The Genesis of AI Regulation in Colorado

July 6, 2021: Senate Bill 21-169 (SB21-169) Becomes Law

Colorado's journey into AI regulation began with the signing of Senate Bill 21-169 (SB21-169) into law on July 6, 2021. This bill was designed to protect consumers from insurance practices that result in unfair discrimination based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression. Insurers were mandated to demonstrate to the Colorado Division of Insurance (DOI) how they are testing their data and tools to ensure they do not result in unfair discrimination. The legislation also directed the insurance commissioner to collaborate with stakeholders before adopting rules on how insurers should test and demonstrate that their use of big data is not unfairly discriminating against consumers.

Implementing AI Insurance Regulations

November 14, 2023: Colorado DOI Adopts Specific AI Insurance Regulations

On November 14, 2023, the Colorado DOI implemented AI insurance regulations, making it the first state to adopt regulations specifically targeting insurance algorithms. Life insurance companies were required to report how they review AI models and use External Consumer Data and Information Sources (ECDIS), including nontraditional data such as social media posts, shopping habits, and biometric data. Additionally, life insurance companies had to develop a governance and risk management framework that includes thirteen specific components.

Proposed Reporting Regulation

Draft Proposal for ECDIS and AI Models

The Colorado DOI also proposed a separate reporting regulation for insurers using ECDIS and/or AI models that utilize ECDIS. The draft proposal would require testing using Bayesian Improved First Name Surname Geocoding (BIFSG), a statistical modeling methodology to help identify potential racial and ethnic incongruities among their datasets. The reporting date for the 12-month period ending December 31, 2023, was set for April 1, 2024, though the draft regulation did not have a proposed effective date at the time.

Connecticut Follows Suit

Connecticut's Bulletin No. MC-25

Connecticut also took steps to regulate AI in the insurance industry. The Connecticut Insurance Department (CID) Commissioner released a bulletin addressing the use of AI systems by insurers licensed to do business in the state. Bulletin No. MC-25 set forth guidelines for insurers’ governance of the development, acquisition, and use of certain AI technologies and systems. Connecticut domestic insurers were required to complete the Artificial Intelligence Certification by September 1, 2024, and annually thereafter.

International Perspectives

Germany's Approach to AI and Big Data in Insurance

Internationally, Germany’s Federal Financial Supervisory Authority issued guidance on the use of AI and big data in insurance, focusing on standards such as data credibility and output explainability. The German government also provided information on its plans for AI and employee protection, indicating that AI systems designed for employment and personnel management fall into the high-risk category. The German government endorsed a risk-based approach to AI regulation and advocated for the inclusion in the AI Act clarifying the possibility of national regulations.

The Current Legislative Effort in Colorado

Senate Bill 24-205 (SB24-205)

The current bill being proposed in Colorado concerning AI insurance regulation is Senate Bill 24-205 (SB24-205). Senate Majority Leader Robert Rodriguez, the bill's sole sponsor, emphasized its intent to establish a foundation for accountability in AI usage, stating, "This bill isn’t about changing the world right now. It’s always been about providing a framework for accountability, for biases and discrimination and just making sure that people know when they’re interacting with it".

Legislative Process and Business Community Response

SB24-205 passed its first legislative hurdle, clearing the Senate Judiciary Committee with a vote of 3-2 along party lines. However, it had not yet been debated in the whole Senate, with the legislative session in Colorado ending on May 8, leaving a narrow window for further action. Critics from the business and technology community, like Kyle Shannon, CEO and founder of Denver-based Storyvine, argued that the regulations could stifle innovation and potentially drive companies out of the state. Shannon noted, "The technology is literally changing on a weekly basis... And I know that overregulating AI right now is going to put Colorado businesses at a significant disadvantage". In response, several groups, including representatives from the Colorado Attorney General’s Office, ACLU, Colorado Technology Association, and the Governor’s Office of Information Technology, have requested amendments to the bill.

Conclusion

This ongoing legislative effort reflects Colorado's proactive stance in regulating AI, particularly in how it intersects with consumer rights and business operations. The state's approach aims to balance innovation with consumer protection, setting a potential model for other states considering similar regulations. As AI technology continues to evolve and integrate more deeply into critical sectors, both state and international bodies are recognizing the need for stringent regulations to manage the risks associated with AI applications, aiming to balance innovation with consumer protection and ethical considerations.