Underwriting AI Under a Regulator's Lens

The underwriter’s inbox has never been fuller. Accelerated underwriting platforms return a risk class in minutes. P&C carriers ingest telematics, aerial imagery, and weather data before quoting a policy. Health insurers use algorithms to flag high-risk applicants. The same technology that makes underwriting faster also makes it the most scrutinized part of an insurance AI program.

Regulators know this. The NAIC’s AI Systems Evaluation Tool, now being piloted in twelve states, treats underwriting as a primary operational area.¹ Examiners are not asking whether carriers use AI in underwriting. They are asking how the carrier knows the AI is fair, traceable, and properly governed.

This article explains what AI in underwriting insurance looks like across P&C, life, and health lines, and what underwriters and compliance teams should prepare before the examiner arrives.

Why Underwriting Is the Natural Test Case for AI Regulation

Underwriting is where an insurer decides who to cover and what to charge. That decision is the definition of a consequential decision under most state AI laws and the NAIC Model Bulletin.² It directly affects consumers’ access to coverage and the price they pay. It also tends to use the richest and most sensitive data: driving behavior, health history, property condition, financial records.

Because underwriting is both high-impact and data-intensive, it attracts attention from three directions at once:

• State insurance regulators want to know that pricing and selection practices do not produce unfair discrimination.
• State AI laws such as Colorado’s SB 26-189 require disclosure and human review when automated systems materially influence decisions.³
• Consumer advocates and plaintiffs’ lawyers look for adverse outcomes that appear correlated with protected classes.

The result is that underwriting is no longer just a pricing or risk-selection exercise. It is a compliance exercise with a risk-selection component.

What the NAIC Evaluation Tool Asks About Underwriting

The NAIC AI Systems Evaluation Tool is organized into four exhibits. Three of them are directly relevant to underwriting.

Exhibit A: AI Usage Inventory. Carriers identify which operational or program areas use AI. Underwriting is explicitly listed as an operational/program area.⁴ The examiner wants to know which systems are used, which decisions they support, and how many consumers are affected. A carrier that cannot produce a complete inventory starts the exam behind.

Exhibit C: High-Risk AI Systems. This exhibit focuses on systems that have a significant influence on adverse consumer outcomes.⁵ Underwriting systems that decline coverage, assign risk classes, or apply surcharges are likely to be classified here. The examiner will ask for governance documentation, risk assessments, and evidence of human oversight.

Exhibit D: AI Systems Data Details. This is where the technical scrutiny intensifies. Examiners ask about the sources of data used in the model, the quality controls applied, the representativeness of the data, and the testing performed to identify proxy discrimination.⁶ For underwriting models, this is where zip code, credit information, prior claims, and third-party data sources come under review.

The NAIC is not inventing new law. It is asking carriers to demonstrate that their existing obligations under unfair discrimination and unfair trade practice laws are being met in the AI context.

Three Lines, Three Different Underwriting Risks

P&C Underwriting

Property and casualty underwriting has adopted AI rapidly because the data sources are abundant and relatively structured. Common applications include:

• Auto insurance: Telematics and usage-based insurance models score driving behavior in real time. Regulators ask whether the scoring correlates with protected classes and whether consumers receive adequate notice.
• Homeowners insurance: Aerial imagery, roof-age estimates, and catastrophe models influence pricing and eligibility. Colorado and other states have raised questions about whether these tools lead to coverage withdrawal in certain neighborhoods.³
• Commercial insurance: Submission scoring, risk aggregation tools, and natural catastrophe models help underwriters prioritize accounts. The challenge is explaining why a model recommends a declination when the underlying risk is complex.

The dominant risk in P&C is proxy discrimination. A variable that appears neutral, such as roof age or distance to a fire station, can correlate with race or income when mapped across a geographic area.

Life Underwriting

Life insurance accelerated underwriting uses predictive models and electronic health records to bypass traditional fluid testing. The benefits are faster issuance and lower friction. The risks are different:

• Health data sensitivity: The data used, including prescription history, medical claims, and electronic health records, is highly sensitive and tightly regulated under state and federal privacy laws.
• Mortality scoring opacity: Models that predict mortality are difficult to explain to consumers and regulators.
• Historical bias: Training data from decades of manual underwriting may embed the biases of earlier underwriting practices.

The American Academy of Actuaries and the Society of Actuaries have both warned that life insurers must test accelerated underwriting models for fairness across demographic groups.⁷

Health Underwriting

Health underwriting in the United States operates under tighter constraints than P&C or life. The Affordable Care Act largely prohibits medical underwriting in individual health insurance. But AI is still used in several related areas:

• Risk adjustment: Models predict the expected cost of enrolled populations to set risk-adjustment payments. Bias here can shift dollars between plans.
• Medicaid eligibility: States use automated systems to determine eligibility, which can affect coverage access.
• Supplemental health and short-term plans: These products may still use health-related underwriting, where AI models face scrutiny under both insurance law and consumer protection law.

Health underwriting AI sits at the intersection of insurance regulation and health equity law, making it one of the most regulated areas. For a deeper look, see our analysis of AI in health insurance governance.

The Proxy Discrimination Problem

Proxy discrimination is the central technical risk in AI underwriting. It occurs when a model uses variables that are not themselves protected class characteristics but correlate strongly with them.

Common examples include:

• Zip code and geographic variables, which can correlate with race or income.
• Credit-based insurance scores, which correlate with income and, in some jurisdictions, race.
• Occupation and education, which can serve as proxies for gender, age, or socioeconomic status.
• Social media and behavioral data, which regulators increasingly view as opaque and potentially discriminatory.

Testing for proxy discrimination requires more than checking whether protected class variables are included in the model. It requires measuring whether the model’s outcomes have a disparate impact on protected groups. Regulators in New York, Colorado, and California have all signaled that disparate impact analysis is part of the exam.⁸

A practical test is to run the model’s predictions against protected class membership at the population level and measure whether the adverse outcome rate is statistically different across groups. If it is, the carrier must be able to explain why the variable is actuarially justified and not a proxy for a prohibited characteristic.

What Underwriters Should Do Before the Exam

A defensible underwriting AI program can be built in five steps:

1. Inventory every underwriting AI system. Map each system to the underwriting decision it supports, the line of business, and the volume of consumers affected. This is the Exhibit A response. A useful inventory includes the system name, vendor or owner, model version, data sources, and the specific decision the model supports. Without this map, the rest of the work is guesswork.

2. Classify systems by risk. Separate high-risk systems, those that directly influence declinations, pricing, or risk classification, from lower-risk systems that merely assist with workflow. High-risk systems need the full Exhibit C and D treatment. A system that recommends whether to accept or decline a life insurance application is high risk. A system that extracts data from application PDFs is lower risk.

3. Document data lineage and perform proxy discrimination testing. For each high-risk model, identify the data sources, explain how the data was selected and cleaned, and produce bias testing results. This is the Exhibit D response. The testing should measure both input-level fairness, whether protected class variables or close proxies are included, and outcome-level fairness, whether the model produces disparate adverse outcomes across demographic groups.

4. Build human-in-the-loop and override records. Regulators want evidence that humans review adverse decisions and that the model does not override human judgment without documentation. Keep records of overrides, including the reason and the outcome. A system that allows an underwriter to override a declination but never documents why is not a compliant system.

5. Prepare the examiner conversation. Draft answers to the most likely questions: What does this model do? How do you know it is fair? Who owns it? When was it last tested? What would you do if a test showed disparate impact? The underwriter who can answer these questions calmly is the one who has already done the work.

Vendor and Third-Party Risk

Many underwriting models are purchased from vendors or built on third-party data. That does not shift the compliance burden. The NAIC Model Bulletin and state laws make clear that the insurer is responsible for the outcomes of systems it deploys, regardless of who built them.⁹

Underwriting teams should work with procurement and legal to ensure vendor contracts include:

• Rights to audit model documentation and testing results.
• Notification of model updates or retraining.
• Restrictions on using the insurer’s data to train models for other customers.
• Clear allocation of liability for discriminatory outcomes.

For a detailed checklist, see our guide to AI vendor risk assessment.

FAQ

Does the NAIC Model Bulletin apply to underwriting models? Yes. Underwriting is one of the core areas where AI systems can produce or support adverse consumer outcomes. The NAIC Model Bulletin expects insurers to have governance, testing, and documentation programs that apply to these models.²

What is the difference between Exhibit A and Exhibit D in the NAIC Evaluation Tool? Exhibit A is an inventory. It asks what systems you have, where they are used, and how many consumers they affect. Exhibit D is a technical deep dive. It asks where the data came from, how it was tested, and whether the model produces proxy discrimination.⁴⁶

Is AI underwriting banned? No. Regulators are not banning AI in underwriting. They are requiring insurers to demonstrate that their AI systems comply with existing insurance laws, including prohibitions on unfair discrimination and unfair trade practices.

Do I need to stop using third-party underwriting models? No. But you must perform due diligence on the vendor and maintain contract controls that preserve your right to audit and require model-change notifications. The insurer remains responsible for the outcomes of any model it deploys.⁹

How often should underwriting models be tested for bias? At least annually, and more often when the model is retrained, deployed in a new market, or expanded to a new use case. High-risk models that influence pricing or declinations should be tested quarterly or semi-annually.

Conclusion

AI in underwriting insurance is not a future risk. It is a current exam topic. The NAIC’s twelve-state pilot, Colorado’s SB 26-189, and New York’s Circular Letter No. 7 all point to the same expectation: carriers must be able to explain what their underwriting models do, where the data comes from, and how they know the outcomes are fair.

The underwriters who prepare now will walk into the exam with documentation and confidence. The ones who wait will be explaining why they cannot answer basic questions about the systems they rely on every day.

For related guidance, see our analysis of Colorado SB 26-189’s impact on insurers and our guide to the NAIC Model Bulletin.

Footnotes

1. National Association of Insurance Commissioners, “AI Systems Evaluation Tool 4.0,” 2025: https://content.naic.org/sites/default/files/inline-files/AI%20Systems%20Evaluation%20Tool%204.0%20%28Clean%29.pdf ↩

2. National Association of Insurance Commissioners, “Model Bulletin on the Use of Artificial Intelligence Systems by Insurers,” December 2023: https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf ↩ ↩²

3. Colorado General Assembly, “SB26-189 Automated Decision-Making Technology”: https://leg.colorado.gov/bills/sb26-189 ↩ ↩²

4. National Association of Insurance Commissioners, “AI Systems Evaluation Tool 4.0, Exhibit A: AI Usage Inventory,” 2025: https://content.naic.org/sites/default/files/inline-files/AI%20Systems%20Evaluation%20Tool%204.0%20%28Clean%29.pdf ↩ ↩²

5. National Association of Insurance Commissioners, “AI Systems Evaluation Tool 4.0, Exhibit C: High-Risk AI Systems,” 2025: https://content.naic.org/sites/default/files/inline-files/AI%20Systems%20Evaluation%20Tool%204.0%20%28Clean%29.pdf ↩

6. National Association of Insurance Commissioners, “AI Systems Evaluation Tool 4.0, Exhibit D: AI Systems Data Details,” 2025: https://content.naic.org/sites/default/files/inline-files/AI%20Systems%20Evaluation%20Tool%204.0%20%28Clean%29.pdf ↩ ↩²

7. American Academy of Actuaries, “AI-Enabled Underwriting Brings New Challenges for Life Insurance,” 2025: https://content.naic.org/sites/default/files/JIR-ZA-40-08-EL.pdf ↩

8. New York State Department of Financial Services, “Insurance Circular Letter No. 7 (2024): Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing,” July 11, 2024: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

9. National Association of Insurance Commissioners, “Health Insurance Artificial Intelligence/Machine Learning Survey Results,” May 2025: https://content.naic.org/sites/default/files/inline-files/Health%20Survey%20Report%20-%20FINAL%205.9.25.pdf ↩ ↩²