Colorado SB26-189 ADMT Framework: Insurance Compliance Guide

Defining ADMT Scope for Insurance Operations

Statutes structured around automated decision-making technology typically target systems that materially influence or determine an outcome affecting a consumer without meaningful human involvement in the final decision. Applied to insurance, that framing raises questions about algorithmic underwriting scores, automated pricing and rating engines, claims triage and adjudication tools, and fraud detection scoring models. Colorado's specific statutory language, its thresholds for what counts as a covered decision, and any exemptions applicable to licensed insurers require direct confirmation against the enacted bill text and any interpretive guidance issued by the Colorado Division of Insurance. Compliance leaders should treat internal scoping work as provisional until legal counsel confirms those specifics, but the absence of final regulatory interpretation is not a reason to delay the underlying inventory and documentation work described below.

Insurance Systems Likely to Warrant ADMT Review

Four categories of insurance decisioning commonly draw scrutiny under ADMT-style frameworks and should be catalogued regardless of final statutory scope. Underwriting models that generate risk scores or accept/decline recommendations sit at the center of this review, since they directly shape whether and on what terms a consumer obtains coverage. Pricing and rating engines that adjust premiums based on modeled risk factors raise similar questions, particularly where inputs are derived from third-party data or machine learning models rather than filed rating manuals alone. Claims adjudication and triage tools, including systems that route, prioritize, or recommend settlement outcomes, warrant review because they affect the timing and value of a benefit a consumer receives. Fraud detection scoring models round out the list, since a flag generated by an automated system can materially affect how a claim is handled even when a human ultimately signs off. Vendor-supplied tools used in any of these functions should be included in the inventory, not just internally built models.

Human Review and Contestability

ADMT-style requirements generally distinguish between decisions that are fully automated and decisions where a human reviewer has genuine authority and sufficient information to change the outcome. Insurance operations often already include human touchpoints, such as underwriter sign-off or claims adjuster review, but compliance teams need to document whether that review is substantive or functions as a pass-through of an automated recommendation. This distinction typically determines whether a workflow is treated as automated for regulatory purposes. Contestability obligations, where applicable, generally require that a consumer be able to request an explanation of an automated decision and seek reconsideration. Insurers should map existing appeal and reconsideration processes for underwriting declines, pricing disputes, and claims denials against this expectation to identify where current procedures fall short of a documented, timely review pathway.

Auditability: What Regulators Will Expect to See

Regardless of the final procedural detail in SB26-189 or its implementing guidance, auditable AI governance generally requires the ability to reconstruct a specific decision after the fact: which model or ruleset produced it, what inputs it considered, what score or recommendation it generated, and whether a human reviewer intervened. For insurers running AI-assisted underwriting, pricing, or claims models in production, building this record manually across multiple systems and vendors is difficult to sustain at scale. Runtime governance tooling, such as Trussed AI's runtime monitoring and audit logging capabilities, can capture this decision-level trail automatically for AI agents and models operating in these pipelines, providing a consistent record without requiring changes to the underlying underwriting or claims logic. This is one implementation mechanism among several, and it does not substitute for the underlying documentation and human review processes described above.

Closing Common Compliance Gaps

• Begin the system inventory now rather than waiting for final statutory interpretation, since the underlying documentation work is unlikely to change materially
• Precisely distinguish automated decisions from genuinely human-reviewed ones, documenting reviewer authority rather than assuming existing sign-off satisfies the distinction
• Centralize impact assessment and audit documentation in one system of record rather than distributing it across underwriting, claims, and vendor management teams
• Test the contestability and appeal workflow end to end to confirm it produces a documented, timely response
• Engage legal counsel early to confirm SB26-189's specific thresholds, effective dates, and any insurance-specific exemptions before finalizing internal policy language
• Monitor Colorado Division of Insurance guidance for interpretive bulletins that may clarify how existing insurance regulatory frameworks intersect with ADMT obligations