NAIC AI Model Bulletin vs Colorado SB 26-189: Which Rules Apply?

Legal status: guidance versus statute

The NAIC describes its AI Model Bulletin as not a model law or regulation. It is a guiding document intended to bring uniformity to what state insurance regulators expect of carriers deploying AI. The NAIC membership adopted it at the 2023 Fall National Meeting, in December 2023. It has no force in a state until that state issues its own bulletin or takes its own action.

The NAIC adoption map lists 18 jurisdictions with bulletins based on the model: AK, AR, CT, DE, DC, IL, IA, KY, MD, MA, MI, NV, NH, NJ, NC, OK, RI and VT. The map itself says it does not determine whether a state's action contains all elements of the model. A state's bulletin can therefore differ from the model text, and each one needs to be read on its own.

Colorado SB 26-189 is a statute. It was signed in May 2026 and repeals and reenacts the SB 24-205 provisions with new requirements on ADMT in consequential decisions. The Colorado Attorney General describes SB 24-205 as the law that created protections against algorithmic discrimination in consequential decisions made by high-risk AI systems. Those earlier requirements, including the disclosure timelines in that act, are superseded. Any program built around SB 24-205 needs to be rechecked against the new law.

Side-by-side comparison

The table summarizes the differences that matter most for applicability. It does not replace a reading of each state's bulletin or of the enrolled Colorado text.

• Legal form: NAIC: model guidance, not a model law or regulation. Colorado: enacted statute.
• How it takes effect: NAIC: only through a state's own bulletin or action. Colorado: through the statute itself.
• Activity addressed: NAIC: decisions or actions impacting consumers that are made or supported by AI Systems. Colorado: consequential decisions made with covered ADMT.
• Core expectation: NAIC: a governance program, including oversight of Predictive Models, designed to mitigate the risk of Adverse Consumer Outcomes. Colorado: duties on deployers, including a plain-language explanation after an adverse decision.
• Enforcement: NAIC: indirect, through existing insurance laws such as unfair trade practices and unfair discrimination. Colorado: Attorney General enforcement through the Colorado Consumer Protection Act, with a violation deemed a deceptive trade practice.
• Regulator evidence: NAIC: documentation the Department may request in an investigation or examination. Colorado: records supporting the statutory duties, with Attorney General rulemaking in progress.

Mapping scope to your AI use cases

The two instruments draw their boundaries differently, so the same AI system can be inside one and outside the other. The bulletin is organized around the insurer and its use of AI Systems in decisions or actions that affect consumers. It reminds insurers holding certificates of authority that these decisions must comply with all applicable insurance laws, including unfair trade practices and unfair discrimination laws. SB 26-189 is organized around covered ADMT and consequential decisions, and its duties attach to the deployer.

In practice, this means building an inventory at the use-case level rather than the system level. For each use case, record the state or states where it operates, whether it supports a consumer-impacting insurance decision, and whether it could amount to a consequential decision made with covered ADMT. Then record your role for that use case, such as deployer. The last two questions turn on the statutory definitions, which is where counsel's reading matters. This page is not legal advice.

Expect the answers to vary. A carrier may have a claims triage model that falls within bulletin expectations in an adopting state and also raises a Colorado question, while an internal productivity assistant raises neither. Treat Colorado separately from the NAIC map, and treat each adopting state's bulletin as its own document.

Which obligations need runtime enforcement and evidence

Both instruments mix organizational duties with duties that depend on what an AI system actually does. Separating them tells you where a document will do and where you need controls and records.

The bulletin's governance program, accountability structure, and policies are largely organizational and documentary. Other listed elements are closer to system behavior. These include oversight of Predictive Models, with measurements, standards or thresholds used in development, validation and oversight, and the protection of non-public information, including against unauthorized access to the models themselves. Because the bulletin tells insurers what the Department may request in an examination, the practical question is whether evidence exists per AI system and per decision.

SB 26-189 has an output-level duty. After a covered ADMT makes a consequential decision with an adverse outcome, the deployer must give the consumer a plain-language description of the ADMT's role within 30 days. It is reasonable to infer that this requires a record linking each decision to the ADMT used and its role. The exact content of the description should be read from the statute.

Trussed enforces policy in the execution path for models, agents, tools and MCP servers, using allow, redact and block actions on individual interactions and tool calls. It produces audit-ready evidence from that enforcement, mapped to NAIC. That is relevant to the bulletin's non-public information protection and to evidence of what AI was permitted to do. It does not replace a governance program or the policies and accountability the bulletin expects, and no Colorado-specific mapping is claimed.

Tradeoffs and open decisions

Building to the strictest instrument in every state is simple to explain but can over-apply controls to low-impact use cases. Building per state and per use case is more precise but needs a maintained matrix and clear ownership. Most multi-state carriers will end up with a common baseline of governance documentation and decision-level evidence, plus state-specific additions.

Two points deserve ongoing attention. First, adopting states may change or extend their bulletins, and the NAIC map does not itemize pending action. Second, Colorado rulemaking may add detail to SB 26-189. Plan for the matrix to be revisited as either changes, and confirm applicability with counsel before relying on any summary, including this one.