protected characteristic such as race, producing "unfair discrimination" that no person intended and that is hard to see from outside. Insurance law has long barred unfair discrimination; the new rules explain how insurers must show they are guarding against it when the decision is made by software.

Colorado

Colorado was first. Senate Bill 21-169, signed July 6, 2021, directs the Division of Insurance to ensure insurers do not use external consumer data and information sources (ECDIS), algorithms or predictive models in ways that unfairly discriminate based on protected classes. The Division's Regulation 10-1-1 (3 CCR 702-10) applies that to life insurers: they must keep a governance and risk management framework for their use of these tools, and remediate unfair discrimination if they find it. The life regulation took effect November 14, 2023.

According to law-firm summaries of the Division's 2025 amendment, Regulation 10-1-1 was extended to private passenger auto and health benefit plan insurers, with compliance and an annual compliance report due by July 1, 2026. The amended text is posted by the Colorado Division of Insurance.

Colorado's separate general AI statute is a different law from the insurance regulation. Senate Bill 24-205 (2024) was delayed to June 30, 2026, then repealed and re-enacted by Senate Bill 26-189, signed May 14, 2026. According to the Colorado General Assembly's bill page, the new law centers on notice and explanation when "automated decision-making technology" is used in consequential decisions, including insurance, with core duties starting January 1, 2027, and it exempts specified entities to the extent they comply with other legal obligations. How that exemption applies to insurers regulated under Regulation 10-1-1 is a point to confirm with the Division or counsel; do not assume either way.

The NAIC model bulletin

On December 4, 2023, the NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers. A bulletin is guidance, not a statute, and each state decides whether to issue it. In substance it tells insurers that existing laws, such as unfair trade practices and unfair discrimination rules, apply to AI, and that they should maintain a written program for the responsible use of AI systems. That program covers governance, risk management, internal controls, and oversight of third-party vendors and data suppliers, and insurers must be ready to answer regulators' questions about it.

Adoption is uneven. A law-firm tracker (Quarles) listed 24 jurisdictions, including the District of Columbia, that had issued the bulletin as of March 2025, among them Alaska, Illinois, Pennsylvania, Virginia and Washington. Trade press in 2026 has reported more, but this guide cannot confirm a current count; the NAIC publishes an adoption map. For how the NAIC writes model rules, see The NAIC and how insurance rules are written.

New York

New York Department of Financial Services Insurance Circular Letter No. 7 (July 11, 2024) addresses AI systems and ECDIS in underwriting and pricing, and covers life insurers authorized in the state. Per the circular letter, insurers:

• remain responsible for unfair discrimination even when a vendor built the tool;
• should assess whether outside data correlates with protected classes, and test before use and regularly afterward;
• should have board and senior management oversight, written policies and vendor contract audit rights;
• should tell applicants when AI or ECDIS is used and give specific reasons, including data sources, for an adverse decision.

What this means if you apply for coverage

A circular letter or model bulletin does not give you a lawsuit-ready right to review an algorithm. It does shape what you can ask for.

1. If you are declined or rated up, ask the insurer in writing for the specific reasons and the data sources used. New York guidance expects this; other states' insurance information privacy laws may also give you access and correction rights (see privacy and your life insurance data: who sees it and your rights).
2. Request your MIB file and prescription history report if the decision seems to rest on them (how insurers check your prescription history), and dispute errors.
3. Ask whether a human underwriter reviewed the decision, and whether you can apply through full underwriting instead.
4. If you believe the decision was discriminatory, file a complaint with your state insurance department; how to file a complaint against a life insurer explains the process.

Limits of the current rules

These measures mostly require insurers to build governance and be able to show their work. They do not guarantee that any one model is accurate, and the thresholds, testing methods and enforcement vary by state. Companies that operate nationally often build one program to satisfy the strictest state. Expect more state action; do not treat any pending proposal as law until it is enacted.

Key takeaways

• No federal AI-in-insurance law exists; state regulators apply anti-discrimination and unfair practices rules through regulations, bulletins and circular letters.
• Colorado's Regulation 10-1-1 has applied to life insurers since November 14, 2023; New York's Circular Letter No. 7 followed on July 11, 2024; the NAIC model bulletin dates from December 4, 2023 and is adopted state by state.
• Colorado's general AI law was repealed and replaced in May 2026 by SB 26-189, with core duties starting January 1, 2027.
• If a model-driven decision goes against you, ask for specific reasons and data sources, check your MIB and prescription reports, and use your state insurance department.