How Colorado is Regulating Insurtech with SB21-169

The use of algorithms and artificial intelligence (AI) in the insurance sector has received widespread attention from policymakers recently due to the risks that the technology poses when it goes unchecked or is used without appropriate safeguards.

Indeed, although algorithms can be used to streamline claims processes and rapidly issue quotes, a number of vendors have come under fire for their algorithms. Examples include State Farm, whose algorithms reportedly make the claims process more difficult and lengthier for black policy holders, and Cigna, who have been accused of relying on algorithms to mass reject claims.

Seeking to prevent unfair discrimination in insurance practices through the use of customer data or algorithms, Colorado’s Senate Bill 21-169 was enacted in 2021, with the provision that it would become effective from 1 January 2023 at the earliest. It is currently in the consultation stage.  

The law was first proposed in March 2021 and passed in June 2021, giving Colorado’s Commissioner on insurance, Michael Conway, at least a year and a half to develop rules for different types of insurance and insurance practices in collaboration with relevant stakeholders during the consultation process.

Rules are still being developed for auto insurance

Since being enacted, the consultation process has focused on underwriting practices in private passenger auto insurance as well as life insurance.  

The first stakeholder meeting on auto insurance was held in April 2023. A subsequent session was held in June 2023, where the use of educational attainment, job title, prior insurance, credit history, and sex or gender in generating quotes were examined. The session highlighted concerning disparities that can occur when such sensitive attributes are used as features in algorithms, with the premium for male drivers $58 lower than the same premium for female drivers. A third consultation on auto insurance is scheduled to take place on 24 August 2023, but proposed rules for underwriting practices in insurance processes have not yet been developed.

Rules have been drafted for life and health insurance

The consultation process for the underwriting of life and health insurance is at a more advanced stage, having kicked off in February 2022. Seven stakeholder meetings have been held since then, with the most recent on 8 June 2023 reviewing the Life Insurance Governance and Risk Management Draft Regulation. The Draft sets out requirements for life insurers to establish a risk-based governance and risk management framework to support policies, procedures and systems to determine whether the use of external customer data or predictive models could result in unfair discrimination. Any such framework is required to be overseen by the insurer’s board of directors or other appropriate board committee, while responsibility and accountability would lie with senior management.

Furthermore, the framework should establish written policies and processes for the design, development, testing, deployment, use, selection, and oversight of vendors and ongoing monitoring of the use of customer data and algorithms to ensure that they are documented, tested, and validated appropriately.

Other framework requirements include processes for dealing with customer complaints, a rubric for assessing and prioritising risks, an up-to-date inventory of customer data and algorithms used along with documentation of changes to the inventory, documentation of testing for unfair discrimination and ongoing monitoring, and documentation of the processes used to select vendors.

The framework also sets out reporting requirements, with insurers using external customer data and algorithms mandated to submit a report to the Division of Insurance summarising the progress made towards compliance and areas still under development six months after the regulation is in effect. They must also submit an annual report summarising compliance and the individuals responsible for each specific requirement, as well as a plan for corrective action if the requirements are not met. Insurers that do not use external customer data or algorithms must declare this to the Division within one month of the regulation coming into effect, or if insurers start using external data and algorithms once the regulation is in effect, they must submit a report to the Division before using external customer data and information sources and algorithms/predictive models.

Ongoing consultation process

With multiple types of insurance still yet to be covered in the consultation process and with other insurance practices – claims evaluation, for example – yet to be addressed in auto and life-health insurance stage, the Commissioner still has some way to go before insurance practices using external data and information sources and algorithms/predictive models are fully regulated in Colorado.

The consultation process is likely to be lengthy, particularly with the nuances between these different types of insurance. However, from the Draft rules for health and life insurance, it’s clear that the Commissioner means business.

Early preparation is key to compliance with regulatory requirements – this is not an overnight process. To find out how Holistic AI can help align your organisation with evolving standards, schedule a call with our expert team.