AI in Insurance: State Regulations Insurers Must Follow in 2026

The insurance industry is one of the most heavily regulated AI use cases in the United States, and the regulatory environment has tightened significantly since 2024. Carriers face two distinct compliance layers: insurance-specific AI governance requirements enacted by state insurance regulators, and general-purpose AI laws like Colorado's SB 205 that include insurance decisions as a category of consequential decisions (Colorado deems insurers subject to its insurance-specific AI statute to be in compliance).

Colorado: Two Parallel Frameworks

Colorado is the most consequential state for insurance AI regulation, operating two distinct but related frameworks that apply simultaneously to carriers writing business in Colorado.

Framework 1: C.R.S. §10-3-1104.9 (Insurance-Specific AI Regulation)

Colorado's insurance-specific AI statute, C.R.S. §10-3-1104.9, predates the general AI Act by several years. It prohibits insurers from using external consumer data sources, external data analytics, algorithms, or predictive models that result in unfair discrimination based on protected characteristics—even when the model or data source is facially neutral. The core requirement is quantitative testing for disparate impact across protected classes, including cases where the model does not explicitly use a protected characteristic as an input.

Critical expansion effective October 15, 2025: The Division of Insurance expanded §10-3-1104.9's scope to cover private passenger automobile insurance and health benefit plans, in addition to life insurance (the original scope). Auto and health carriers writing in Colorado who have not yet implemented quantitative disparate impact testing are currently out of compliance—this is not a future-effective obligation. It is in effect now.

Framework 2: Colorado SB 26-189 (Applies January 1, 2027)

Colorado's original AI Act (SB 24-205) treats insurance decisions as consequential decisions but deems an insurer subject to §10-3-1104.9 and the Commissioner’s rules under it to be in full compliance. Its duties became operative June 30, 2026 and run until SB 26-189, signed May 14, 2026, repeals and replaces it effective January 1, 2027; under an April 27, 2026 stipulated court order in X. AI LLC v. Weiser, the Attorney General may not start enforcement of SB 24-205 or 2026 replacement legislation for violations through 14 days after the court rules on xAI’s planned preliminary-injunction motion. From January 1, 2027, SB 26-189 covers automated decision-making technology that materially influences consequential decisions, including insurance coverage, premium, and claims decisions. Insurers and affiliated entities subject to §10-3-1104.9 are in compliance with SB 26-189 in the practice of insurance (employment uses are still covered); an insurer not deemed in compliance must give SB 26-189’s adverse-outcome disclosures, to the extent applicable. Otherwise, a deployer must:

• Provide clear pre-use notice before covered automated decision-making technology is used in a coverage or claims decision
• Within 30 days of an adverse outcome (claim denials, premium surcharges), provide a plain-language explanation of the decision and the technology’s role
• Let consumers correct inaccurate personal data and request meaningful human review
• Retain records for three years

The Colorado Attorney General enforces SB 26-189 under the Colorado Consumer Protection Act; there is no private right of action.

What Insurers Must Do in Colorado

New York: Auto Insurance AI Legislation

New York's legislature has advanced several bills targeting AI use in auto insurance underwriting and claims, including proposals requiring disclosure when AI is used in underwriting decisions, legislation requiring insurers to explain AI-based premium determinations to applicants, and proposals to prohibit certain data types as AI model inputs in underwriting. As of October 2026, specific New York insurance AI bills remain pending. Track current status on our New York AI law page.

NAIC Model Bulletin on AI

The National Association of Insurance Commissioners (NAIC) adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in 2023. Key elements include requirements to inventory AI systems, implement governance and risk management programs, conduct testing for bias and discrimination, and maintain third-party vendor oversight. The NAIC bulletin is not legally binding in itself, but adoption by state insurance commissioners creates enforceable obligations. Carriers should track which states have formally adopted NAIC AI guidance through their departments of insurance.

Specific High-Risk AI Use Cases in Insurance

Underwriting AI

AI systems that score applicants, determine eligibility, or set premiums are the most clearly covered category under both Colorado frameworks and NAIC guidance. Third-party predictive models, telematics data, credit-based insurance scoring, and property imagery analysis should all be reviewed for disparate impact compliance.

Claims AI

AI systems used to detect fraud, assess claim severity, or automate payment decisions fall within insurance as a consequential-decision domain under Colorado SB 26-189 from January 1, 2027. Consumers can request meaningful human review of adverse claims decisions materially influenced by automated decision-making technology.

Customer-Facing AI

Customer-facing AI systems that help policyholders understand coverage, file claims, or evaluate options trigger disclosure obligations under California AB 2905 (for companion-style interactions) and Colorado SB 26-189's pre-use notice requirement (from January 1, 2027).

Documentation as Compliance Asset

Under both Colorado frameworks, documentation is a core compliance asset. The compliance record a carrier builds—AI inventories, disparate impact test results, governance policies, vendor documentation—is what the carrier presents if enforcement is initiated. For carriers that have not yet started building this record, SB 26-189's January 1, 2027 start date is the next hard stop in Colorado.

For state-by-state insurance AI compliance requirements, visit our AI in insurance regulations page and the Colorado and New York state pages.

This article is for informational purposes only and does not constitute legal advice. Insurance regulatory matters require advice from qualified insurance counsel admitted in your state(s) of operation.