NYDFS warns insurers on frontier AI risks as Colorado revises law

Frontier AI has moved from a policy memo to a security operations problem for insurers. The New York State Department of Financial Services warned CISOs of DFS-regulated entities that certain frontier models can amplify the potency, scale and speed of finding vulnerabilities and exploits in information systems, and it paired that warning with companion guidance for a heightened cybersecurity threat environment.

For carrier IT teams, that is not abstract. It means the AI stack now has to sit inside the same controls framework as claims platforms, underwriting engines and security tooling: model inventories that actually track what is in production, audit trails that show who approved a use case, human oversight gates for consequential decisions, and testing regimes that prove the system behaves as intended before it touches policyholders. Hinshaw & Culbertson’s June 5 alert captured the practical shift bluntly: regulators are moving toward examination-ready expectations for insurers’ use of AI and automated decision-making technology.

Colorado added another layer of pressure by rewriting its own AI law. Gov. Jared Polis signed SB 26-189 on May 14, substantially revising the state’s 2024 AI law and pushing the effective date to January 1, 2027. The earlier version had been set to take effect June 30, 2026, but the new law repeals and reenacts those provisions with new requirements around automated decision-making technology in consequential decisions. For vendors selling decision engines into the state, that rewrite narrows and redirects the compliance burden, but it does not make the operational work go away.

The insurance-specific baseline remains the National Association of Insurance Commissioners’ Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted on December 4, 2023. The NAIC’s 2020 AI principles still do the heavy lifting: fairness and ethical use, accountability, compliance, transparency, and systems that are safe, secure, fair and robust. The NAIC’s state adoption tracker shows why insurers are increasingly dealing with a patchwork, not a single rulebook, as general AI statutes and insurance guidance stack on top of one another.

Taken together, the message is clear for underwriting, claims, pricing, fraud detection, customer service and cybersecurity teams. Build the governance workflow into the software, not around it. Track the model. Test the model. Document the vendor. Keep a human in the loop where the decision matters. That is now the difference between an AI program that looks innovative and one that survives an exam.