On February 17, like an orchestra conductor, Colorado Division of Insurance (Colorado DOI) Commissioner Michael Conway directed the first of many stakeholder engagement meetings as part of Colorado Senate Bill 21-169's (as codified in Colorado Statutes section 10-3-1104.9) required rulemaking process. Recognizing that the different insurance practices and lines of insurance are like different sections of an orchestra, the conductor opted to first fine-tune the underwriting practices in life insurance. As we have previously discussed, section 10-3-1104.9 prohibits insurers from using external consumer data and information sources, and algorithms and predictive models based on such data, in a way that unfairly discriminates based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression ("protected status").

The Colorado DOI explained that it selected life insurance underwriting practices for its first concert because this insurance practice is already subject to requirements in the consideration of the use of class. Thus, Colorado DOI believed fine-tuning underwriting practices, particularly with respect to discrimination based on race, would strike a chord as information on race is most readily available or could be required to be collected. Moreover, the Colorado DOI noted that it believed pricing may be less favorable for certain segments of the population due to the use of education, occupation, and access to health care as data points. It also noted that research has found bias and substantial error rates exist in the use of facial recognition involving people of color.

Below is a score of observations from the first stakeholder meeting:

1. Section 10-3-1104.9 is intended to impose a duty on insurers to self-regulate their use of external consumer information, algorithms, and predictive models in recognition that the Colorado DOI does not have the resources or expertise to do so. As part of this "self-regulation" insurers must:
   • Report their use of external data along with algorithms and predictive models.
   • Establish and maintain a risk management framework reasonably designed to determine, to the extent practicable, whether the insurer's use of external data along with algorithms and predictive models unfairly discriminates against a protected status. As part of this, insurers must conduct stress testing on their use of external data within the algorithms or predictive models in an effort to determine whether discrimination is occurring. Insurers will be required to make periodic reports and attestations to the Colorado DOI as to their use of external data, algorithms, and predictive models and the results of their stress testing.

2. The required reports and attestations will be used by the Colorado DOI to identify problems, harmony across insurance practices and lines of insurance, and areas for market conduct exam reports.
3. The reporting is not intended to be a "gotcha," and the Colorado DOI will allow insurers to remedy any use of external information and algorithms or predictive models that may have a discriminatory impact.
4. The Colorado DOI hopes to learn from insurers that are already doing stress testing.
5. The Colorado DOI understands that a key part of the work to be completed during the stakeholder meetings is to define many of the terms used in section 10-3-1104.9. This includes further defining the term "external consumer data."
6. The Colorado DOI cautioned that while it may find or deem that a particular use of external consumer information and algorithms or predictive models is non-discriminatory, any change to the algorithm or predictive model may result in dissonance and a different finding by the Colorado DOI.

In addition to ensuring that the use of external consumer data, algorithms, or predictive models is non-discriminatory, the Colorado DOI is concerned about consumer understanding. Consumers must understand what data points are being used and how those data points impact them. In underwriting, this means how the data impacts their cost of insurance. Consumers must also understand how to correct erroneous data.

While any rulemaking is not permitted to become effective until January 1, 2023, the Colorado DOI noted that it does not view this date as a hard deadline by which rulemaking must be completed. The Colorado DOI recognized that it is at the forefront and desires to be thoughtful and thorough. To do so, the Colorado DOI anticipates holding stakeholder meetings every 4 to 6 weeks. It also encouraged stakeholders to reach out directly to the Colorado DOI to provide comments.

While the Colorado DOI may be the leading maestro in the effort to regulate insurers' use of consumer data and algorithms, the following states have picked up their batons:

• Indiana: H.B. 1238 adds a new section, 27-2-21-9.5, imposing new requirements on insurers that use external consumer data to supplement traditional underwriting. If enacted, insurers using external consumer data would be required to identify the five most heavily weighted or primary factors used in calculating a premium upon the consumer's request or if the insurer takes an adverse action based on external consumer data.
• Oklahoma: H.B. 3186, which is based on Colorado S.B. 21-169.
• Rhode Island: H.B. 7230, which is based on Colorado S.B. 21-169.

Additionally, New Jersey Assembly Bill 5651 requires annual reporting by automobile insurers using an automated or predictive underwriting system to demonstrate that there is no discriminatory outcome in the pricing of insurance and directs the commissioner of banking and insurance to adopt rules and regulations. Perhaps New Jersey viewed automobile insurers like the string section of an orchestra - where the foundation for algorithmic underwriting principles is set. Once satisfied that the potential for discriminatory automobile insurance underwriting has been addressed, it follows that New Jersey would move to work on other parts of the orchestra - i.e., other lines of insurance, potentially life insurance.

We will continue to participate in Colorado's stakeholder process and monitor state legislative and regulatory activity seeking to impose requirements with respect to insurers' use of external consumer data, information sources, and algorithms.