By Michael Branson

Quick answer. As of September 2026, Colorado Regulation 10-1-1, as amended, requires private passenger automobile and health benefit plan insurers that use external consumer data and information sources (ECDIS), or algorithms and predictive models that use ECDIS, to keep a fourteen-component governance and risk management framework available on request and to submit a compliance report to the Colorado Division of Insurance, both due next on July 1, 2027, according to the Division’s Amended Regulation 10-1-1. Most of the framework’s documentation components map onto capability already in a Microsoft estate: the Azure Machine Learning model registry and model monitoring for algorithm and predictive-model inventory, version control and drift, Microsoft Purview for the underlying data-source inventory and the evidence trail, and Microsoft Fabric or Power BI for lineage, audit and access-restricted reporting, though none of it is configured to the regulation’s specifics by default. The third-party vendor selection-and-oversight duty in Sections 5.A.13 and 5.B is a documented process the insurer runs itself; the tenant can help document that record and restrict who sees it, but no Microsoft product vets a vendor’s ECDIS, algorithm or predictive-model governance, and this page names criteria, never a product.

The inventory your data-science team can produce today probably lists the models. The question Regulation 10-1-1 asks is narrower and harder: whether that inventory carries version control, whether drift monitoring reaches a record compliance can read, and whether anyone wrote down how the third-party data and model suppliers were chosen. The Colorado Division of Insurance set the first auto and health date on July 1, 2026, and its Amended Regulation 10-1-1 repeats the duty “annually thereafter,” so the next report and the next availability-on-request date both fall on July 1, 2027. This guide sets out what the regulation says, which parts a Microsoft estate already covers, what still has to be built or written down, and the order to do it in.

What Colorado Regulation 10-1-1 covers, who it binds, and what counts as ECDIS

The first decision is whether the book of business in front of you is one the regulation names, and that decision belongs to counsel and the Division, not to this page. What the text itself says is set out below, from the Division’s Amended Regulation 10-1-1. Section 2 states its purpose: “This regulation establishes the governance and risk management requirements for insurers authorized to do business in Colorado and offering individual life insurance, private passenger automobile insurance, and/or health benefit plans that use external consumer data and information sources (ECDIS), as well as algorithms and predictive models that use ECDIS, in any insurance practice.” Section 3 applies it to insurers authorized to do business in Colorado that offer three lines: individually issued life insurance, private passenger automobile insurance, and health benefit plans. The July 1, 2027 date this guide is built around binds the second and third of those lines; life insurers run their own cycle, which began on December 1, 2024.

Section 4 of the regulation defines ECDIS, for auto and health insurers, as a data or information source the insurer uses to supplement or supplant traditional underwriting factors or other insurance practices, or to establish lifestyle indicators used in insurance practices. Its examples include credit scores, social media habits, locations, purchasing habits, home ownership, educational attainment, licensures, civil judgments, court records, consumer-generated Internet of Things data (including telematics data for auto insurers), biometric data, and insurance risk scores derived from those sources. One condition matters for health plans, in the regulation’s own words: “For health benefit plan insurers, ECDIS does not include an individual’s medical records.” The regulation defines “algorithm” and “predictive model” by cross-reference to section 10-3-1104.9 of the Colorado Revised Statutes rather than in its own text, so read those definitions at the statute, with counsel. The amended regulation took effect on October 15, 2025; the original version took effect on November 14, 2023.

The Regulation 10-1-1 framework components, mapped to a Microsoft estate

The failure mode here is a tenant with real tooling running and no written framework around it. Section 5.A of the Division’s Amended Regulation 10-1-1 requires each insurer to “establish a risk-based governance and risk management framework” and lists fourteen components that framework must include. Several are governance duties no software performs: documented governing principles (5.A.1), oversight by the board of directors or a committee of the board (5.A.2), senior management responsibility and accountability (5.A.3), a provider acting for a health benefit plan insurer being ultimately responsible for certain authorization decisions (5.A.5), complaint and inquiry protocols (5.A.7), and policies for assessing and prioritizing risk (5.A.8). The rest are documentation duties where Microsoft tooling can carry much of the evidence. The mapping below is this guide’s reading, not Microsoft’s and not the Division’s.

Inventory and version control under Regulation 10-1-1 Sections 5.A.9 and 5.A.10

Section 5.A.9 of the regulation requires a “Documented up-to-date inventory, including version control, of all utilized ECDIS, as well as algorithms and predictive models that use ECDIS, including a detailed description of each ECDIS, algorithm, and predictive model, their clearly stated purpose(s), and the outputs generated through their use.” That duty has two halves, and they sit in different Microsoft products. For the model half, Microsoft’s MLOps model management documentation states that “Model registration stores and versions your models in your Azure Machine Learning workspace in the Azure cloud,” and that “Whenever you register a model with the same name as an existing model, the registry increments the version number.” A registry that increments versions on its own is the difference between version control and a spreadsheet someone updates by hand. For the data half, Microsoft describes Purview Unified Catalog as a platform “that has an inventory of all your data assets, their metadata, and their lineage so you can understand the topography of your data estate.” Neither product writes the purpose statement or the description of outputs the regulation asks for; those are documents your team writes and keeps beside each registered model and cataloged source.

Material change gets its own record. Section 5.A.10 of the regulation adds a “Documented explanation of any material change(s) in the inventory of all ECDIS, as well as all algorithms and predictive models that use ECDIS, and the rationale for the change(s).” Microsoft’s Fabric governance overview states that “For each item in the lineage view, you can display an impact analysis that shows what downstream items are affected if you make changes to the item.” That view shows what a change touches. The explanation and the rationale remain a written record.

Ongoing monitoring and model drift under Regulation 10-1-1 Section 5.A.12

The gap most teams find here is not missing monitoring but monitoring that never reaches a compliance record. Section 5.A.12 of the Division’s Amended Regulation 10-1-1 requires a “Documented description of ongoing monitoring regarding the performance of algorithms and predictive models that use ECDIS including accounting for model drift.” Microsoft’s model monitoring documentation lists, for Azure Machine Learning, “Built-in monitoring signals for tabular data, including data drift, prediction drift, data quality, feature attribution drift, and model performance.” The regulation names the requirement, not a method. What the Colorado report needs is a description of the monitoring that actually runs: which signals are watched, who reviews them, and what happens when one fires, written so someone outside data science can read it.

Quantitative testing for unfair discrimination under Regulation 10-1-1 Section 5.A.11

This is the component most easily misread in either direction. Section 5.A.11 of the regulation requires a “Documented description of quantitative testing conducted pursuant to requirements established by the Division to detect unfair discrimination in insurance practices resulting from the use of ECDIS, as well as algorithms and predictive models that use ECDIS, including the methodology, assumptions, results, and steps taken to address unfairly discriminatory outcomes.” The testing requirements are the Division’s, and this guide does not state what they are; read them from the Division directly. Microsoft’s Responsible AI dashboard documentation describes a tool that can “evaluate your model’s group fairness issues (how your model’s predictions affect diverse groups of people).” That is a fairness-assessment tool your team can apply while building the evidence. Neither Microsoft’s page nor this one says it satisfies the Division’s testing requirements.

The Regulation 10-1-1 governance group and who can see its records

Section 5.A.4 of the regulation requires a “Documented cross-functional ECDIS, algorithm, and predictive model governance group composed of representatives from key functional areas including legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, as applicable.” Once that group’s records live in a Microsoft system, access becomes a design question. Microsoft’s Dataverse security concepts page states that “Dataverse uses security roles to group privileges,” that business units “define security boundaries that help you manage users and data,” and advises: “Use column-level security when record-level security doesn’t provide enough control.” For results reported in Power BI, Microsoft’s row-level security page states that “Row-level security (RLS) restricts data access for specific users of a Power BI semantic model.” These are access-control structures. The group’s charter, membership and decisions are still documents your organization writes.

Regulation 10-1-1 policies, the annual review and the evidence trail

Section 5.A.6 of the regulation requires documented policies, processes and procedures, with assigned roles, for the design, development, testing, deployment, use and ongoing monitoring of ECDIS, algorithms and predictive models. Section 5.A.14 requires “Documented comprehensive annual reviews of the governance structure and risk management framework and updates to the required documentation to ensure its continued accuracy and relevance.” Two Microsoft facts help with the evidence trail around both. Microsoft’s Fabric governance overview states that “Fabric administrators and compliance teams in your organizations can track and investigate user activity on Fabric items by using Purview Audit.” And Microsoft describes Purview Compliance Manager as a tool that “helps you automatically assess and manage compliance across your multicloud environment”; it assesses your own Microsoft configuration, which makes it a place to keep the insurer’s own records, not a review of any vendor and not a substitute for the annual review itself.

Where Microsoft’s defaults fall short of Regulation 10-1-1, or carry a condition

Two conditions catch teams that assume the tooling is already in place. First, the data-source catalog may not be there yet: Microsoft’s Purview Unified Catalog page notes that “The new Unified Catalog experience is rolling out across environments” and tells readers to “Make sure you’ve upgraded to the enterprise version of the new Microsoft Purview experience in order to access the new experience when it’s available in your region.” Confirm the rollout in your region and your licence tier before you plan the Section 5.A.9 data inventory around it.

Second, audit retention in Dataverse is a setting, not an assumption. Microsoft’s Dataverse auditing page tells administrators to “Select the period that meets your data retention policy.” Set the retention period explicitly, record the setting and the reason for it beside your Regulation 10-1-1 documentation, and do not rely on any default.

The Regulation 10-1-1 annual report, the ten-page limit, and the 5.A.14 question

The report is where the documentation becomes a signed statement. Section 6.C of the Division’s Amended Regulation 10-1-1 requires private passenger automobile and health benefit plan insurers using ECDIS, algorithms or predictive models to “submit to the Division on July 1, 2026 and annually thereafter a report summarizing compliance with the requirements in Section 5 and the title and qualifications of each individual responsible for ensuring compliance along with the specific requirement(s) from Section 5 for which that individual is responsible.” Section 5.C sets the same date for availability: “For private passenger automobile and health benefit plan insurers, all components of the governance structure and risk management framework required by Section 5 must be available upon request by the Division on July 1, 2026, and annually thereafter.” Section 6.D adds that “These reports must be signed by an officer attesting to compliance with this regulation,” that an insurer unable to attest must submit a corrective action plan, and that “This report shall be no more than ten (10) pages including an executive summary and address Sections 5.A.1. through 5.A.13.” Section 6.G requires the reports to be filed in SERFF, the System of Electronic Rate and Form Filing, as an Annual Report filing.

One precision is worth stating plainly, from the same regulation. Section 5.A lists fourteen components; Section 6.D’s own scope sentence names thirteen of them, 5.A.1 through 5.A.13. The fourteenth, 5.A.14, is the documented annual review. That sentence does not say how the annual review is expected to appear in or beside the ten-page report, and this guide does not resolve it. It is a question for the Division of Insurance or your counsel, and one worth asking well before July 1, 2027.

The hard case: third-party ECDIS, algorithm and predictive-model vendors under Sections 5.A.13 and 5.B

When the data or the model comes from outside the insurer, this is where budgets go wrong: the duty reads like a product requirement and is not one. Section 5.A.13 of the Division’s Amended Regulation 10-1-1 requires a “Documented description of the process used for selecting external resources including third-party vendors that supply ECDIS, algorithms, and/or predictive models that use ECDIS including the intended use of the ECDIS, algorithm(s), and/or predictive model(s).” Section 5.B then states that “the insurer remains responsible for ensuring all requirements in Section 5.A. are met” and that “The insurer must establish and document a process for the selection and oversight of all external resources and third-party vendors as part of the governance structure and risk management framework.” Section 5.B also allows a vendor to provide requested documents directly to the Division on the insurer’s behalf.

Treat the duty as two separate things. Selection and oversight is a documented, repeatable process your organization runs: the intended use of each supplied source or model, the criteria it was selected against, what the vendor must produce on request, and how its performance is reviewed over time. The documentation and access around that process is where the tenant helps: the Dataverse business units, security roles and column-level security described above can restrict who reads or edits the vendor record, and Purview can keep the evidence trail. No tenant configuration shows that a vendor was diligently selected, or that the vendor’s own ECDIS, algorithm or predictive-model governance is sound, and this page names no product for that job.

An i3solutions engagement does not produce managed-service ownership, a replacement for the internal team, open-ended scope expansion, or vendor lock-in. i3solutions does not vet a specific vendor’s governance on your behalf or act as your vendor selection function; it helps you build and document the process your own team runs.

The order of work before the July 1, 2027 Regulation 10-1-1 report

This sequence is this guide’s own recommendation, not the Division’s and not Microsoft’s, drawn from Sections 3, 5 and 6 of the Division’s Amended Regulation 10-1-1:

  1. Confirm with counsel which lines of business and which entities in your group are authorized to do business in Colorado and offer private passenger automobile insurance or health benefit plans.
  2. Inventory every ECDIS source, algorithm and predictive model in use, and confirm each model is registered with real version control rather than tracked by hand (5.A.9).
  3. Confirm drift monitoring is wired to a record compliance can read, not only to a data-science dashboard (5.A.12).
  4. Document the quantitative testing in use against the Division’s own requirements, read directly from the Division (5.A.11).
  5. Document the cross-functional governance group, its membership and its access structure (5.A.4).
  6. Build or confirm the selection-and-oversight process for every third-party ECDIS, algorithm and predictive-model supplier (5.A.13, 5.B).
  7. Treat the ten-page report and the availability-on-request duty as a July 1, 2027 deliverable, and put the 5.A.14 annual-review question to the Division or counsel well before then.

When this Colorado guide is the wrong starting point

This guide is the wrong starting point in five situations, each drawn from the Division’s Amended Regulation 10-1-1 or from a separate regime:

  • Your book is life insurance only. The regulation’s life-insurer cycle began on December 1, 2024 (Sections 5.C and 6.B), not on the July 1 date this guide is built around.
  • Your insurer uses no ECDIS and no algorithm or predictive model that uses ECDIS. Section 6.E exempts that insurer from Section 5 and requires an officer-signed attestation instead; whether that describes your company is a question for counsel.
  • Your company is also licensed in Missouri, Alaska or New York. Missouri’s and Alaska’s insurance data security laws and New York’s cybersecurity regulation set separate data-security duties with their own dates; they neither replace nor duplicate this regulation’s framework for ECDIS, algorithms and predictive models.
  • Your group also includes a bank. Federal banking model-risk guidance is a separate duty under a separate regulator.
  • The real question is which voluntary AI governance framework to adopt, or which product to buy for testing or vendor review. This page maps one binding state regulation and makes neither choice.

What to ask of whoever helps you with Regulation 10-1-1

Hold any help, internal or external, to these criteria, each tied to the Division’s Amended Regulation 10-1-1:

  • Show the fourteen Section 5.A components mapped one to one to a named control or a named document, with version control and drift monitoring demonstrated, not asserted.
  • Show the Unified Catalog rollout and licence tier confirmed, not assumed.
  • Show a Dataverse audit retention setting chosen and recorded, not a default assumed.
  • Show the vendor selection-and-oversight process as a documented, repeatable step, separate from any tenant configuration.
  • Hand the testing methodology, the governance documents and the 5.A.14 question to your internal team, actuarial, legal counsel and the Division where the text is unclear.

No product, assessor or firm is named or compared in that work.

How i3solutions answers

i3solutions plans and runs governed Azure and Microsoft 365 migrations with senior, U.S.-based engineers. For Regulation 10-1-1, that means a project, with embedded specialists where your team needs them, that maps the regulation’s components to your tenant, closes the inventory, version-control and monitoring gaps, documents the governance group and the annual review, and designs the record for your vendor selection-and-oversight process. i3solutions maps governance to named control families, enforces it in the platform through Entra ID, Purview, and Azure Policy, and evidences it continuously rather than reconstructing it at audit. i3solutions governs identity and access for regulated Microsoft estates with senior, U.S.-based engineers and leaves an audit-defensible record. i3solutions has been a Microsoft Partner with 30 years of enterprise technology delivery experience and has delivered 1,500+ Microsoft engagements across aerospace and defense, financial services, and health sciences.

The testing methodology, the governance decisions and the officer’s attestation stay with your organization; i3solutions does not run the Division’s quantitative testing or operate the framework as a managed service.

For how this fits the wider governance program, see Embedding Governance into How the Enterprise Operates and Scales.

Key Takeaways

Every regulatory fact below is drawn from the Colorado Division of Insurance’s Amended Regulation 10-1-1, re-read on drafting day:

  • Private passenger automobile and health benefit plan insurers owe the framework on request and an annual compliance report on July 1, 2026 and annually thereafter, so the next date is July 1, 2027.
  • Section 5.A lists fourteen components; Section 6.D scopes the ten-page report to 5.A.1 through 5.A.13, and how 5.A.14 is evidenced is a question for the Division or counsel.
  • Version control and model drift map closely onto the Azure Machine Learning model registry and model monitoring; the data-source half of the inventory maps onto Purview Unified Catalog, subject to its rollout and licence tier.
  • Quantitative testing follows requirements established by the Division; a fairness-assessment tool helps build evidence but is not the Division’s method.
  • The vendor selection-and-oversight duty is a documented process the insurer runs; the tenant restricts and records it but does not perform it.
  • For health benefit plan insurers, ECDIS does not include an individual’s medical records.

Frequently Asked Questions

When is a Colorado auto or health insurer’s next Regulation 10-1-1 compliance report due?

According to the Colorado Division of Insurance’s Regulation 10-1-1, private passenger automobile and health benefit plan insurers using ECDIS, algorithms or predictive models submit a compliance report on July 1, 2026 and annually thereafter, so the next report is due on July 1, 2027, the same date the framework must be available on request.

Does Regulation 10-1-1 apply to life insurers on the same July 1, 2027 date?

No. According to the Colorado Division of Insurance’s Regulation 10-1-1, life insurers run their own cycle, which began on December 1, 2024; the July 1 dates apply to private passenger automobile and health benefit plan insurers.

What counts as ECDIS under Colorado Regulation 10-1-1?

According to the Colorado Division of Insurance’s Regulation 10-1-1, ECDIS is a data or information source used to supplement or supplant traditional underwriting factors or other insurance practices, or to establish lifestyle indicators, including credit scores, social media habits, locations, purchasing habits, home ownership, court records, consumer-generated Internet of Things data and biometric data. For health benefit plan insurers, ECDIS does not include an individual’s medical records.

Does Regulation 10-1-1 require us to vet every vendor that supplies our predictive models?

It requires a documented process. According to the Colorado Division of Insurance’s Regulation 10-1-1, the insurer must establish and document a process for the selection and oversight of all external resources and third-party vendors, and remains responsible for meeting Section 5.A when it uses them. That process is one your organization runs; no Microsoft product performs the selection, and this guide names criteria, never a product.

Does Colorado Regulation 10-1-1 say what model drift monitoring must look like?

No. According to the Colorado Division of Insurance’s Regulation 10-1-1, Section 5.A.12 requires a documented description of ongoing monitoring of algorithm and predictive-model performance, including accounting for model drift, without naming a method. According to Microsoft, Azure Machine Learning model monitoring offers built-in signals including data drift, prediction drift and model performance.

Are we exempt from Colorado Regulation 10-1-1 if we do not use ECDIS, algorithms, or predictive models?

According to the Colorado Division of Insurance’s Regulation 10-1-1, Section 6.E exempts an insurer that does not use ECDIS, or algorithms or predictive models that use ECDIS, from Section 5 and requires an officer-signed attestation instead. Whether that describes your company is a question for counsel and the Division, not for this guide.

Planning the Decision

If your Colorado auto or health book uses ECDIS, algorithms or predictive models, start with the inventory: list every source and model, confirm which models are registered with version control, and confirm the drift monitoring reaches a record compliance can read, before you write a page of the next annual report.

Contact a senior architect