Colorado HB 26-1139 (Session Laws 2026, ch. 325; C.R.S. 10-16-112.7)

Binding law — not yet in force or stayed

Disclose in writing to the regulator where AI is used in utilization review, its human oversight and audit process (Colorado HB 26-1139)

C.R.S. 10-16-112.7(4) · official text · Enacted, not yet applying: applies from 1 Jan 2027 · Colorado (US-CO)

From 2027-01-01, a carrier, pharmacy benefit manager, private utilization review organization, behavioral health administrative services organization or managed care entity that uses an artificial intelligence system for utilization review must provide written disclosures to the Division, the Department of Human Services or the Department of Health Care Policy and Financing, as applicable, that identify the utilization-review functions for which the system will be used, the points in the process when it is used, the human oversight process (including the qualifications of the reviewer and whether a human must approve an adverse determination) and the process for maintaining audit information sufficient to demonstrate compliance with subsection (3) (C.R.S. 10-16-112.7(4)); the system's or algorithm's criteria and guidelines must comply with other applicable state or federal law on utilization review and coverage ((3)(h)). Detect the absence of the written disclosure record.

Who it applies to

• Duty falls on: insurer, organization
• Sectors: insurance, healthcare
• Carriers that use an artificial intelligence system for utilization review, or contract with or otherwise work through a person that does; pharmacy benefit managers and private utilization review organizations that contract with a carrier to provide utilization review on its behalf and use such a system; and behavioral health administrative services organizations and managed care entities that use such a system for utilization review of mental or behavioral health services (C.R.S. 10-16-112.7(2)), in Colorado. 'Artificial intelligence system' has the meaning in 6-1-1701(2). Applies from 2027-01-01 to actions taken on or after that date (HB 26-1139 sec. 4).
• Whether it applies depends on facts outside the code; a person has to decide.

resp = client.chat.completions.create(model=MODEL, messages=claim_msgs)
claim_decision = parse_decision(resp.choices[0].message.content)
claims.update(claim_id, status=claim_decision)

AI_USE_NOTICE = ('An AI system helped evaluate your claim. '
                 'You can ask us how it was used and request review by a claims adjuster.')
resp = client.chat.completions.create(model=MODEL, messages=claim_msgs)
claim_decision = parse_decision(resp.choices[0].message.content)
claims.update(claim_id, status=claim_decision, ais_program_ref='AIS-012')
send_ai_notice(claimant, text=AI_USE_NOTICE)

Standards that recommend the same control

• Insurers adopting the NAIC model guidance should maintain an AIS Program and AI-use notice (NAIC AI Model Bulletin · NAIC Model Bulletin, AIS Program Guidelines 1.1-1.9)

Rule id co-hb26-1139.ai-use-disclosure-to-regulator · review status: primary source derived

Binding law — not yet in force or stayed

AI utilization review must produce and retain documentation, audit logs and model-governance records (Colorado HB 26-1139)

C.R.S. 10-16-112.7(3)(e) · official text · Enacted, not yet applying: applies from 1 Jan 2027 · Colorado (US-CO)

From 2027-01-01, a person that uses an artificial intelligence system to conduct utilization review must ensure that the system produces and retains documentation, audit logs and model-governance records in order to demonstrate compliance with 10-16-112.7 and 10-3-1104.9 (C.R.S. 10-16-112.7(3)(e)), and must disclose to the regulator its process for maintaining audit information sufficient to demonstrate compliance with subsection (3) ((4)(d)). Detect AI determinations stored without an audit record, and the absence of model-governance records.

Who it applies to

• Duty falls on: insurer, organization
• Sectors: insurance, healthcare
• Carriers that use an artificial intelligence system for utilization review, or contract with or otherwise work through a person that does; pharmacy benefit managers and private utilization review organizations that contract with a carrier to provide utilization review on its behalf and use such a system; and behavioral health administrative services organizations and managed care entities that use such a system for utilization review of mental or behavioral health services (C.R.S. 10-16-112.7(2)), in Colorado. 'Artificial intelligence system' has the meaning in 6-1-1701(2). Applies from 2027-01-01 to actions taken on or after that date (HB 26-1139 sec. 4).
• Whether it applies depends on facts outside the code; a person has to decide.

def decide(app):
    resp = client.chat.completions.create(model=MODEL, messages=eligibility_prompt(app))
    applications.set_status(app.id, parse_decision(resp))

log = structlog.get_logger()   # TimeStamper processor adds the timestamp

def decide(app):
    decision_id = str(uuid.uuid4())
    resp = client.chat.completions.create(model=MODEL, messages=eligibility_prompt(app))
    status = parse_decision(resp)
    log.info('ai_decision', decision_id=decision_id, model=resp.model,
             input_ref=f'applications/{app.id}', output=status, operator=current_operator())
    applications.set_status(app.id, status, decision_id=decision_id)

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Court compelled discovery on how nH Predict works (2026-03-09; confirmed). A federal magistrate judge in the District of Minnesota ordered UnitedHealth to produce documents on how nH Predict works, including whether it was designed to supplant physician decision-making. Plaintiffs needed litigation discovery to learn how the model was designed and used. Source: U.S. District Court, D. Minn. (Order, Doc. 162) · evidence grade: primary · cited by Record enough at decision time to reproduce and explain every consequential AI decision

Rule id co-hb26-1139.audit-logs-and-model-governance-records · review status: primary source derived

Binding law — not yet in force or stayed

No medical-necessity denial solely on AI output without review and approval by a competent licensed clinician (Colorado HB 26-1139)

C.R.S. 10-16-112.7(5)(b) · official text · Enacted, not yet applying: applies from 1 Jan 2027 · Colorado (US-CO)

From 2027-01-01, a carrier's denial of coverage based in whole or in part on medical necessity shall not be issued solely on the output of an artificial intelligence system without human review and approval of the denial by a licensed clinician, licensed physician or other regulated professional competent to evaluate the specific clinical issues involved in the services the provider requested, and a review of the health benefit plan's terms of coverage for the service (C.R.S. 10-16-112.7(5)(b)). An AI system may still be used to assist with utilization review, including expedited approvals ((5)(a)). Detect model or scoring output that sets a denial without a clinical reviewer's decision.

Who it applies to

• Duty falls on: insurer
• Sectors: insurance, healthcare
• Carriers (and the pharmacy benefit managers and private utilization review organizations that conduct utilization review on their behalf, C.R.S. 10-16-112.7(2)) issuing a denial of coverage based in whole or in part on medical necessity where an artificial intelligence system's output is used, in Colorado. Approvals, including expedited approvals, may be assisted by the system ((5)(a)). Applies from 2027-01-01 to actions taken on or after that date (HB 26-1139 sec. 4).
• Not covered:
  • Approvals, including expedited approvals: an artificial intelligence system may be used to assist with utilization review (C.R.S. 10-16-112.7(5)(a)); only a denial based in whole or in part on medical necessity needs the clinician's review and approval ((5)(b))
• Whether it applies depends on facts outside the code; a person has to decide.

result = client.chat.completions.create(model=MODEL, messages=build_pa_prompt(request)).choices[0].message.content
if json.loads(result)['decision'] == 'deny':
    prior_auth.update(request.id, status='denied')
    send_denial_letter(request)

result = json.loads(client.chat.completions.create(
    model=MODEL, messages=build_pa_prompt(request, record=member_clinical_record(request))).choices[0].message.content)
if result['decision'] == 'approve' and AUTO_APPROVE_ALLOWED:
    prior_auth.update(request.id, status='approved', ai_assisted=True)
else:                                   # any non-approval goes to a clinician
    review_queue.enqueue(request.id, queue='pending_clinical_review',
                         specialty=request.specialty, ai_recommendation=result)

@app.post('/reviews/{case_id}/decision')
def record_clinical_decision(case_id: str, body: Decision, reviewer=Depends(licensed_clinical_reviewer)):
    decision = clinical_decisions.create(case_id=case_id, reviewer_id=reviewer.id, licence=reviewer.licence,
                                         specialty=reviewer.specialty, documents_reviewed=body.documents,
                                         outcome=body.outcome, rationale=body.rationale)
    if body.outcome in ('denied', 'downgraded'):
        send_adverse_determination(case_id, decision=decision, signed_by=reviewer)

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id co-hb26-1139.clinician-approves-medical-necessity-denial · review status: primary source derived

Binding law — not yet in force or stayed

AI utilization review must not discriminate unlawfully, must be fairly applied and must be periodically reviewed (Colorado HB 26-1139)

C.R.S. 10-16-112.7(3)(c) · official text · Enacted, not yet applying: applies from 1 Jan 2027 · Colorado (US-CO)

From 2027-01-01, a person that uses an artificial intelligence system to conduct utilization review must ensure that the system is not used in any way that discriminates against individuals in violation of other state or federal laws (C.R.S. 10-16-112.7(3)(c)), that it is fairly and equitably applied, including in accordance with applicable regulations and guidance of the federal Department of Health and Human Services ((3)(d)), and that its performance, use and outcomes are periodically reviewed to maximize accuracy and reliability ((3)(f)). Detect the absence of a periodic accuracy, outcome and disparity review.

Who it applies to

• Duty falls on: insurer, organization
• Sectors: insurance, healthcare
• Carriers that use an artificial intelligence system for utilization review, or contract with or otherwise work through a person that does; pharmacy benefit managers and private utilization review organizations that contract with a carrier to provide utilization review on its behalf and use such a system; and behavioral health administrative services organizations and managed care entities that use such a system for utilization review of mental or behavioral health services (C.R.S. 10-16-112.7(2)), in Colorado. 'Artificial intelligence system' has the meaning in 6-1-1701(2). Applies from 2027-01-01 to actions taken on or after that date (HB 26-1139 sec. 4).
• Whether it applies depends on facts outside the code; a person has to decide.

clf = LogisticRegression(max_iter=1000).fit(X_train, y_train)
joblib.dump(clf, 'models/credit_v4.joblib')

from fairlearn.metrics import MetricFrame, selection_rate, demographic_parity_difference
from sklearn.metrics import accuracy_score

clf = LogisticRegression(max_iter=1000).fit(X_train, y_train)
y_pred = clf.predict(X_test)
mf = MetricFrame(metrics={'accuracy': accuracy_score, 'selection_rate': selection_rate},
                 y_true=y_test, y_pred=y_pred, sensitive_features=A_test)
dpd = demographic_parity_difference(y_test, y_pred, sensitive_features=A_test)
write_validation_report('credit_v4', mf.by_group, dpd)
if dpd > MAX_DPD:
    raise SystemExit('bias gate failed: owner review required before release')
joblib.dump(clf, 'models/credit_v4.joblib')

Standards that recommend the same control

• AI should avoid unfair bias and be assessed for discrimination (EU ALTAI) (EU ALTAI · ALTAI / EU Ethics Guidelines — Requirement 5 (Diversity, Non-discrimination and Fairness))
• AI models in financial decisions should be regularly validated for accuracy and bias (MAS FEAT) (MAS FEAT Principles · MAS FEAT Principles — Fairness (Accuracy and Bias), Principles 3-4)
• Insurers adopting the NAIC model guidance should validate and bias-test AI and predictive models (NAIC AI Model Bulletin · NAIC Model Bulletin, adoption statement (title page))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Meta's automated moderation over-enforced Arabic and under-enforced Hebrew content (BSR due diligence) (2021-05; disclosed by the operator). An independent human rights due diligence by BSR, commissioned and published by Meta on September 22, 2022, found that during the May 2021 Israel-Palestine escalation Arabic content saw greater over-enforcement per user than Hebrew content and Hebrew content greater under-enforcement. BSR attributes this in part to Meta having an Arabic hostile-speech classifier but no Hebrew one, and to Arabic classifiers likely being less accurate for Palestinian Arabic. BSR found no intentional bias but 'various instances of unintentional bias' with different impacts on Palestinian and Arabic-speaking users. Meta committed to implement 10 of BSR's 21 recommendations and said it had since launched a Hebrew hostile-speech classifier. Source: Meta (operator response, 2022-09-22) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language
• Toxicity classifiers rate African American English as more offensive (2019; confirmed). University of Washington researchers reported at ACL 2019 that tweets in African American English and tweets by self-identified African Americans were up to two times more likely to be labelled offensive by hate-speech models trained on widely used datasets, and that Jigsaw's public Perspective API showed similar racial bias, rating AAE phrases as more toxic than non-AAE equivalents. Source: Sap et al., 'The Risk of Racial Bias in Hate Speech Detection', ACL 2019 (original researchers) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language
• Ride-hailing fares higher in Chicago neighborhoods with more non-white residents (researcher audit) (2018-11; alleged (not proven)). George Washington University researchers analysing Chicago's public data on more than 100 million ride-hailing trips from November 2018 to September 2019 report that trips in neighborhoods with larger non-white populations, higher poverty, younger residents and more college-educated residents were significantly associated with higher fares. They attribute this to pricing algorithms learning from demand, supply and trip duration. The finding is an observational association from census-tract data; the pricing models themselves were not examined. Source: Pandey & Caliskan, 'Disparate Impact of Artificial Intelligence Bias in Ridehailing Economy's Price Discrimination Algorithms', AIES 2021 (original researchers) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language
• Google ads suggesting arrest records served more often for Black-identifying names (2012; confirmed). Harvard researcher Latanya Sweeney searched 2,184 racially associated full names on google.com and reuters.com (a Google AdSense host) from September 24 to October 23, 2012 and found ads suggestive of an arrest record appeared more often for Black-identifying first names; on reuters.com a Black-identifying name was 25% more likely to get such an ad (statistically significant). Ads appeared regardless of whether the name had an arrest record in the advertiser's database. The paper does not determine whether the advertiser's templates or Google's click-based ad optimization caused the pattern; the advertiser, Instant Checkmate, told the author it gave Google the same ad text for groups of last names. Source: Sweeney, 'Discrimination in Online Ad Delivery' (original researcher, 2013-01-28) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language

Rule id co-hb26-1139.fair-application-and-periodic-review · review status: primary source derived

Binding law — not yet in force or stayed

AI utilization review must rest on the individual's clinical history and record, not solely on group data (Colorado HB 26-1139)

C.R.S. 10-16-112.7(3)(a) · official text · Enacted, not yet applying: applies from 1 Jan 2027 · Colorado (US-CO)

From 2027-01-01, a carrier, pharmacy benefit manager, private utilization review organization, behavioral health administrative services organization or managed care entity that uses an artificial intelligence system to conduct utilization review must ensure that the system bases its determination, as applicable, on the individual's medical or other clinical history, the individual clinical circumstances as presented by the requesting provider, and other relevant clinical information in the individual's medical or other clinical record (C.R.S. 10-16-112.7(3)(a)), and does not base its determinations solely on group data, without reference to the individual's data ((3)(b)). Detect utilization-review model calls built without the member's clinical record or the provider's submission.

Who it applies to

• Duty falls on: insurer, organization
• Sectors: insurance, healthcare
• Carriers that use an artificial intelligence system for utilization review, or contract with or otherwise work through a person that does; pharmacy benefit managers and private utilization review organizations that contract with a carrier to provide utilization review on its behalf and use such a system; and behavioral health administrative services organizations and managed care entities that use such a system for utilization review of mental or behavioral health services (C.R.S. 10-16-112.7(2)), in Colorado. 'Artificial intelligence system' has the meaning in 6-1-1701(2). Applies from 2027-01-01 to actions taken on or after that date (HB 26-1139 sec. 4).
• Whether it applies depends on facts outside the code; a person has to decide.

features = {'cpt': req.cpt, 'icd10': req.icd10, 'cohort_approval_rate': cohort_stats(req.icd10)}
reply = client.messages.create(model=MODEL, max_tokens=400,
    messages=[{'role': 'user', 'content': f'Prior authorization request: {features}'}])

record = member_clinical_record(req.member_id, fields=PA_CLINICAL_FIELDS)   # history, conditions, meds
submission = provider_clinical_submission(req.id)                            # notes, letter of medical necessity
if not record or not submission:
    return review_queue.enqueue(req.id, reason='individual clinical information missing')
reply = client.messages.create(model=MODEL, max_tokens=400, messages=[{'role': 'user', 'content':
    render('pa_review.txt', request=req, clinical_history=record, provider_submission=submission)}])
determinations.save(req.id, inputs={'clinical_history': record.ids, 'submission': submission.ids})

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Meta's automated moderation over-enforced Arabic and under-enforced Hebrew content (BSR due diligence) (2021-05; disclosed by the operator). An independent human rights due diligence by BSR, commissioned and published by Meta on September 22, 2022, found that during the May 2021 Israel-Palestine escalation Arabic content saw greater over-enforcement per user than Hebrew content and Hebrew content greater under-enforcement. BSR attributes this in part to Meta having an Arabic hostile-speech classifier but no Hebrew one, and to Arabic classifiers likely being less accurate for Palestinian Arabic. BSR found no intentional bias but 'various instances of unintentional bias' with different impacts on Palestinian and Arabic-speaking users. Meta committed to implement 10 of BSR's 21 recommendations and said it had since launched a Hebrew hostile-speech classifier. Source: Meta (operator response, 2022-09-22) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language
• Toxicity classifiers rate African American English as more offensive (2019; confirmed). University of Washington researchers reported at ACL 2019 that tweets in African American English and tweets by self-identified African Americans were up to two times more likely to be labelled offensive by hate-speech models trained on widely used datasets, and that Jigsaw's public Perspective API showed similar racial bias, rating AAE phrases as more toxic than non-AAE equivalents. Source: Sap et al., 'The Risk of Racial Bias in Hate Speech Detection', ACL 2019 (original researchers) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language
• Ride-hailing fares higher in Chicago neighborhoods with more non-white residents (researcher audit) (2018-11; alleged (not proven)). George Washington University researchers analysing Chicago's public data on more than 100 million ride-hailing trips from November 2018 to September 2019 report that trips in neighborhoods with larger non-white populations, higher poverty, younger residents and more college-educated residents were significantly associated with higher fares. They attribute this to pricing algorithms learning from demand, supply and trip duration. The finding is an observational association from census-tract data; the pricing models themselves were not examined. Source: Pandey & Caliskan, 'Disparate Impact of Artificial Intelligence Bias in Ridehailing Economy's Price Discrimination Algorithms', AIES 2021 (original researchers) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language
• Google ads suggesting arrest records served more often for Black-identifying names (2012; confirmed). Harvard researcher Latanya Sweeney searched 2,184 racially associated full names on google.com and reuters.com (a Google AdSense host) from September 24 to October 23, 2012 and found ads suggestive of an arrest record appeared more often for Black-identifying first names; on reuters.com a Black-identifying name was 25% more likely to get such an ad (statistically significant). Ads appeared regardless of whether the name had an arrest record in the advertiser's database. The paper does not determine whether the advertiser's templates or Google's click-based ad optimization caused the pattern; the advertiser, Instant Checkmate, told the author it gave Google the same ad text for groups of last names. Source: Sweeney, 'Discrimination in Online Ad Delivery' (original researcher, 2013-01-28) · evidence grade: primary · cited by Check AI ranking, pricing, moderation, and ad targeting for disparities when features can stand in for protected traits, and screen every served language

Rule id co-hb26-1139.individual-clinical-data-basis · review status: primary source derived

Binding law — not yet in force or stayed

Health data used in AI utilization review must not be used beyond its intended or stated purpose (Colorado HB 26-1139)

C.R.S. 10-16-112.7(3)(g) · official text · Enacted, not yet applying: applies from 1 Jan 2027 · Colorado (US-CO)

From 2027-01-01, a person that uses an artificial intelligence system to conduct utilization review must ensure that an individual's health data is not used beyond its intended or stated purpose, consistent with applicable state and federal laws (C.R.S. 10-16-112.7(3)(g)). Detect utilization-review patient data exported to model training or fine-tuning, marketing lists or product analytics.

Who it applies to

• Duty falls on: insurer, organization
• Sectors: insurance, healthcare
• Carriers that use an artificial intelligence system for utilization review, or contract with or otherwise work through a person that does; pharmacy benefit managers and private utilization review organizations that contract with a carrier to provide utilization review on its behalf and use such a system; and behavioral health administrative services organizations and managed care entities that use such a system for utilization review of mental or behavioral health services (C.R.S. 10-16-112.7(2)), in Colorado. 'Artificial intelligence system' has the meaning in 6-1-1701(2). Applies from 2027-01-01 to actions taken on or after that date (HB 26-1139 sec. 4).
• Whether it applies depends on facts outside the code; a person has to decide.

client = OpenAI()
resp = client.chat.completions.create(model='gpt-4o', messages=[
    {'role': 'user', 'content': f'Summarize: {patient.clinical_note}'}])

VENDORS = load_yaml('vendors/ai_vendors.yaml')   # baa_signed, zero_data_retention per endpoint

def phi_client(name: str) -> tuple[AzureOpenAI, str]:
    v = VENDORS[name]
    if not (v['baa_signed'] and v['zero_data_retention']):
        raise PermissionError(f'{name} is not cleared for PHI')
    client = AzureOpenAI(azure_endpoint=v['endpoint'], api_key=os.environ['AZURE_OPENAI_KEY'],
                         api_version=v['api_version'])
    return client, v['deployment']

client, deployment = phi_client('azure-openai-hipaa')
resp = client.chat.completions.create(model=deployment, messages=[
    {'role': 'user', 'content': f'Summarize: {patient.clinical_note}'}])

Rule id co-hb26-1139.patient-data-purpose-limit · review status: primary source derived