Texas Bulletin B-0036-20 on Third-Party Data

The Texas Department of Insurance issued Commissioner’s Bulletin B-0036-20 on September 30, 2020, to remind all regulated entities that they are responsible for the accuracy of data used in rating, underwriting, and claims handling even when that data comes from a third party. The bulletin does not create a new legal duty, but it clarified that TDI may pursue enforcement action against an insurer if the use of inaccurate data harms policyholders.

The bulletin is short, but it carries a long shadow. It was issued before the current wave of AI and advanced analytics adoption, yet it directly addresses the risk that insurers now face when they license external data, embed vendor models, or use AI tools that rely on third-party information. The core message is that outsourcing a function does not outsource responsibility. An insurer cannot blame a data vendor or a model vendor if the information used to rate, underwrite, or deny a claim turns out to be wrong.

TDI specifically encouraged insurers to give policyholders a way to review and correct data being used about them. Newer AI governance frameworks pick up part of that idea without going as far. The NAIC Model Bulletin asks for processes that notify affected consumers that AI systems are in use and give them access to appropriate levels of information, which is a notice duty rather than a correction right; the correction right shows up in state laws on consumer notice and appeal. In that sense, B-0036-20 was an early statement of what has become a central theme in insurance AI regulation: the carrier owns the outcome, even if a third party owns the algorithm.

For insurers, the bulletin remains relevant because third-party data use is only increasing. Carriers now commonly use external data for everything from property replacement costs and vehicle history to medical records and social media signals. Each of those data sources is a potential point of failure. If the data is inaccurate, stale, or misapplied, the insurer is responsible for the consumer harm, not the data broker.

The practical response is to treat third-party data and models as part of the carrier’s own risk management program. That means verifying data quality, understanding how models transform raw data into scores, monitoring outcomes for errors and bias, and giving consumers a clear path to dispute and correct information. Vendor due diligence is a starting point, but it does not end the carrier’s obligation.

The bulletin is also relevant to current AI governance frameworks. The NAIC Model Bulletin and many state AI laws now require carriers to document, test, and monitor AI systems. B-0036-20 anticipated this by making clear that the regulated entity owns the risk. A vendor contract that shifts liability to the model provider is not a substitute for a carrier’s own governance program, because regulators and courts will look at who made the decision that affected the consumer.

Texas has since issued Bulletin B-0003-26 on AI governance, and the state’s data localization and healthcare AI disclosure rules continue to evolve. Neither one withdraws B-0036-20, which TDI still carries on its 2020 bulletin index. It still does the load-bearing work, because it settled the question the newer rules assume rather than restate: the carrier that uses the data answers for it. That is why a vendor risk assessment written for Texas starts with the carrier’s own controls and treats the vendor’s representations as evidence rather than as coverage.