AI Fairness / Algorithmic Bias Rules (State DOI) — Regulatory Reference

Colorado Regulation 10-1-1 requires life insurers to maintain a documented algorithm and predictive model governance framework, including model risk management procedures and bias testing. California DOI Bulletin 2022-5 requires insurers to demonstrate that AI systems used in underwriting do not result in unfair discrimination or disparate impact against protected classes. Both frameworks demand that each AI-driven decision be traceable and that the insurer can produce evidence of ongoing bias monitoring. Insurers using AI agents — whether for data retrieval, scoring, or decision support — must capture per-decision audit records sufficient to support quantitative disparate impact analysis on demand.

Colorado Reg 10-1-1 applies to any life insurer licensed in Colorado that uses an algorithm or predictive model in a decision that could affect policyholder outcomes — including underwriting, rating, and claims. California Bulletin 2022-5 applies broadly to insurers using AI or ML in California for rating, underwriting, or claims handling. Both frameworks are triggered when an AI agent accesses data that informs any such decision. If an agent queries customer records, medical data, credit proxies, or external data sources as part of an underwriting workflow, the governance and audit obligations apply to that agent's behavior.

Under state fair lending and insurance non-discrimination principles — reinforced by the California and Colorado guidance — insurers must be able to explain adverse decisions to applicants. When AI is involved, this means the insurer must reconstruct which data the agent accessed, which model scored the request, and what policy governed the decision at the moment it was made. A generic log that captures only the final outcome is not sufficient. The adverse action notice must be supportable by a complete decision trail, which requires that every agent access event be recorded with the data source, sensitivity level, governing policy version, and outcome classification at the time of the decision.

AutoPIL maps directly to the three compliance obligations these frameworks impose. The agent registry and policy YAML provide the documented governance framework Colorado and California require — each agent is registered, bound to a named policy, and the policy is version-controlled so no decision is retroactively reinterpreted. The tamper-evident audit chain records every data access event before sensitive data enters the agent's context window, with the governing policy version stamped on each record — this is the per-decision evidence needed for quantitative disparate impact testing. Access history by source and agent supports adverse action notice reconstruction. AutoPIL ships pre-built policies `INS-AIFAIR-CO-001` and `INS-AIFAIR-CA-001` for these frameworks.

Regulators in Colorado and California have signaled examination readiness on AI fairness. An insurer that cannot produce a documented governance framework, bias testing results, or per-decision audit records for AI-assisted underwriting faces examination findings, market conduct action, and potential cease-and-desist orders on affected products. California's DOI has authority to require rate or form withdrawals where unfair discrimination is alleged and the insurer cannot refute it with data. Beyond direct regulatory action, failure to document adverse action notice support exposes insurers to civil claims under state unfair insurance practices statutes. The evidentiary bar is: can you show, for any specific decision, exactly what data the AI accessed and which policy governed it?