NAIC AI Model Bulletin vs Colorado HB 1139 for Health Insurers

What is actually being compared

The NAIC Model Bulletin on the Use of AI Systems by Insurers and Colorado HB26-1139 do not sit in the same legal category, so a line-by-line equivalence will mislead. A model bulletin is a template. Its force in any given state depends on whether and how that state's insurance department adopts it. A bill is a legislative instrument whose obligations, effective dates and enforcement depend on its enacted text.

Colorado HB26-1139 is titled Use of Artificial Intelligence in Health Care and appears in the 2026 Regular Session. Colorado also has other AI-related instruments, including SB24-205, Consumer Protections for Artificial Intelligence, and SB26-189, Automated Decision-Making Technology. Bill numbers also repeat across sessions, so HB 1139 in one year is a different bill from HB 1139 in another. A compliance team should record exactly which instrument it is mapping, and its status as of October 2026, before assigning obligations to it.

For a health insurer, the useful question is not which regime is stricter. It is which expectations apply to which AI uses, who enforces them, and what proof each enforcer would ask for.

Side-by-side comparison dimensions

Apply the same six tests to each instrument and record the answer separately. Where the answers match, one control and one evidence artifact can serve both. Where they differ, document the difference rather than assuming the stricter reading covers the other.

• Legal nature: Is the instrument guidance, a regulation or a statute? Who adopted it, and where does it bind your entities? Evidence: a dated applicability memo per state.
• Scope: Which carriers, lines of business and payers are covered, and which are excluded? Evidence: a legal-entity and product map tied to each instrument.
• Covered AI uses: Does it reach utilization management, claims, underwriting, member-facing tools or only specific services? Evidence: an inventory of AI uses tagged by decision type.
• Governance and documentation: What written program, risk management, testing and recordkeeping is expected? Evidence: policies, test records and approvals tied to specific deployments.
• Third-party AI and data: What due diligence, contract terms, audit rights and record access apply to vendors? Evidence: vendor files plus records of what data each vendor system received.
• Regulator examination: Who examines, what can they request, and what penalties follow? Evidence: a retrieval process that can reproduce records for a specific interaction.

Paper obligations versus runtime obligations

Most compliance programs are strong on paper. They hold a written AI program, a risk framework, vendor questionnaires and committee minutes. These artifacts show intent and structure. They do not show what an AI system did when a specific utilization review, claim or underwriting request passed through it.

An examiner reviewing a consequential decision is likely to move from the policy to the instance. Which model or tool handled the request? Which policy applied? Was protected health information exposed to a vendor? Did a person review the output before it affected a member? Documents written before deployment cannot answer these questions. Only records created at the moment of execution can.

This is the practical split. Governance documentation defines what the AI is allowed to do. Runtime evidence shows that the definition was enforced. A program that has only the first can describe its controls but cannot demonstrate them.

Scoping Colorado before mapping it

A bill titled Use of Artificial Intelligence in Health Care signals a health care focus, but the obligations that fall on a carrier come from the enacted text, not the title. Read HB26-1139 for its covered persons, its covered AI uses, its effective dates and its enforcement provisions. Then read the Colorado instruments with different titles on the same terms.

A practical sequence is to build a Colorado applicability table with one row per instrument. For each row, record the status as of October 2026, the entities and AI uses in scope, and the duties placed on carriers. Cross-reference each duty to a control and an evidence artifact. Duties that exist in only one instrument get their own rows. Do not collapse them into a general Colorado requirement.

The same discipline applies to the NAIC bulletin. Because it is adopted state by state, maintain a per-state record of adoption and form instead of a single national assumption.

How execution-path enforcement produces evidence

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. For each interaction or tool call, it can allow, redact, block, rate limit or escalate for human approval. Because the decision is enforced at runtime rather than reviewed after the fact, each enforcement action also produces audit-ready evidence. That evidence is mapped to HIPAA, NAIC, NYDFS, the EU AI Act and NIST, including the HIPAA 164.312(b) audit controls. Trussed runs in production with healthcare organizations and deploys self-managed in the customer's cloud, with configurable retention and data residency.

This addresses the runtime half of the problem. It does not replace the written program, the risk assessment, vendor due diligence or legal analysis of which instrument applies. It does not satisfy the NAIC bulletin or any Colorado requirement on its own. It gives the compliance team interaction-level records to set beside those documents.