NAIC AI Model Bulletin vs Colorado SB21-169 Testing Requirements

Scope: what each regime covers

The NAIC Model Bulletin was adopted on December 4, 2023 and aligns with the NAIC Principles of Artificial Intelligence adopted in 2020. It applies to decisions or actions made or supported by advanced analytical and computational technologies, including AI systems, and it expects an AIS Program to address every lifecycle phase: design, development, validation, implementation, use, ongoing monitoring, updating and retirement. A model bulletin has effect only as states adopt it. As of August 2025, 24 states had adopted it, so a multi-state insurer should track each state's own bulletin and its identifiers and dates.

Colorado's scope is narrower in subject and more specific in method. SB21-169 addresses the use of external consumer data and information sources (ECDIS), and algorithms and predictive models that use them, in insurance practices that unfairly discriminate on protected characteristics. These include race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity and gender expression. The implementing regulation, 3 CCR 702-10, took effect November 13, 2023 and first covered life insurers. Amendments effective October 15, 2025 extend it to auto and health insurers as well. This status is as of October 2026. Colorado SB 24-205 is a separate law and is not covered here.

Side-by-side comparison

The table summarizes how the two regimes differ on the dimensions that shape a testing program and its records.

• Subject of testing: NAIC: AI systems and predictive models across the lifecycle, including errors, performance issues, outliers and unfair discrimination. Colorado: ECDIS, and algorithms and models using ECDIS, tested for unfairly discriminatory outcomes.
• Testing frequency: NAIC: validating, testing and retesting "as necessary", with no fixed interval. Colorado: documented ongoing monitoring of model performance, including drift.
• Validation method: NAIC: flexible, such as comparing unseen development data with post-implementation performance, or expert review. Colorado: testing for unfair discrimination within a risk management framework.
• Governance: NAIC: governance across the AI lifecycle. Colorado: documented roles and responsibilities for design, development, testing, deployment, use and monitoring.
• Third parties: NAIC: confirm obligations against the full bulletin text. Colorado: a documented process for selecting third-party models and third-party ECDIS, algorithm or model vendors.
• Documentation: NAIC: records of validation, testing and auditing, which a Department may request in an investigation or examination. Colorado: an inventory with version control of all algorithms and models, their purpose and outputs.

Testing and frequency: where Colorado is more prescriptive

The two regimes overlap on the core idea that insurers should detect and address unfair discrimination, validate models before relying on them, and keep records. The NAIC bulletin describes processes for designing, developing, verifying, deploying, using, updating and monitoring predictive models. It refers to reproducibility, traceability, model drift and auditability of measurements "where appropriate." It lets the insurer choose how to validate.

Colorado converts parts of that into named program elements. Carriers test ECDIS and the models that use it for unfairly discriminatory outcomes and establish a risk management framework. They maintain a versioned inventory that records each model's purpose and outputs. They document ongoing monitoring, including drift, and they document who is responsible for each stage from design through monitoring. Where the NAIC bulletin leaves the schedule to the insurer, Colorado asks for records that show the work was assigned, performed and monitored.

The practical consequence is that a program built only to the NAIC's flexibility may lack the specific artifacts Colorado expects. A program built to Colorado's elements will generally satisfy the NAIC's documentation expectations for the same models, though state-by-state variation still needs tracking.

Separating scheduled testing from production-time controls

Pre-deployment validation, unfair discrimination testing and periodic retesting are performed by the insurer's own model validation and testing processes. They produce results, test designs and approvals. No runtime control substitutes for them, and runtime controls should never be described as bias testing.

Other expectations are continuing rather than periodic. Ongoing monitoring, drift records, documented roles and examination-ready documentation depend on records that exist because systems operated in production. A Department that asks what an AI system did, and whether people were involved, is asking about operation as well as design.

A workable split is to keep two calendars. The first holds validation, testing and retesting, with insurer-defined triggers such as model updates, new data sources or new lines of business. The second holds continuing monitoring, drift review and the retention of production records. Each testing result should reference the inventory entry and model version it applies to, so the two calendars connect.

Where runtime policy enforcement fits

Trussed does not perform model testing, bias evaluation or red-teaming. Its role is narrower and sits beside the insurer's validation function. Trussed enforces policy in the execution path across models, agents, tools and MCP servers, with actions to allow, redact, block, rate limit or escalate for human approval at the level of individual interactions and tool calls. Enforcement is at runtime, not reviewed after the fact.

That enforcement produces audit-ready evidence mapped to NAIC expectations, showing what AI systems were permitted to do and what happened in production. Such records can support the bulletin's documentation and auditability expectations and the continuing records Colorado documents around monitoring and roles. This is a mapping judgment, not a stated regulatory requirement. Compliance teams still map the same evidence to Colorado's regulation elements themselves. Trussed deploys self-managed in the customer cloud, with configurable retention and data residency, which matters when examination records must be retrievable on the insurer's own terms.