California Bulletin 2022-5 Targets AI Bias in Insurance

California Insurance Commissioner Ricardo Lara issued Bulletin 2022-5 on June 30, 2022, reminding insurers and licensees that they must avoid both conscious and unconscious bias or discrimination resulting from the use of artificial intelligence and other forms of big data. The bulletin reaches marketing, rating, underwriting, claims handling, and fraud investigation in any insurance transaction that affects California residents, businesses, and policyholders.

The bulletin restates obligations that the California Unruh Civil Rights Act and related insurance laws already imposed. But it was significant because it explicitly connected traditional fair-discrimination obligations to modern data sources and algorithmic models. The department put the duty of inquiry on the carrier. Before using any data collection method, fraud algorithm, or rating, underwriting, or marketing tool, insurers and licensees must conduct their own due diligence to ensure full compliance with all applicable laws. If a model or data source produces a discriminatory outcome, the insurer is responsible for it.

The bulletin identifies several concrete examples of concern. These include allegations that insurers unfairly flag claims from certain inner-city ZIP Codes for referral to their special investigative units, use biometric data obtained through facial recognition to influence whether to pay or deny claims, and collect biometric and other personal information unrelated to risk in marketing and underwriting. It also notes that external data sources such as geographical data, homeownership data, credit information, education level, civil judgments, and court records have a strong potential to disguise bias and discrimination even when they do not explicitly reference protected characteristics. A second list names factors the bulletin calls arbitrary, among them retail purchase history, social media, internet use, location tracking, and how a consumer appears in a photograph.

Disparate impact is the bulletin’s own word, and it appears exactly once, in the sentence about proxies: a purportedly neutral characteristic used as a stand-in for a prohibited one, producing racial bias, unfair discrimination, or disparate impact. The bulletin does not require any testing for it. The obligations it spells out are narrower and easier to audit against, and there are three of them. The first is due diligence before a tool goes into use. The second is a specific reason given to the consumer whenever a complex algorithm drives a declination, limitation, premium increase, or other adverse action. The third is the department’s reserved right to examine an insurer’s marketing, rating, claim, and underwriting criteria, programs, algorithms, and models.

The bulletin remains the department’s operative statement on AI and discrimination. In the four years since, California has issued no later bulletin on artificial intelligence or algorithmic bias, and 2022-5 is still carried on the department’s current bulletins page.

Carriers should also audit whether their current model testing would answer what the department can ask to see. As an InsureAI Wire risk-control recommendation, not a testing schedule stated in the bulletin, fairness analysis should be repeated when models are retrained, new data sources are added, or market conditions change. The bulletin reserves the department’s right to examine models, criteria, and outcomes, but it does not prescribe a recurring disparate-impact test. A model that passes a fairness test at launch can still produce discriminatory results in production if the underlying data distribution shifts. Because the examination right reaches the models themselves, documentation of testing methodology, dates, and responsible parties is what turns a defensible process into a demonstrable one. The same rigor should apply to any external data source used for marketing, rating, or claims triage. If a vendor cannot explain how a data element is derived, or if the carrier cannot reproduce the score with its own records, the data should not be used in a decision that affects a consumer until the gap is closed.

The operational question is whether a retrain triggers a fairness re-test automatically or waits for someone to remember. Wire it into the model release checklist rather than the annual compliance calendar, and keep each bias-testing record filed against the model version it actually tested.