If your underwriting or rating model takes in credit-derived attributes, telematics or any other external consumer data, Colorado puts the fairness attestation on your chief risk officer, and nothing your model vendor signs moves it. SB21-169 requires insurers to keep a risk management framework for external data and have their chief risk officer attest that it is implemented. So buy a testing capability you can run on your own book, keep the per-decision record in a system you control, and file the vendor's fairness report as diligence evidence.
Our pick for most carriers is SolasAI for the disparity testing, plus a governance and inventory layer such as Monitaur if you have more than a handful of models. If you have a strong actuarial or statistics team, the open-source BIRDiE estimator does the methodological part better than most commercial defaults and costs nothing to license. FairPlay is a credible choice if you already use it for lending. The option we would not take is the one most buyers default to: accepting the model vendor's own fairness report as your test.
| Option | What it actually does for you | Runs on your own book? | Public price (checked Oct 14, 2026) | Do not pick it if |
|---|---|---|---|---|
| SolasAI | Disparity measurement, driver analysis, alternative-model search, monitoring | Yes | None published; sales contact | You need a model inventory and exam workflow; it is a testing engine |
| Monitaur | Insurance model governance: inventory, controls, vendor governance, bias and drift monitoring, transaction search | Yes | None published; sales contact | You expect it to settle the race-inference method for you |
| FairPlay | Bias testing and model validation, lending-first, with an insurance input-proxy product | Yes | None published; sales contact | Your program is insurance-only and you want insurance-native exam artifacts |
| BIRDiE (open source) | Disparity estimation from BISG probabilities, correcting the bias BISG introduces | Yes | Free software; you pay in staff time | Nobody on staff can defend a Bayesian estimator to an examiner |
| Vendor's own fairness report | The model vendor's claim about its model, on its data | No | Bundled | You are the insurer. This is the loser. |
The workload we normalised to: a Colorado private passenger auto book, one vendor-built pricing model that uses telematics and a credit-based score, and an annual compliance report you have to stand behind. Every row above is judged on whether it helps you produce that report from your own policyholder data.
What Pulls a Model Into Colorado's Scope?
A model is in scope when it uses external consumer data and information sources (ECDIS), meaning data from outside the traditional underwriting file, such as credit-derived attributes, purchasing behaviour or telematics, used to supplement or replace traditional rating factors. SB21-169, signed July 6, 2021, bars insurers from using external data, algorithms or predictive models in a way that unfairly discriminates on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression.
The amended rule names telematics explicitly for auto, per Debevoise's summary of the adopted text. For health benefit plans, an individual's medical records are excluded from ECDIS, and a provider acting for the insurer must be ultimately responsible for prior-authorization denials informed by ECDIS models, per Willkie's client alert.
Scope turns on the input. A plain GLM fed a third-party shopping-behaviour score is in. A gradient-boosted model built only on traditional rating factors may not be. Inventory by data source first.
The Dates That Set Your Exposure
Life insurers have been covered since Regulation 10-1-1 took effect on November 14, 2023. The Division adopted the amendment extending it to private passenger auto and health benefit plans, effective October 15, 2025.
For auto and health insurers, a narrative progress report was due December 1, 2025. From July 1, 2026, every component of the governance framework must be available to the Division on request, and an annual compliance report is due that day and every year after. That report has to give the title and qualifications of each individual responsible for compliance and which requirements each one owns, per Willkie. Insurers that do not use ECDIS at all file an attestation instead, which Bulletin B-10.001 says must be signed by an officer and filed in SERFF by December 1.
Bulletin B-10.004 first waived the quantitative-testing description for the life reports due December 1, 2024 and December 1, 2025 only. The Division reissued it on June 10, 2026, and the waiver now covers life, auto and health reports until the testing rules are adopted, per ResourcePro's summary. The date to watch is the adoption of the testing rule itself.
The Testing Trap: Your Estimator Decides Your Answer
Colorado still has no adopted quantitative testing rule. Willkie noted in September 2025 that standards "remain under consideration," and the Division's June 10, 2026 reissue of B-10.004 still rested on the testing rules being unadopted, per ResourcePro. The amended regulation still requires you to remediate any unfair discrimination your testing finds and to document the testing you did.
The 2023 draft is the best guide to what the Division expects. Per Pinnacle Actuarial Resources' summary, it required race and ethnicity to be estimated with BIFSG, the RAND method that combines first name, surname and location. It then compared Hispanic, Black and Asian/Pacific Islander applicants with White applicants: a logistic regression on approvals, a linear regression on premium per $1,000, a 5% significance cut-off and a five-percentage-point materiality threshold. Exceed both and you test each external variable by adding a race term and comparing coefficients.
Insurers do not collect race, so every result runs through an inferred probability, and the choice of estimator can move the answer either way:
- Assign each person to their most likely race with a cutoff and you tend to overstate disparity, by an amount that depends on the threshold you pick, according to Chen, Kallus and colleagues.
- Weight by the BISG probabilities instead and the bias tends to run negative, pulling the disparity toward zero. McCartan, Imai and co-authors show this attenuation and propose BIRDiE, which uses surname as an instrument to correct it. In the authors' North Carolina voter-file validation of racial gaps in party registration, BISG combined with BIRDiE cut estimation error by up to 84%.
- Use the proxy as a regressor, which is exactly what the draft's variable-level test does, and the coefficients become mixtures of true group effects. A March 2026 paper by Xin, Hooker and Huang, built on linked North Carolina voter and ZIP-level auto premium data, found estimates tend to shrink toward the majority group, with errors that track neighbourhood composition and correlate with pricing residuals, so a proxy-based estimate can come out smaller or larger than one using self-reported race.
The practical consequence: a test that shows no disparity can be an artefact of attenuation, and a test that shows one can be an artefact of hard thresholds. An examiner who knows this literature will ask which estimator you used and why. "The vendor's default" is not an answer you want to give.
SolasAI: The Testing Engine to Shortlist First
SolasAI does the part of the job most likely to be wrong in a carrier's hands: measuring disparity, explaining which features drive it, and generating alternative models with documentation. Its own site describes Beacon for pre-production testing and Illumination for monitoring deployed models, and cites an anonymised multi-billion-dollar P&C insurer and a Fortune 100 health insurer among its clients. It lists SAS, R, Python and AWS among its technology partners, which matters if your actuaries work in SAS.
The alternative-model search is the reason to pick it. Colorado's draft had no less-discriminatory-alternative step among the three tests Troutman Pepper Locke summarised, but NY DFS Circular Letter No. 7 does: after a prima facie disparity, you look for a legitimate explanation and then a less discriminatory alternative. A tool that can produce that alternative is useful in both states.
Do not pick SolasAI as your governance system. It does not present itself as a model inventory, a control library or an exam workflow, and you will need all three. Its site does not say which race-inference method it uses by default. Ask, in writing.
Monitaur: The System of Record, If You Have Many Models
Monitaur is built for insurance governance rather than for statistics. Its insurance page pitches model filings, market conduct, ECDIS and multi-jurisdiction work, and lists vendor governance through "a centralized inventory and pre-mapped controls," bias and drift monitoring, and transaction search. Its home page shows Progressive, Unum, Clearcover and Hippo among its customers.
That inventory is what Colorado's version-control requirement and the NAIC bulletin's documentation lists ask for. A carrier running dozens of models across states gets the most from it.
Do not pick Monitaur expecting it to settle the race-inference question. Bias monitoring in a governance platform is only as good as the estimator underneath it, and you still own that choice. Smaller carriers with three or four ECDIS models may find a spreadsheet inventory plus a testing engine covers Colorado for less.
FairPlay: Strong on Lending, Thinner on Insurance
FairPlay's current site sells automated bias testing, less-discriminatory-alternative search, model validation with SR 11-7 documentation, and reports "aligned to ECOA/Reg B." Those are bank exam artefacts. It does serve insurers: it launched Input Intelligence, which checks whether input variables act as proxies for race or gender, with its insurance division led by a former Connecticut deputy insurance commissioner.
If your group writes both credit and insurance and already runs FairPlay for fair lending, extending it is sensible. Do not pick it if your program is insurance-only and you want artefacts built around Colorado and NAIC exams rather than translated from ECOA. Its outcome claims (5x faster time to production, 10% to 20% higher approval rates) are its own, and approval rate is a lending metric.
BIRDiE: The Best Estimator, If You Can Defend It
BIRDiE is open-source software from the McCartan and Imai group. It takes BISG probabilities as input and corrects the attenuation that probability-weighting introduces. For the narrow question "how large is the disparity, given that we never observed race," it is the most defensible method we found, and it costs nothing to license.
Zest AI's ZRP, Apache-2.0, is the other open-source option on the inference side. Its developers claim it identifies about 25% more African Americans correctly than BISG. It was trained on Florida, Georgia and North Carolina voter files, and its README calls it a preliminary version. Note that it replaces BISG for classification; it does not fix the downstream estimation bias the way BIRDiE does.
Do not pick the open-source route unless someone on staff can explain an instrumental-variable Bayesian estimator to an examiner and maintain the code. Name that owner before the method goes into a filed report.
Why the Vendor's Fairness Report Loses
The vendor's report tests the vendor's model on the vendor's data, with the vendor's choice of estimator, and its author signs nothing in Colorado. The CRO attestation in SB21-169 is yours. New York is blunter: insurers "may not rely solely on a third-party's claim of non-discrimination," and may not cite the proprietary nature of a vendor's algorithm to excuse vague adverse-action reasons, per Circular Letter No. 7.
Read the report and file it with your due diligence, then run your own test on your own Colorado book.
Why a Multi-State Book Faces Different Bars
The NAIC Model Bulletin, adopted December 4, 2023, is principles-based: a written AI program, governance, risk controls and third-party diligence, with no prescribed statistical test. The NAIC's implementation map counted 25 adopting jurisdictions as of April 1, 2026, with California, Colorado, New York and Texas on their own insurance-specific rules instead.
So the same model faces three bars. In bulletin states you need a documented program and diligence. In New York you need a three-step disparate-impact analysis with named metrics (adverse impact ratios, denial odds ratios, standardized mean differences) and specific adverse-action notices. In Colorado you need the framework, a remediation duty and an officer attestation, with the test method still open. Build to New York's analysis and Colorado's attestation and you will clear the bulletin states as a by-product.
What to Demand From the Model Vendor in Writing
The NAIC bulletin's third-party section asks insurers to get, where available, audit rights and a duty to cooperate with regulatory inquiries into contracts. Turn that into a schedule:
- A feature inventory with every ECDIS input flagged, its source and its refresh date.
- A model card and a version identifier returned with every scored decision.
- The vendor's own proxy analysis, with the estimator named and the reference group stated.
- Named support during a market-conduct examination, with a response time.
- Adverse-decision reason codes specific enough for a New York notice, which Circular Letter 7 says must identify the information and its source.
- Notice before any material model or data change, since New York's Circular Letter 7 expects testing after material changes.
The Record Set an Examiner Asks For
Section 4 of the NAIC bulletin says an insurer in a market-conduct action can expect requests for its model inventories, documentation of each model's development and use, third-party diligence records and data retention practices. Colorado adds an ECDIS inventory with version control, per Faegre Drinker.
To answer "why was this applicant rated this way in March," you need, per decision: the model version invoked, the rule versions that fired, each external data call with its timestamp and response, any human review or override, and retention metadata. If the vendor's API returns only a score, log the rest on your side at the moment of the call.
The Honest Omission: Who Pays for Remediation?
Your officer signs, and the vendor does not. We found no public market-conduct finding in which a model vendor's indemnity paid for an insurer's remediation, and no adopted Colorado test that defines what remediation requires. That leaves the contract question open: if your test finds a variable is a proxy, who pays to rebuild the model, refile rates and re-rate affected policyholders?
Ask that before signature. If a vendor will not commit to remediation support and cost-sharing in writing, budget the remediation as yours.
How to Decide
The criteria that predict regret:
- Can you re-run the test without the vendor? If not, you cannot answer an examiner's follow-up.
- Is the estimator named and defensible? BIFSG with a hard threshold and BISG probability-weighting give different answers. Pick deliberately and write down why.
- Does every decision carry a model version? Without it, your record set has a hole.
- Who owns remediation cost? Settle it in the contract.
What changes the answer: if Colorado adopts a testing rule that prescribes an estimator, use that one and the BIRDiE argument narrows to New York and internal use. If you run fewer than five ECDIS models, skip a governance platform and buy only the testing engine.
This Week: Ask your CRO's office which estimator your last life report described, or whether it described one at all.
This Month: Send the six-item vendor schedule above to every ECDIS model vendor and log who refuses.
Before December 1, 2026: Run one disparity test on your own Colorado book with two estimators, so you know how far apart they land before the report goes out.
The Bottom Line
The American Academy of Actuaries warned in 2023 that BIFSG results shift with implementation choices as basic as 2010 versus 2020 Census data, per Pinnacle. Colorado has made the attestation personal and left the method open. Run the test yourself, know which estimator you used, and get the vendor's remediation commitment on paper before your CRO signs.
Continue Reading
- NAIC's Draft AI Exam Lets Insurers Set Their Own Materiality Bar
- AI Hiring Bias Audits: DCI Wins When the Audit Must Use Your Data
- Colorado Gutted Its AI Law 46 Days Before Enforcement.
- Agent Audit Logging: Platform Logs Miss the Decision You Must Prove
- AI Vendor Exit Clauses: Standard Terms Give 0 to 90 Days to Get Out
- Best MLOps for Regulated AI: Domino, Then a Sign-Off Layer