How Regulators Test AI in Insurance Underwriting
The NAIC's bulletin and draft exhibits set no fairness metric for AI in insurance underwriting, and a regulator may ask for the thresholds the insurer used.
In this article
For Underwriting leaders, actuaries, and compliance officers at P&C, life, and health carriers.
Read if Your underwriting uses models or outside data and you want to know what a regulator can test, and which document each test comes from.
During the comment period on the NAIC’s draft AI Risk Evaluation Supplement, Wanchin Chou of the Connecticut Insurance Department sent its drafters a single page. It proposed a longer version of the draft’s question about model testing. An insurer would describe, among other things, the methods and metrics it used, the populations or comparison groups it evaluated, and how often it tested. A new question would ask, where applicable, whether the company checks its input variables, derived variables, or model outputs for proxy relationships.1
The Supplement, formerly the AI Systems Evaluation Tool, is a set of exhibits that regulators may choose to use when they review an insurer’s use of AI. Its question on testing asks for less than Chou proposed. It tells the company to “Discuss testing model outputs,” with examples that begin at drift and accuracy and take in unfair discrimination.2
Neither version says what result is good enough. Nor does the NAIC Model Bulletin, the 2023 guidance on insurers’ use of AI. When regulators test AI in insurance underwriting, the decision is judged against law that mostly predates the models. The test on the model has a passing score only because someone at the company chose one. A department may ask what it was.
Status as of October 9, 2026. No version of the Supplement has been adopted. Version 5.0 is the newest draft on the NAIC working group’s page, which lists the next public meeting for November 2. Draft minutes of the group’s August 31 meeting describe a plan for a version 6.0, further comments, and a version 7.0 presented for adoption at the Fall National Meeting. Colorado’s 2023 rule on quantitative testing is still listed as a draft proposal.3
The standard applies to the decision
The bulletin is guidance that applies where a state’s insurance department has issued it. Its Section 3 says a decision made with an AI system must comply with the legal and regulatory standards that apply to that decision, whatever tools and methods produced it. Those standards, it says, “require, at a minimum, that decisions made by Insurers are not inaccurate, arbitrary, capricious, or unfairly discriminatory.”4
On that wording the standard attaches to the decision, so it would apply to the same decision made by hand. Even the bulletin’s term for a failure, an Adverse Consumer Outcome, is defined as a decision that harms the consumer “in a manner that violates those standards.”4 Read literally, a decline is not one unless it broke a rule.
What the bulletin adds is an expectation that the insurer keep a written AIS Program, its name for an insurer’s own controls on its use of AI. It also lists what a department may ask for in an investigation or market conduct action. For a specific model, one line asks for information on “the techniques, measurements, thresholds, and similar controls used by the Insurer.”4
Underwriting AI as the Supplement counts it
For each operational area, Exhibit A of the Supplement asks how many AI systems a company uses and, separately, how many models have direct consumer impact and how many have material financial impact. Underwriting has a row, labeled “Underwriting/ Eligibility.”2
Advice counts. In the Supplement’s terms, a system has direct consumer impact when it augments or automates a human decision and its output could create a final consumer outcome. Tier and coverage eligibility determinations are on its list of such outcomes, and augmentation takes in a system that “advises a human who is making a decision.”2 That puts a score on the row even when it only advises an underwriter. The Supplement’s examples of underwriting also run past accept or decline, to report ordering and retention modeling.2
For an actuary the bigger news is that GLMs are counted at all. The NAIC’s auto and homeowners surveys left them out of what counted as AI and machine learning. Yet the 2022 memo on the auto survey noted that GLMs “are used by 85% of companies in rate filings.”5 The Supplement gives them a count of their own and says they too carry a risk of unfair discrimination.2
Several insurer trade associations asked the working group to take GLMs out or to drop the separate count; other insurer associations asked it to reconsider including them.6 One reason, from NAMIC, was that GLMs used for pricing are already regulated through rate filing review.
Wisconsin Commissioner Nathan Houdek, who chairs the working group, had addressed that argument at a July 2026 meeting. According to the minutes, he said a regulatory framework for reviewing GLMs used in ratemaking already exists, but that GLMs are also used in other insurer operations the current framework has not fully addressed.7 The minutes do not name those operations, and we read underwriting as one of them.
The parts left to the insurer
The testing request sits in Exhibit C, which asks for detail on each in-production high-risk model a regulator requests. What counts as high-risk is judged under criteria the company sets.2 Five NAIC consumer representatives wrote that they continue to be concerned about that: company-set criteria pose “an inherent conflict of interest,” and consumers would benefit from a uniform definition.8 NAMIC came at it from the other side and asked that Exhibit C be removed.
How those criteria work in use is known only secondhand, from a 2026 pilot of an earlier version. The Blue Cross Blue Shield Association wrote that some member plans were asked to complete Exhibit C for every AI use case they had reported, low-risk models included. NAMIC wrote that most piloting states did not appear to have used Exhibits C and D. The NAIC has confirmed neither account.9
The passing score is left to the company too: no fairness metric, level to meet, or testing interval appears in the Supplement or the bulletin.24
As we read the two documents, that leaves an examiner holding the company’s thresholds with nothing from a regulator to set beside them. What can be checked is the company’s own record: whether results stayed inside the level it chose, how often it tested, and what it did when a result fell outside. The reason for the number then carries weight, since no outside figure will vouch for it.
Chou’s rewrite would not change that. It asks the company to describe its metrics and supplies none, though its added question would be the first place either document used the word proxy.10
The same model should match across the exhibits
A company whose regulator sends more than one exhibit may have to describe the same underwriting model more than once.2
| Fact | Exhibit A | Exhibit C, for an in-production high-risk model the regulator requests | Exhibit D |
|---|---|---|---|
| Identity | The counts name no model. Its name comes in a model inventory, for the program areas the regulator specifies. | Name and version | The systems or models that rely on the data described |
| Use | Use cases, on the “Underwriting/ Eligibility” row; in the inventory, how the model is used and its program area | Use cases and purpose | How the model uses each kind of data |
| Type | Counts by type: GLMs, generative or agentic models, and other AI or machine learning | Model type, on the same three-way split | Not asked |
| Risk level | In the inventory, the inherent risk level under the company’s own risk assessment | Risk classification, under criteria the company sets | Not asked |
| Developer | Not asked | How it was developed, with the vendor named where there is one | Not asked |
| Data sources | Not asked | Not asked | For each listed kind of data used to train or test a model, an internal source or a named third party. Telematics and usage-based insurance is one of the kinds listed. |
No exhibit tells a regulator to set these answers side by side. We think it is the cheapest test the Supplement makes possible, because it needs nothing but the company’s own submissions. One model should have one name, one use, one type, and one risk level.
Suppose the inventory listed a telematics score as an underwriting use. If Exhibit D had no telematics entry, or Exhibit C described the same score as a pricing model, the mismatch would show without any statistics.
States that have written a test down
In any insurance practice, underwriting included, Colorado’s SB 21-169 bars insurers from unfairly discriminating on race, sex, disability, or six other characteristics it lists. Its bar on external consumer data and models that unfairly discriminate applies “pursuant to rules adopted by the commissioner.”1112
One such rule has been adopted: Regulation 10-1-1, which sets governance and risk management framework requirements for insurers offering individually issued life insurance, private passenger automobile insurance, and health benefit plans. Homeowners is not among them. A separate rule that would set a quantitative test was drafted for life insurance underwriting only and released for informal comment on September 28, 2023. The American Council of Life Insurers presented a version of its own at a stakeholder meeting in June 2024.11
Under the draft, a life insurer that uses external consumer data in underwriting would estimate each applicant’s race or ethnicity by BIFSG, from the name and location on the application. It would then regress approvals, and premium per $1,000 of face amount, on the estimated groups. A difference would have to clear two gates. The first is statistical significance, at a p-value below .05. The second is size: five percentage points in approval rates, or a premium at least 5% above the average for all policies.13
A difference that cleared both would send the insurer on to test variable by variable: one regression on all its underwriting variables, then a second with the race and ethnicity estimates added. Any external consumer data variable whose coefficient differed between the two would be deemed unfairly discriminatory, along with the model that uses it.13
The draft’s words are “any difference,” with no p-value or minimum size of the kind the step before has.13 Taken at its word, a coefficient that moved at all would be enough, and coefficients seldom stay put when another variable is added.
A draft binds no one. This one is also the only document read for this guide in which a regulator wrote down how large a difference must be to trigger further testing. An insurer choosing its own thresholds can at least see where one regulator put them.
New York works through guidance, and unlike Colorado’s draft its guidance is final. Insurance Circular Letter No. 7 was issued in 2024. It says an insurer should not use external consumer data or an AI system in underwriting or pricing unless a comprehensive assessment shows its guidelines are not unfairly or unlawfully discriminatory.14
| Colorado draft regulation, as proposed | New York Circular Letter No. 7, as guidance | |
|---|---|---|
| Standing | Draft, released for informal comment in 2023 | Final, issued in 2024; its steps are what an insurer should do at a minimum |
| Reach | Life insurance underwriting | Underwriting and pricing, and no other phase of the product lifecycle |
| Groups compared | Race and ethnicity, estimated by BIFSG | Similarly situated insureds, and any protected class whose membership the insurer’s data shows or accepted statistical methods can reasonably infer |
| Measure | Logistic regression on approvals, linear regression on premium | Not prescribed; the letter encourages more than one statistic |
| Threshold | A p-value below .05, then five percentage points in approval rates or 5% in premium | A prima facie showing of a disproportionate adverse effect; no figure is given |
| Next step | A variable-by-variable test, then remediation | A legitimate, lawful, and fair explanation and, if there is one, a documented search for a less discriminatory alternative |
| Frequency | Annually | Before production, on a regular cadence, and after material changes |
| A vendor’s model | Tested the same way where a third party used the data or model on the insurer’s behalf | The insurer may not rely solely on the vendor’s claim of non-discrimination; responsibility “remains with the insurer at all times”1415 |
Where an investigation or examination concerns a system developed in whole or in part by a third party, the bulletin says the insurer should also expect requests about its oversight of the vendor.15
New York’s letter gives no number for how large an effect is disproportionate. Commenters on the proposed letter had asked for more detail on thresholds in its risk management provisions. The Department of Financial Services answered: “It is up to insurers to determine the appropriate sufficiency thresholds and standards of proof.”14
The nearest thing to a published case is the letter New York sent life insurers in 2019, after investigating how they used external consumer data in underwriting. It concluded that such data “has the strong potential to mask” prohibited discrimination, named no insurer, and announced no penalty.16
We looked for a published penalty, consent order, or examination report on an underwriting model and found none, in a search limited to New York’s enforcement page, one Pennsylvania examination report, and web searches.17 Within that search, an insurer setting a threshold has no published decision to measure it against.
By line of business, and the record to check
The standard is the same in every line of business. The law beside it is not.
| Line | Particular to the line | Our suggestion for the file |
|---|---|---|
| P&C | Rates answer to a statute of their own. The bulletin lists each state’s version of the Property and Casualty Model Rating Law and says its requirements apply whatever methodology produced the rates.4 | For a score that feeds tier or eligibility: the filed rule or rate filing it operates under, and the inspection, imagery, or driving data it read. |
| Life | Accelerated underwriting replaces some traditional evidence, such as an exam or lab work, with external consumer data and a model’s score. New York’s 2019 letter says an adverse underwriting decision would include an applicant’s inability to use an expedited, accelerated, or algorithmic process in place of traditional medical underwriting.16 | Which applicants were moved from the accelerated path to full underwriting, on what data, and what each was told. |
| Health | The Affordable Care Act largely prohibits medical underwriting in individual health insurance.18 The Supplement also gives utilization management, utilization review, and prior authorization a row apart from underwriting and eligibility, so a health carrier’s decisions about care are counted separately from its decisions about coverage.2 | Which products the model touches, and whether health status may lawfully enter eligibility or rating for each. |
Take one completed underwriting decision and find the model behind it. Check that the model has a testing record with a method, a threshold, a date, and a reason the threshold was chosen. That is the record an Exhibit C answer would draw on.
Footnotes
-
NAIC Big Data and Artificial Intelligence (H) Working Group, Comments Received on version 5.0 exposure, a compilation of the comment letters on the version 5.0 exposure draft. Wanchin Chou’s submission is one regulator’s drafting proposal, not a decision of the working group, and it does not describe a Connecticut requirement. It is page 83, headed “From Wanchin Chou (CT DOI)”: one undated page with three items, of which the third gives replacement text for Exhibit C without stating reasons, a rewritten request 11 and a new request 11a that begins “Where applicable.” Page numbers in these notes are PDF pages of the file as posted on October 9, 2026, when it ran to 225 pages. ↩
-
National Association of Insurance Commissioners, Artificial Intelligence (AI) Risk Evaluation Supplement, version 5.0, clean, posted by the Big Data and Artificial Intelligence (H) Working Group as an exposure draft. The file prints no version number; “5.0” comes from its file name and the exposure notice. Passages relied on: Intent (“These optional exhibits allow regulators to determine the extent of AI Systems usage”); General Guidance, Machine Learning Models, which says the Supplement asks about specific models in Exhibit A “to give regulators flexibility in determining their scope of interest”; Exhibit A, Part One (the count grid) and Part Two (the request list, which includes the model inventory); Exhibit C, purpose and requests 1, 2, 3, 5, 7, 11, and 12; Exhibit D, instructions and column headings; Definitions and Appendix (“Augmentation”; “Direct Consumer Impact”; “Material Financial Impact”; Operations, “Underwriting - Examples”). Request 11 also asks how the model was validated before deployment and how it is monitored afterward, and request 12 asks for the date of the last test. The material financial impact heading depends on a materiality threshold that the company discloses or the regulator provides. Exhibit D’s data categories, one list for every line of business, include aerial imagery, driving behavior, geocoding, geo-demographics, natural catastrophe hazard, telematics and usage-based insurance, and weather. On frequency, the narrative version of Exhibit B asks the company only to “Discuss the testing and verification that has occurred including frequency, scope and methodology.” Its preface says its questions about an AIS Program “are not intended to be interpreted as creating new requirements”; that statement appears in Exhibit B only, and the American Council of Life Insurers (ACLI) asked that a similar one cover the entire Supplement (comments, note 1, p. 3). Request numbers belong to version 5.0 and may change in a later draft. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9
-
Status sources, as read on October 9, 2026. National Association of Insurance Commissioners, Big Data and Artificial Intelligence (H) Working Group: the Exposure Drafts section exposed version 5.0 after the group’s August 31, 2026 meeting for a comment period that ended September 29, 2026; version 5.0 was the newest version linked, and none was marked adopted. The page listed public meetings on the Supplement for October 8 and November 2, 2026. For October 8 it carried the agenda and materials only, with no minutes, summary, or later draft, and the agenda and materials list no vote on the Supplement. The plan for later versions is in the draft August 31 minutes attached to them: revise after the October 8 meeting, release a version 6.0, take further comments, and present a version 7.0 for adoption at the Fall National Meeting. Nothing on the page or in the comment compilation showed which requests the working group had accepted. On the former name and the pilot, see the working group’s August 13, 2026 summary report: “AI Risk Evaluation Supplement (formerly known as the AI Systems Evaluation Tool),” in a pilot that began in March 2026 with 12 participating states. On Colorado, see the Division of Insurance page SB21-169: Protecting Consumers from Unfair Discrimination in Insurance Practices, which on the same date listed the quantitative testing regulation as a draft proposal, under its Life Insurance Underwriting heading only. ↩
-
National Association of Insurance Commissioners, Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted December 4, 2023. Passages relied on: Section 1, Legislative Authority (Property and Casualty Model Rating Law, Model #1780); Section 2, definition of “Adverse Consumer Outcome”; Section 3, first two paragraphs; Section 4, its opening paragraphs and items 1.3(c)(ii)(2) and (3), where item (2) asks about the data behind a model, “bias analysis and minimization” included; and Section 4’s second-to-last paragraph, which says the bulletin’s goal “is not to prescribe specific practices or to prescribe specific documentation requirements.” ↩ ↩2 ↩3 ↩4 ↩5
-
The NAIC’s 2021 private passenger auto survey and its 2022 to 2023 homeowners survey counted only what they called more advanced AI and machine learning models and excluded GLMs; the remark about rate filings is in the first footnote of the auto survey memorandum, which does not say which companies the 85% is a share of. On that definition, 34 of 193 responding auto insurers (18%) and 91 of 194 responding homeowners insurers (47%) reported underwriting models in use; with models under construction added, the figures were 31% and 62%. The surveys were run under the market examination authority of nine and ten states respectively, and covered only larger writers, those with at least $75 million (auto) or $50 million (homeowners) in national premium for 2020. Neither gives a share of all insurers or describes current use. See the survey memoranda of December 8, 2022 and August 10, 2023, and Table 3 of the accompanying staff reports on auto and homeowners. The 2023 life survey is not comparable. It included GLMs and GAMs, covered life insurance products only, and its underwriting figure, 34% of the AI and machine learning models that respondents had implemented, counts models, not companies (memorandum of November 30, 2023; 161 companies completed the survey). ↩
-
Comments (note 1). These are requests, and nothing in the compilation shows what the working group accepted. By our count, which is not an NAIC figure, seven insurer trade associations addressed GLMs: ACLI, that GLMs and GAMs be excluded from the Supplement (p. 5); the American Property Casualty Insurance Association, that “further consideration” be given to whether conventional GLMs should be distinguished from AI systems (p. 35); the Blue Cross Blue Shield Association, that the separate GLM count be removed from Exhibit A or, at a minimum, limited to models that materially affect consumers or financial soundness (p. 45); the Committee of Annuity Insurers, which wrote that it is “strongly opposed” to the new emphasis on GLMs (p. 57); the Insured Retirement Institute, that GLMs and GAMs be excluded (p. 95); the National Association of Mutual Insurance Companies (NAMIC), that GLMs be removed from scope, one of its reasons being that “GLMs used for insurance pricing specifically are already being regulated, as parts of rate filing reviews” (pp. 149 to 150); and the National Alliance of Life Companies, that the working group reconsider including them (pp. 207 to 208). The National Alliance’s letter describes GLMs as “the standard statistical method behind experience studies, pricing and valuation assumptions, and simplified issue underwriting.” A vendor, Monitaur, welcomed the inclusion (p. 144). We did not assess AHIP’s position, because the redline attached to its letter does not show its edits in a form we could read. ↩
-
Minutes of the working group’s July 22, 2026 meeting, Attachment A in the materials for its August 13, 2026 meeting, PDF pages 2 to 3. Minutes report speech indirectly, so the wording is the minute-taker’s and not Commissioner Houdek’s. He was describing a question that interested parties and regulators had repeatedly raised, and the meeting took no decision on GLM scope. Its minutes (PDF pages 2 to 6) do not contain the word “underwriting.” The group adopted them on August 13; the copy linked is headed “Draft: 8/6/26.” ↩
-
Comments (note 1). All of the following are requests, and both exhibits are in version 5.0. NAIC Consumer Representatives (Lucy Culp, Adam Fox, Amy Killelea, Peter Kochenburger, and Silvia Yee), letter of September 29, 2026, pp. 79 to 82, at p. 80: “We continue to be concerned that AI model risk criteria are set by the insurance company.” NAMIC, p. 151: “NAMIC continues to suggest the removal of Exhibits C and D.” The Insured Retirement Institute asked that Exhibits C and D be removed or deferred until further piloting (p. 95), and ACLI that Exhibit C be expressly limited to identified high-risk models (p. 7). ↩
-
Comments (note 1): the Blue Cross Blue Shield Association at p. 51 (“some member Plans were asked to complete Exhibit C for all AI use cases identified in Exhibit A, including models the company had already assessed and determined to be low risk”) and NAMIC at p. 151 (“based on NAMIC member feedback, it does not appear that the majority of the piloting states utilized Exhibits C and D”). The two statements describe different things. One comes from an association of health plans and the other from an association of property and casualty insurers, and each supports a change its author asks for. On the pilot itself, see the minutes of the working group’s August 13, 2026 meeting, p. 1, which report speech indirectly; the copy linked is headed “Draft Pending Adoption,” and the draft August 31 minutes record its adoption. Commissioner Houdek said the 12 states in the pilot had been engaged since March, that some used the Supplement inside examinations they had already planned, market conduct or financial, and others as a stand-alone questionnaire outside the examination process, and that each state could modify or add questions. The minutes give no count of states for either use and name no state or company; the draft August 31 minutes refer to companies that participated in the pilot. Version 5.0 was released on August 31, 2026, after that report, so the pilot it describes ran on earlier text. ↩
-
Neither the bulletin nor version 5.0 of the Supplement contains the word. That is a statement about those two texts and not about state documents: New York’s Circular Letter No. 7 (note 14) has a proxy assessment. On the term itself, Azish Filabi and Sophia Duffy (The American College of Financial Services), writing for themselves in a journal the NAIC publishes, said in a 2021 paper on AI-enabled life underwriting that there was “not yet a standard definition of proxy discrimination within the context of insurance underwriting, nor a consensus on whether it is considered discriminatory intent or discriminatory impact”: “AI-Enabled Underwriting Brings New Challenges for Life Insurance: Policy and Regulatory Considerations,” Journal of Insurance Regulation 40, no. 8 (2021), https://content.naic.org/sites/default/files/JIR-ZA-40-08-EL.pdf. ↩
-
Colorado General Assembly, Senate Bill 21-169, signed act, adding C.R.S. 10-3-1104.9. Subsection (1) has the two prohibitions: the first lists race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, and gender expression, and the second applies “pursuant to rules adopted by the commissioner.” Subsection (8)(c) defines “insurance practice” and lists underwriting. The act is printed in capitals; quotations here are lowercased. On the rules, see Colorado Division of Insurance, SB21-169: Protecting Consumers from Unfair Discrimination in Insurance Practices, which records the adoption of Amended Regulation 10-1-1, effective October 15, 2025, under a title naming governance and risk management framework requirements for life insurers, private passenger automobile insurers, and health benefit plan insurers. Regulation 10-1-1 is codified at 3 CCR 702-10, and its Section 3 applies it to insurers offering individually issued life insurance, private passenger automobile insurance, and health benefit plans. Under its Life Insurance Underwriting heading, and no other, the Division’s page lists a “DRAFT PROPOSED Algorithm and Predictive Model Quantitative Testing Regulation” released for informal comments on September 28, 2023, and records that ACLI presented its own version of a draft at a stakeholder meeting on June 17, 2024. For auto, under its Private Passenger Auto Insurance Underwriting heading, the page says the Division “has issued a data call to the top ten private passenger auto insurers based on direct written premium through December 31, 2023.” A data call is a request for data, not a rule or a test. As read on October 9, 2026, the page gave no date for it, did not say what data were requested or what came of it, and listed no quantitative testing draft for auto. ↩ ↩2
-
Colorado’s newer statute, SB 26-189, applies to consequential decisions made on or after January 1, 2027, in a list of domains that includes insurance underwriting. Its section 6-1-1708(1)(a), however, treats an insurer subject to section 10-3-1104.9 as “in compliance with this part 17 in the practice of insurance.” We read that as leaving underwriting, for an insurer SB 21-169 covers, under the older statute; our Colorado guide explains who falls outside the provision. Colorado General Assembly, Senate Bill 26-189, signed act: C.R.S. 6-1-1701(3)(a) for “consequential decision,” 6-1-1701(6)(e) for the insurance covered domain, 6-1-1708(1)(a) for insurers subject to section 10-3-1104.9, and SECTION 5(3) for applicability from January 1, 2027. The act is printed in capitals; quotations here are lowercased. ↩
-
Colorado Division of Insurance, DRAFT PROPOSED New Regulation 10-2-xx, a draft concerning quantitative testing of external consumer data and information sources, algorithms, and predictive models used for life insurance underwriting. Section 3 applies it to all life insurers authorized to do business in Colorado, and Section 4 defines “Insurance Practice,” for the draft’s purposes, as life insurance underwriting. The passages relied on are Sections 5 through 8: estimating race and ethnicity, testing approval decisions, testing premium rates, and testing variables. BIFSG is Bayesian Improved First Name Surname Geocoding, applied to the name and geolocation information in the application. The draft tests race and ethnicity only, comparing Hispanic, Black, and Asian Pacific Islander applicants with White applicants. Approval is modeled by logistic regression and premium by linear regression, with the estimated groups entered as dummy variables, and policy type, face amount, age, gender, and tobacco use “may be accounted for as control variables.” Clearing both thresholds leads to “further testing.” The finding of unfair discrimination comes at the variable step, where the two models’ coefficients “shall be compared and any difference noted”: “If any ECDIS variable exhibits a difference, that ECDIS variable, and the algorithm or predictive model that uses that ECDIS variable, is deemed to have a direct relationship to a disproportionate negative outcome and is thus unfairly discriminatory requiring remediation.” ECDIS is the draft’s abbreviation for an external consumer data and information source. The draft would have the tests repeated annually, with a first report due April 1, 2024, and its effective date is left blank (“This regulation shall become effective on __________, 2024.”). Sections are cited by subject because the draft’s internal cross-references do not match its numbering. ↩ ↩2 ↩3
-
New York State Department of Financial Services, Insurance Circular Letter No. 7 (2024), July 11, 2024, “Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing,” addressed to all insurers authorized to write insurance in New York and to several other kinds of entity. Its opening says the Department is publishing it “in its final form,” and Section I says it “is not intended to address phases of the insurance product lifecycle other than underwriting and pricing.” Section II.B has the comprehensive assessment, its Steps 1 through 3, and the sentence on third-party claims of non-discrimination. Section II.C encourages “multiple statistical metrics” and gives the timing of testing. The passage on thresholds is in the opening summary of comments on the proposed letter, under Governance and Risk Management, where commenters “sought additional detail on thresholds for sufficiency across risk management procedures.” ↩ ↩2 ↩3
-
The NAIC Model Bulletin (note 4), in Section 4, items 2.1 through 2.3, says that where an investigation or examination concerns a system developed in whole or in part by a third party, the insurer should also expect requests that include its due diligence on the vendor, its vendor contracts, and its audits or other checks of the vendor’s compliance. The words quoted in the table are from New York’s 2024 letter (note 14). Its 2019 letter (note 16) had told life insurers the same in other words: “The burden remains with the insurer at all times.” Colorado’s draft (note 13) frames its tests around decisions in which the insurer “or a third party acting on behalf of the insurer” used the data or model. In the other direction, the American Council of Life Insurers asked in its September 29, 2026 comment letter on the Supplement (comments, note 1, p. 7) that for third-party systems and models an insurer “be required to provide only information reasonably available through its contractual rights and ordinary vendor-oversight processes,” and that the Supplement not imply that an insurer must produce source code, training data, model weights, or other information it has no legal or contractual right to obtain. That request concerns the draft Supplement and leaves the bulletin’s list as it is. ↩ ↩2
-
New York State Department of Financial Services, Insurance Circular Letter No. 1 (2019), January 18, 2019, “Use of External Consumer Data and Information Sources in Underwriting for Life Insurance,” addressed to insurers authorized to write life insurance in New York; Sections II and III. Section II reports the investigation and its conclusion, has the passage on vendors, and says what an adverse underwriting decision would include. Section III, the conclusion, reserves the Department’s right to examine underwriting algorithms and models, including in regular market conduct examinations, and to take disciplinary action. The letter calls its contents principles that “insurers should use as guidance.” It says the Department “commenced an investigation of insurers’ underwriting guidelines and practices in New York related to the use of external data in underwriting for life insurance,” and does not say how many insurers were investigated or which. Insurance Circular Letter No. 7 (2024) cites the 2019 letter and has a section clarifying it. ↩ ↩2
-
The search was run on October 9, 2026. The New York page is the Department of Financial Services’ insurance enforcement page, read by the titles of its entries; the consent orders themselves were not opened. The Pennsylvania document is a May 2025 market conduct examination report on one insurer, which does not contain the words algorithm, model, predictive, or score. Three web searches made up the rest. State enforcement databases were not searched one by one, so the finding reaches only as far as those places. ↩
-
Public Health Service Act §2702, “Guaranteed availability of coverage,” 42 U.S.C. §300gg-1 (issuers “must accept every employer and individual in the State that applies for such coverage”): https://www.law.cornell.edu/uscode/text/42/300gg-1. See also Public Health Service Act §2705, “Prohibiting discrimination against individual participants and beneficiaries based on health status,” 42 U.S.C. §300gg-4 (barring eligibility rules and premium differences based on health status, medical condition, claims experience, medical history, genetic information, or disability): https://www.law.cornell.edu/uscode/text/42/300gg-4. “Largely” carries the carve-outs: grandfathered plans, short-term limited-duration insurance, and excepted benefits sit outside this scope. ↩
The Bottom Line
- The NAIC Model Bulletin says an AI-assisted underwriting decision must meet the legal standards that already apply to it, regardless of the tools and methods used.
- Neither the bulletin nor the NAIC's draft exhibits set a fairness metric or testing interval, so the thresholds a department may ask for are the insurer's own.
- On the NAIC's draft exhibits an insurer would report a model that only advises an underwriter on eligibility or tier, and would report generalized linear models separately.
- A testing procedure exists only where a state has written one: New York's guidance lays out assessment steps for underwriting and pricing, and a 2023 Colorado draft proposed numeric thresholds for life underwriting only.
How to Build an AI Inventory by Line of Business for NAIC Exhibit A
Map your insurance AI systems by line of business for NAIC Exhibit A. Use this template to capture underwriting, pricing, claims, fraud, and customer service AI.
Continue →
Simon Li · Founding Editor
I write InsureAI Wire and maintain its 51-jurisdiction tracker. Most of the work is reading: NAIC working group papers, state bulletins, bills, court filings, and public comment letters. Every claim on the site carries the document it came from, so you never have to take my word for it.
Free · Weekly
Track these developments weekly
Get the InsureAI Wire dispatch in your inbox. Free, sourced, no spam.
Free weekly · No spam · Unsubscribe anytime
Related reading
What to Keep in an Insurance AI Decision Evidence Pack
Insurance AI decision documentation for reconstructing one underwriting or claims outcome, including human review, notice, appeal, and model version.
Will AI Replace Insurance Agents? What the Job Data Shows
Federal data rates insurance agents among the jobs most exposed to AI and still projects their numbers to grow through 2035.
Conversational AI in Insurance and Where the Rules Reach
What conversational AI and chatbots actually do across insurance, from quotes to claims, and the point where a customer-facing bot becomes a compliance question.
AI in Insurance Claims
AI in insurance claims, step by step from intake to appeal: what each system decides, where it can go wrong, and what record makes the step reviewable.
Information aggregation and analysis, not legal advice. See our disclaimer.