Case Study 1 — Colorado SB21-169 and the Regulatory Turn from Intent to Effect

A real, public development. The statute, the NAIC's accompanying work, and the regulatory direction are matters of public record; this study keeps every specific qualitative and attaches no fabricated figure. It is the chapter's central illustration of how the law is moving the test of unfair discrimination from * intent to* effect.

Background

For most of the modern era, the legal standard that governed insurance fairness was written for a world of rate manuals, not algorithms. The model Unfair Trade Practices Act, adopted in some form by every state, prohibits "unfair discrimination between individuals of the same class and essentially the same hazard" (§35.2). For decades that language did real work: it stopped an insurer from charging two identical risks different prices, and it embedded the principle that price differences must reflect cost differences. But it had a gap that mattered little when pricing was transparent and grew enormous when pricing went algorithmic. The Act, by its terms, asks about intent and about treating like risks alike. It does not, on its face, prohibit a facially neutral practice that produces a disparate impact on a protected group without anyone intending it (§35.4).

Into that gap walked the modern underwriting stack: machine-learning models (Chapter 32), third-party "external" data of every kind, and the proxy problem (§35.3) at industrial scale. An insurer could, with complete honesty, swear it used no protected class — and still deploy a model that reconstructed protected characteristics from their correlates and priced accordingly. The old statute had no clean answer, because it was built to police a kind of discrimination (intentional, transparent) that was no longer the kind most likely to occur. Regulators, consumer advocates, and many in the industry recognized that the framework needed to catch up to the technology.

The insurance / underwriting issue

In 2021 Colorado enacted SB21-169 — a law specifically aimed at the use of external consumer data and information sources, algorithms, and predictive models by insurers. Its core move is exactly the shift this chapter describes: it directs insurers to test their data and models for results that are unfairly discriminatory against protected classes, and it reaches outcomes (effect), not merely stated intent. In other words, it begins to close the disparate-impact gap that the old Unfair Trade Practices Act left open. Rather than asking only "did you use a prohibited factor or mean to discriminate?", the new regime asks "whatever you used and whatever you meant, does your system produce a discriminatory result — and have you looked?"

The significance for underwriting and model governance is structural, and it is the issue at the heart of this study:

• The burden shifts. Under an effect-based standard, refraining from using a protected class is no longer sufficient. An insurer may be required to affirmatively demonstrate that its models and external data do not produce a prohibited disparate impact — to run the §35.4 audit and stand behind it. "We didn't intend to discriminate" becomes an incomplete defense.
• Testing becomes a compliance obligation, not a virtue. The disparate-impact analysis that a conscientious insurer might have done voluntarily becomes something a regulator can expect to see — changing it from a box to check into a genuine, documented audit (the chapter's §35.6 "compliance-plus").
• The proxy problem is named, not ignored. By focusing on external data and algorithms specifically, the law confronts head-on the reality that neutral inputs can carry protected information — the precise mechanism of §35.3 and §35.4.

Alongside the state action, the NAIC — the body of state insurance regulators (Chapter 4) — advanced its own work: a model bulletin on the use of artificial intelligence by insurers, setting governance expectations for AI systems, and a sustained program of work on accelerated underwriting, big data, and algorithmic accountability. The direction of travel, across both the Colorado statute and the NAIC's efforts, is consistent: toward governance, testing, and an effect-based understanding of fairness.

What it shows

This development is the cleanest available illustration of three of the chapter's load-bearing claims.

First, it shows that "colorblindness" is not a sufficient fairness strategy (§35.3). The whole reason a law like SB21-169 is necessary is that an insurer can avoid every protected variable and still discriminate by proxy; a regime that asked only about intent would miss exactly the harm the algorithm makes most likely. The law is, in effect, a regulatory recognition of the §35.3 trap.

Second, it shows that fairness has become a model-governance problem, not just an individual-underwriter problem (§35.4). The disparate impact that matters most is a pattern across thousands of files, invisible on any single desk — which is precisely why the response is institutional testing rather than heroic case-by-case override. The law targets the layer where the bias actually lives.

Third, it shows that the underwriter's "compliance-plus" duty is becoming literal compliance (§35.6, §35.7). What the chapter frames as an ethical obligation to test for disparate impact is, in a growing number of jurisdictions, an emerging legal one. The gap between "what a responsible underwriter should do" and "what the law requires" is narrowing.

Outcome

The outcome is best described as in motion, and honesty requires saying so rather than inventing a tidy resolution. SB21-169 set in train a rule-making and stakeholder process to work out the operational details — how testing is to be done, for which lines and data types first, what thresholds and methods count. Other states and the NAIC continued parallel work on AI governance and algorithmic accountability. The result is not a finished national standard but a clear and accelerating direction: more testing, more documentation, and an effect-based conception of unfair discrimination spreading across the regulatory map. Because this is live and evolving, the precise current obligations must be read from the statute, the rules, and the bulletins as they stand — not from any textbook snapshot. The trajectory, however, is unmistakable, and an underwriter entering the profession now will spend a career inside it.

Lesson

The lesson for the underwriter is direct: the era in which "I didn't use a protected class" settled the fairness question is ending. The standard is moving toward effect, and effect must be measured — which means the §35.4 audit (bringing the protected attribute back as an audit variable, testing for disparate impact, confronting the fairness-metric incompatibility) is becoming part of the job rather than an optional extra. The conscientious instinct the chapter urges — look at what you would rather not look at — is turning into a regulatory expectation. The underwriters and model-governance teams who internalize this early will be the ones who can defend their pricing when, not if, they are asked to.

Discussion questions

1. Explain, in your own words, the difference between an intent-based and an effect-based test of unfair discrimination. Why did the rise of machine learning (Chapter 32) make the gap between them matter so much more than it did in the rate-manual era?
2. SB21-169 can require an insurer to affirmatively demonstrate that its models do not produce a prohibited disparate impact. How does that shift the burden compared with the old Unfair Trade Practices Act, and what would an insurer actually have to do to meet it? (Tie to the §35.4 audit.)
3. A critic argues that effect-based regulation will force insurers to abandon predictive-but-disparate factors, pushing the system toward adverse selection and higher prices for everyone, including the good risks within disadvantaged groups. A defender argues that some predictive accuracy is a fair price to pay to refuse to "punish history." Steel-man both positions. Where do you come down, and why?
4. Why is institutional model governance — rather than case-by-case underwriter override — the right level at which to address algorithmic bias? What kind of bias would an individual underwriter's override never catch? (§35.4, the Model vs. Judgment callout.)
5. The chapter calls testing for disparate impact "compliance-plus" — an ethical duty that exceeds the legal floor. With developments like SB21-169, that ethical duty is becoming a legal one. Does that make the ethical framing unnecessary, or does ethics still do work the law cannot? Defend your view.