What Regulation 10-1-1 Requires
Regulation 10-1-1 (3 CCR 702-10) was adopted by the Colorado Division of Insurance to implement SB21-169, which prohibits insurers from using external consumer data, algorithms, or predictive models in a way that unfairly discriminates on the basis of protected characteristics such as race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression. The regulation translates that statutory prohibition into an operational requirement: life insurers must establish a governance and risk management framework (RMF) covering their use of external consumer data and information sources (ECDIS), algorithms, and predictive models in underwriting.
The RMF is not a one-time filing. It is expected to function as an ongoing control structure, meaning testing, documentation, and oversight need to persist as models and data sources change, not just at initial rollout.
Data and Systems in Scope
The regulation’s scope covers ECDIS, algorithms, and predictive models used specifically in underwriting and related rating decisions for life insurance. ECDIS includes external data sources brought into underwriting workflows that are not directly collected from the applicant. This scope extends beyond the outputs of a model to the inputs themselves, which means insurers need to trace data lineage from the original source, through any scoring or predictive model, to the final underwriting decision.
Vendor-developed and third-party predictive models used in underwriting also fall within scope. Insurers cannot treat a purchased or licensed model as outside the RMF simply because it was not built internally. Sufficient documentation must be obtained from vendors to support the insurer’s own testing and attestation obligations, since the regulatory responsibility sits with the insurer regardless of who developed the model.
Quantitative Testing Process
Regulation 10-1-1 requires quantitative testing to identify unfair discrimination in underwriting outcomes tied to ECDIS, algorithms, and predictive models. Because insurers generally do not collect applicants’ race directly, initial testing is scoped to race using an accepted imputation methodology. The Division has referenced Bayesian Improved First Name Surname Geocoding (BIFSG) for imputing race and ethnicity to support required testing.
Testing should be defined in a documented protocol that covers methodology, cadence, decision thresholds, and remediation triggers. As data sources and models change, testing is expected to operate as a periodic control rather than a single point-in-time validation.
Build documentation so it can extend if testing requirements expand beyond race to additional protected classes covered under SB21-169.
Documentation, Recordkeeping, and Attestation
Insurers subject to Regulation 10-1-1 must submit periodic attestations or reports to the Commissioner describing their RMF, governance structure, and testing results. This places a practical burden on compliance teams to translate technical testing output into a reporting format the Division can review, and to retain records sufficient to withstand examination of testing methodology, data sources, and any remediation actions taken.
Governance accountability should be defined at the senior management or board level, not limited to the technical teams running the tests, since the RMF is a governance obligation as much as a technical one.