NYDFS Circular Letter No. 7 and the AI Underwriting Proxy Test

On July 11, 2024, the New York State Department of Financial Services (NYDFS) issued Insurance Circular Letter No. 7 (2024), “Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing.”¹ The letter is not new legislation. It is the NYDFS’s formal explanation of how existing New York insurance law applies to ECDIS and AIS in underwriting and pricing decisions in New York. For any insurer authorized to write business in the state, it functions as a compliance roadmap for ECDIS and AIS in insurance underwriting and pricing.

This article breaks down the scope of NYDFS Circular Letter No. 7, the ECDIS and AIS definitions that control its reach, the proxy test it requires, and the operational obligations that carriers must meet before using third-party data or AI models in underwriting or pricing.

What does NYDFS Circular Letter No. 7 cover?

NYDFS Circular Letter No. 7 applies to all insurers authorized to write insurance in New York State, including P&C, life, and health carriers, HMOs, Article 43 corporations, licensed fraternal benefit societies, and the New York State Insurance Fund.² It governs the use of artificial intelligence systems (AIS) and external consumer data and information sources (ECDIS) in underwriting and pricing.

Circular Letter No. 7 is the most comprehensive ECDIS AIS insurance rule issued by a U.S. state regulator to date. It treats artificial intelligence systems and external consumer data as a single risk vector when they affect underwriting or pricing. The circular letter covers three specific uses:

• AI or external data used to supplement traditional underwriting or pricing.
• AI or external data used as a proxy for traditional underwriting or pricing.
• AI or external data used to identify “lifestyle indicators” that contribute to an underwriting or pricing assessment.³

It does not apply to claims adjusting, marketing, fraud detection, or other insurer functions.⁴ It also does not apply to Child Health Plus, Essential Plan, or Medicaid managed care coverage.⁵

What are ECDIS and AIS in insurance underwriting and pricing?

ECDIS means external consumer data and information sources. The term covers data points not directly related to the risk being underwritten but used to supplement or replace traditional underwriting. Examples include credit scores, purchase history, social media activity, location data, and behavioral scores.⁶

AIS means artificial intelligence systems. The circular letter defines this broadly to include machine learning and other automated systems that assist or replace underwriting and pricing decisions.⁷ Importantly, the guidance applies to AIS even when the insurer does not use ECDIS. If a carrier uses AI in underwriting or pricing, the letter’s core obligations apply.⁸

This ECDIS and AIS framework matters because many carriers assume ECDIS and AIS are linked. They are not. A carrier using a proprietary machine-learning model on traditional data must still comply with Circular Letter No. 7.

In practical terms, ECDIS and AIS in insurance underwriting cover any automated or data-driven step that influences whether a policy is issued and at what price. Credit-based insurance scores, behavioral telemetry, aerial imagery, and social-media-derived signals all fall under ECDIS. A neural network trained only on traditional application data still counts as AIS. When ECDIS and AIS in insurance underwriting are combined, the compliance burden doubles: the insurer must validate both the external data source and the AI model that consumes it.

Why does New York regulate AI underwriting and pricing separately?

New York has long treated insurance underwriting and pricing as a distinct regulatory domain. Rather than adopting the NAIC Model Bulletin’s principles-based governance approach, NYDFS built Circular Letter No. 7 on existing state anti-discrimination statutes.⁹ This means AI underwriting New York is not governed by a voluntary framework; it is governed by existing insurance law, enforced through the NYDFS’s market conduct authority.

The practical consequence is that New York-licensed insurers must satisfy a state-specific standard. A program that meets NAIC guidance may still fall short of Circular Letter No. 7, especially on the proxy test, the 15-day adverse-action notice, and vendor audit rights.

What is the proxy test Circular Letter No. 7 requires?

The proxy test is the heart of the circular letter. The NYDFS states that an insurer should not use ECDIS or AIS in underwriting or pricing unless the insurer can establish, through a comprehensive assessment, that the use does not result in unfair or unlawful discrimination.¹⁰

Specifically, the insurer must evaluate the extent to which an ECDIS or AIS is correlated with membership in a protected class. This correlation can be determined using data available to the insurer or inferred by the insurer using accepted statistical methodologies.¹¹ If a correlation is found, the insurer must then consider whether the use of that ECDIS or AIS is required by a legitimate business necessity.¹²

This is not a pure prohibition. The final letter softened the draft’s proxy language. The draft would have required insurers to demonstrate that ECDIS do not serve as a proxy for protected classes. The final letter requires only that insurers evaluate the correlation and consider business necessity.¹³ But the burden remains on the insurer to document the analysis, the methodology, and the conclusion.

What counts as unfair discrimination in AI underwriting under New York law?

Circular Letter No. 7 does not define “unfair” or “unlawful” discrimination. Instead, it points to existing New York and federal statutes.¹⁴ For insurers, this means the concepts already embedded in New York insurance law control the analysis. Unfair discrimination AI underwriting generally refers to rate or underwriting distinctions that are not justified by the risk being insured.¹⁵

The practical effect is that an ECDIS or AIS variable that correlates with a protected class and is not required by a legitimate business necessity creates a compliance risk. Legitimate business necessity means the variable is substantially related to the risk being underwritten and there is no less discriminatory alternative available.¹⁶

What must an insurer do before using ECDIS or AIS?

Circular Letter No. 7 requires a governance framework before deployment. The framework must include:

1. Risk identification. The insurer must identify the risks of unfair or unlawful discrimination associated with the ECDIS or AIS.
2. Testing and validation. The insurer must test the system for bias and validate its outputs before deployment and periodically after deployment.¹⁷
3. Human oversight. The insurer must ensure qualified personnel review the system and its outputs.
4. Documentation. The insurer must maintain records of the assessment, testing, validation, and ongoing monitoring.¹⁸
5. Board or senior management reporting. The insurer must report on AI and ECDIS governance to senior management or the board.¹⁹

This framework is principles-based, but the expectation is concrete. An insurer cannot deploy an ECDIS or AIS and then investigate fairness after the fact.

What notice must an insurer give after an adverse AI underwriting decision in New York?

When an insurer makes an adverse underwriting or pricing decision based on ECDIS or AIS, it must provide a written notice to the consumer within 15 days of the decision.²⁰ The notice must:

• State that the adverse decision was based in whole or in part on ECDIS or AIS.
• Provide the specific source or sources of the information that contributed to the decision.
• Explain how the consumer can obtain more information about the decision, including the right to appeal or request correction of inaccurate information.²¹

This 15-day requirement is one of the most specific operational obligations in the letter. It gives consumers a concrete right to understand and challenge AI-driven decisions.

What are the third-party vendor requirements?

Insurers cannot outsource compliance to a vendor. Circular Letter No. 7 requires that contracts with third-party ECDIS or AIS providers include appropriate provisions to ensure the insurer can meet its obligations.²² The contract should grant the insurer the right to audit the vendor’s data, models, and practices.²³

The NYDFS expects insurers to know how their vendors source data, test models, and document methodology. If a vendor refuses to share information, the insurer must either find another vendor or accept that the system cannot be used in New York.

Does NYDFS Circular Letter No. 7 apply to AI without external data?

Yes. The final letter clarifies that the guidance applies to a licensed insurer’s use of AIS even absent the use of ECDIS.²⁴ This is a significant expansion from the draft, which some commenters had interpreted as applying only when AI systems used external consumer data. If an insurer uses AI in underwriting or pricing, the governance, testing, and documentation requirements apply regardless of whether the inputs are proprietary or third-party.²⁵

What is the relationship between NYDFS Circular Letter No. 7 and the NAIC Model Bulletin?

The NYDFS deliberately did not adopt the NAIC Model Bulletin framework.⁹ New York built its guidance on existing anti-discrimination statutes rather than the NAIC’s principles-based governance model. This means carriers operating in New York must satisfy a distinct, state-specific standard for AI underwriting in New York.

The NAIC Model Bulletin is useful as a governance baseline, but it does not substitute for Circular Letter No. 7. Carriers should compare their NAIC-aligned program against the NYDFS requirements to identify gaps, particularly around the proxy test, the 15-day adverse-action notice, and vendor audit rights.²⁶

What should insurers do next?

Carriers subject to NYDFS Circular Letter No. 7 should take five steps:

1. Inventory ECDIS and AIS. Identify every external data source and AI model used in underwriting and pricing in New York.
2. Run proxy assessments. For each ECDIS or AIS variable, evaluate correlation with protected classes using accepted statistical methods. Document the analysis and any conclusion about business necessity.
3. Build the 15-day notice process. Ensure adverse-action letters meet the letter’s specific requirements, including data source identification and appeal rights.
4. Audit vendor contracts. Add audit rights, data-source disclosure, and model-documentation requirements to third-party agreements.
5. Train underwriters and compliance staff. Make sure the people who use AI systems understand when the system has contributed to a decision and what notice obligations are triggered.

FAQ

What are ECDIS and AIS in insurance? ECDIS means external consumer data and information sources. AIS means artificial intelligence systems. NYDFS Circular Letter No. 7 regulates the use of ECDIS and AIS in underwriting and pricing by New York-licensed insurers.

What is the proxy test under NYDFS Circular Letter No. 7? The proxy test requires insurers to evaluate whether an ECDIS or AIS variable is correlated with a protected class. If a correlation exists, the insurer must consider whether the variable is required by a legitimate business necessity. This is the central fairness test in Circular Letter No. 7.

Does NYDFS Circular Letter No. 7 apply to AI without external data? Yes. The final letter clarifies that the guidance applies to a licensed insurer’s use of AIS even absent the use of ECDIS. Any AI used in underwriting or pricing in New York is in scope.

What notice must an insurer give after an adverse AI underwriting decision? The insurer must provide a written notice within 15 days. The notice must state that the adverse decision was based in whole or in part on ECDIS or AIS, identify the specific sources used, and explain the consumer’s appeal or correction rights.

What is unfair discrimination AI underwriting under New York law? Unfair discrimination AI underwriting refers to rate or underwriting distinctions that are not justified by the risk being insured. Circular Letter No. 7 points to existing New York anti-discrimination statutes for the legal standard, but the practical risk is that an ECDIS or AIS variable correlates with a protected class without a legitimate business necessity.

The Bottom Line on NYDFS Circular Letter No. 7

NYDFS Circular Letter No. 7 is the most specific AI underwriting and pricing guidance issued by any U.S. state insurance regulator. It does not ban ECDIS or AIS, but it requires insurers to prove, through a documented proxy test, that their use of these tools does not produce unfair discrimination. The 15-day adverse-action notice and vendor audit requirements give the guidance teeth.

For New York-licensed insurers, compliance is not optional and cannot be delegated. The carrier remains responsible for the AI and external data it uses in AI underwriting in New York, no matter who built the model.

For related guidance, see our analysis of AI in underwriting insurance, AI vendor risk assessment, and Health Insurance AI Governance.

Footnotes

1. New York State Department of Financial Services, Insurance Circular Letter No. 7 (2024), July 11, 2024: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

2. NYDFS Circular Letter No. 7, TO field: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

3. NYDFS Circular Letter No. 7, Scope section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

4. Sullivan & Cromwell, “NYDFS Final Guidance on Use of AI in Insurance Underwriting and Pricing,” July 12, 2024: https://www.sullcrom.com/SullivanCromwell/_Assets/PDFs/Memos/NYDFS-Final-Guidance-AI-Use-Insurance-Underwriting-Pricing.pdf ↩

5. NYDFS Circular Letter No. 7, Scope section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

6. NYDFS Circular Letter No. 7, Definitions section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

7. NYDFS Circular Letter No. 7, Definitions section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

8. Sullivan & Cromwell, “NYDFS Final Guidance on Use of AI in Insurance Underwriting and Pricing,” July 12, 2024: https://www.sullcrom.com/SullivanCromwell/_Assets/PDFs/Memos/NYDFS-Final-Guidance-AI-Use-Insurance-Underwriting-Pricing.pdf ↩

9. WaterStreet Company, “New York DFS Circular Letter 2024-7: What the Proxy Test Actually Requires of Insurance AI,” April 10, 2026: https://www.waterstreetcompany.com/new-york-dfs-circular-letter-2024-7-what-the-proxy-test-actually-requires-of-insurance-ai/ ↩ ↩²

10. NYDFS Circular Letter No. 7, Proxy Assessment section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

11. Sullivan & Cromwell, “NYDFS Final Guidance on Use of AI in Insurance Underwriting and Pricing,” July 12, 2024: https://www.sullcrom.com/SullivanCromwell/_Assets/PDFs/Memos/NYDFS-Final-Guidance-AI-Use-Insurance-Underwriting-Pricing.pdf ↩

12. NYDFS Circular Letter No. 7, Proxy Assessment section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

13. Sullivan & Cromwell, “NYDFS Final Guidance on Use of AI in Insurance Underwriting and Pricing,” July 12, 2024: https://www.sullcrom.com/SullivanCromwell/_Assets/PDFs/Memos/NYDFS-Final-Guidance-AI-Use-Insurance-Underwriting-Pricing.pdf ↩

14. NYDFS Circular Letter No. 7, “Unlawful or Unfair Discrimination” section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

15. New York Insurance Law § 2303 (unfair discrimination): https://www.nysenate.gov/legislation/laws/ISC/2303 ↩

16. NYDFS Circular Letter No. 7, Proxy Assessment section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

17. NYDFS Circular Letter No. 7, Governance Framework section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

18. NYDFS Circular Letter No. 7, Governance Framework section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

19. NYDFS Circular Letter No. 7, Governance Framework section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

20. NYDFS Circular Letter No. 7, Notice section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

21. NYDFS Circular Letter No. 7, Notice section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

22. NYDFS Circular Letter No. 7, Third-Party Vendor section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

23. Sullivan & Cromwell, “NYDFS Final Guidance on Use of AI in Insurance Underwriting and Pricing,” July 12, 2024: https://www.sullcrom.com/SullivanCromwell/_Assets/PDFs/Memos/NYDFS-Final-Guidance-AI-Use-Insurance-Underwriting-Pricing.pdf ↩

24. Sullivan & Cromwell, “NYDFS Final Guidance on Use of AI in Insurance Underwriting and Pricing,” July 12, 2024: https://www.sullcrom.com/SullivanCromwell/_Assets/PDFs/Memos/NYDFS-Final-Guidance-AI-Use-Insurance-Underwriting-Pricing.pdf ↩

25. NYDFS Circular Letter No. 7, Scope section: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩

26. NYDFS Circular Letter No. 7, Statutory and Regulatory References: https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07 ↩