Skip to content
AI Policy Generator

ESWhat applies

Insurance pricing or underwriting in United States (federal): related rules

Models that calculate premiums, accept or decline risks or adjust coverage based on personal data. For life and health insurance it is high-risk in the EU, and several US regulators require governance and discrimination testing.

Risk classification

JurisdictionLevelDateNote
ColoradoSector rules—SB 21-169 and its life insurance regulation: governance framework and discrimination testing when using external data and algorithms.
ColoradoConsequential decisionJanuary 1, 2027SB 26-189: insurance is a consequential decision.
New York (incl. NYC)Sector rules—NYDFS Circular Letter No. 7 (2024) on AI and external data in underwriting and pricing (supervisory guidance).

Obligations related to this use case

Adverse action notice based on third-party reports

FCRA15 U.S.C. § 1681m(a); § 1681b(b)(3)In force

Already applicable

When it relates
Applies if your credit, insurance or rental decisions rely in whole or part on reports or scores bought from a consumer reporting agency. In hiring it applies only if you use background checks or other third-party reports; the assessment does not assume it just because you use AI in hiring.
What the rule provides
  • Identify the reporting company and state that it did not make the decision.
  • Explain the right to a free copy within 60 days and to dispute inaccurate data.
  • In employment, send a pre-adverse action notice with a copy of the report before the final decision.
  • If a credit score was used, disclose it with its key factors.
Typical evidence
  • Pre-adverse and final adverse action templates
  • Contract with the reporting vendor
Verification
Verified in the official source on November 4, 2026Checked on govinfo: 15 U.S.C. § 1681m(a)(1)-(4) (notice, agency identity, statement that it did not make the decision, free copy and right to dispute) and § 1681b(b)(3) (employment: copy of the report and summary of rights before the adverse action).

Clear consumer notice of ADMT use

Colorado SB 26-189SB 26-189 (C.R.S. 6-1-17xx), obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies if you use ADMT that materially influences decisions on employment, housing, health care, education, lending or insurance for Colorado consumers.
What the rule provides
  • Give a clear and conspicuous notice at the point of interaction that ADMT is used.
Typical evidence
  • Published notice and screenshots of interaction points
Verification
Verified in the official source on November 2, 2026Signing, dates and obligations checked on leg.colorado.gov on Nov 2, 2026. Exact content will depend on the Attorney General's rules, still pending.

Explanation within 30 days after an adverse decision

Colorado SB 26-189SB 26-189, obligaciones del deployerAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Within 30 days of an adverse outcome, explain in plain language the decision and the role of ADMT.
  • Explain how to request information about the system, its data and the rights of correction and review.
Typical evidence
  • Explanation template and delivery log
Verification
Verified in the official source on November 2, 202630-day period checked on leg.colorado.gov; details subject to Attorney General rules.

Data correction and human review

Colorado SB 26-189SB 26-189, derechos del consumidorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to ADMT deployers in consequential decisions about Colorado consumers.
What the rule provides
  • Let consumers access their personal data and correct inaccurate data.
  • Offer meaningful human review and reconsideration after an adverse outcome, by a trained person with authority to change it.
Typical evidence
  • Review procedure and log of requests and outcomes
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Developer technical documentation for deployers

Colorado SB 26-189SB 26-189, obligaciones del desarrolladorAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to those who develop or sell ADMT used in consequential decisions about Colorado consumers. Selling an AI product is not enough: in the assessment, select the type of decision your product supports.
What the rule provides
  • Give each deployer documentation on intended uses, training data categories, known limitations and instructions for use and human review.
  • Notify deployers of material updates.
Typical evidence
  • Delivered technical documentation and version log
Related base documents
Verification
Verified in the official source on November 2, 2026Checked on leg.colorado.gov.

Keep compliance records for three years

Colorado SB 26-189SB 26-189, conservación de registrosAdopted, applies later

Applies from January 1, 2027

When it relates
Applies to developers and deployers covered by the law.
What the rule provides
  • Keep records showing compliance for at least three years, with version identifiers.
Typical evidence
  • Decision log and system version log
Related base documents
Verification
Verified in the official source on November 2, 2026Three-year period checked on leg.colorado.gov.

Related base documents

Related kits

Includes 7 documents

Credit and Insurance Kit

Model risk with inventory and materiality, adverse-decision explanation letters, human review, a decision log, technical model documentation and the EU AI Act Art. 26 checklist for high-risk systems.

USD 139USD 253

Complete kit · available to buy

Find out what applies to you (free)United States (federal)