# NYDFS Circular Letter 7 vs the NAIC model bulletin: every difference, with the evidence on both sides

> New York is recorded as 'Independent framework' on the NAIC adoption map, under Insurance Circular Letter No. 7 (2024). The circular letter came seven months after the NAIC adopted the model bulletin. DFS borrowed one clause and says so: the third-party contract terms in §III.D are drawn from the model bulletin. Everything else is New York's own construction, and it is aimed at underwriting and pricing only.

- Source page: https://insureaiwire.com/states/new-york/
- Publication: InsureAI Wire
- Difference layer reviewed: 2026-08-18
- Measured against: naic-model-bulletin-2023-12-04 (parallel-framework)
- NAIC AI Systems Evaluation Tool pilot: not participating. Its own examination powers, under Insurance Law sections 308 and 309, are what apply instead. (https://content.naic.org/sites/default/files/call_materials/Pilot%20Project%20Summary.pdf)
- Method: every departure below is quoted from both instruments with a locator. Where one side has nothing to quote, the reading that established the absence is given in its place. Not legal advice.

## What is different

| Point | NAIC model | New York |
|---|---|---|
| Proxy assessment | — | Show external data is not a stand-in for a class |
| Three-step assessment | — | Three-step test; step 3 repeats every year |
| Named statistics | — | Six named statistics offered as candidates |
| Notice deadline | — | Written notice within 15 days of the decision |
| Policy approval | No review cadence set | Board signs off on the policies at least yearly |
| Model testing | Validate "as necessary" | Test at least yearly, model drift included |
| Adverse action detail | Tell consumers AI is in use | Name the data source behind the decision |
| Practices covered | Every regulated insurance practice | Underwriting and pricing only |
| Vendor contract terms | Audit rights where available | Same clause, taken from the NAIC bulletin |

An em dash means that instrument says nothing on the point. That is a finding, not a gap in the review.

## Every difference, with both texts

### Who and what it covers

#### Covers fewer insurers: The circular letter covers underwriting and pricing and says so explicitly. Claims handling, marketing and fraud detection are outside it. The model bulletin reaches every regulated insurance practice.

- Item id: ny-scope-underwriting-pricing
- NAIC model bulletin (Section 3, p.4): 'all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an "AIS Program") for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices.'
- New York (§I, Purpose and Background): 'This Circular Letter also is not intended to address phases of the insurance product lifecycle other than underwriting and pricing.'
- Source: Insurance Circular Letter No. 7 (2024) · NY DFS, retrieved 2026-08-18 via in-app browser page text (https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07)

### Testing you have to run

#### Extra requirement here: New York requires a proxy assessment: show that an external data source is not standing in for a protected class, and if it correlates, ask whether a legitimate business necessity requires using it anyway.

- Item id: ny-proxy-assessment
- Not in the model bulletin. Basis for that reading: "proxy" 0 hits in the model bulletin (word-boundary count over the 9-page, 28,577-character text, pypdf, 2026-08-18). The model has no concept of a stand-in variable and asks only for "bias analysis and minimization" at §3.2.
- New York (§II.A, Proxy Assessment): 'Insurers must be able to demonstrate that the ECDIS employed for underwriting and pricing are not prohibited by the Insurance Law … Insurers should evaluate the extent to which such ECDIS are correlated with (i.e., proxy for) status in any protected classes that may result in unfair or unlawful discrimination. … If such correlations are identified, insurers should consider whether the use of such ECDIS is required by a legitimate business necessity.'
- Source: Insurance Circular Letter No. 7 (2024) · NY DFS, retrieved 2026-08-18 via in-app browser page text (https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07)

#### Extra requirement here: A second and separate test: a three-step comprehensive assessment for disproportionate adverse effects, which loops rather than ends. No prima facie showing stops at Step 1; no less discriminatory alternative means repeating Step 3 every year.

- Item id: ny-three-step-assessment
- Not in the model bulletin. Basis for that reading: The model bulletin prescribes no test and no sequence: "quantitative" 0 hits, "disparate" 0 hits, "prima facie" 0 hits. Section 4 states outright that "The goal of the bulletin is not to prescribe specific practices or to prescribe specific documentation requirements." pypdf, 2026-08-18.
- New York (§II.B, Steps 1-3): 'Step 1: assessing whether the use of ECDIS or AIS produces disproportionate adverse effects … Step 2: assessing whether there is a legitimate, lawful, and fair explanation or rationale for the differential effect … Step 3: conducting and appropriately documenting a search and analysis for a less discriminatory alternative variable(s) or methodology … If no less discriminatory alternative exists, the insurer should conduct ongoing model risk management … and repeat Step 3 at least annually.'
- Source: Insurance Circular Letter No. 7 (2024) · NY DFS, retrieved 2026-08-18 via in-app browser page text (https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07)

#### Extra requirement here: New York goes as far as naming the statistics. Six metrics are listed by name, with the caveat that no one is expected to collect new data about individuals to compute them.

- Item id: ny-quantitative-metrics
- Not in the model bulletin. Basis for that reading: No metric is named anywhere in the model bulletin: "ratio" 0 hits, "odds" 0 hits, "metric" 0 hits, "quantitative" 0 hits. The single hit for "statistical" sits inside the definition of Model Drift, not in any testing expectation. §3.2 stops at "bias analysis and minimization". pypdf, 2026-08-18.
- New York (§II.C, Quantitative Assessment): 'Adverse Impact Ratio … Denials Odds Ratios … Marginal Effects … Standardized Mean Differences … Z-tests and T-tests … Drivers of Disparity … There is no expectation that insurers collect additional data from, or about, individuals to perform exemplary analysis.'
- Source: Insurance Circular Letter No. 7 (2024) · NY DFS, retrieved 2026-08-18 via in-app browser page text (https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07)

### Who signs off

#### Goes further here: New York puts a clock on board approval: policies and procedures reviewed and approved at least annually. The model bulletin lists governance items an insurer should consider addressing, with no cadence attached.

- Item id: ny-annual-policy-approval
- NAIC model bulletin (§2.0 introduction, p.5): 'An Insurer may consider adopting new internal governance structures or rely on the Insurer's existing governance structures; however, in developing its governance framework, the Insurer should consider addressing the following items:'
- New York (§III.B): 'An insurer's board of directors or other governing body, committees thereof, or senior management through delegated authority, should review and approve the insurer's ECDIS and AIS-related policies and procedures at least annually to ensure that they are kept current with changes in the insurer's use of ECDIS and AIS and best practices in the industry.'
- Supporting reading: "annual" appears three times in the model bulletin and all three are references to the Corporate Governance Annual Disclosure Model Act (#305) in the legal-basis section, not a cadence for the AIS Program. pypdf, 2026-08-18.
- Source: Insurance Circular Letter No. 7 (2024) · NY DFS, retrieved 2026-08-18 via in-app browser page text (https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07)

### Monitoring and controls

#### Goes further here: Model testing gets a floor. New York asks for testing at least annually including drift; the model bulletin asks for validation "as necessary" and offers methods a company "can" use.

- Item id: ny-annual-model-testing
- NAIC model bulletin (§3.4, p.6): 'Validating, testing, and retesting as necessary to assess the generalization of AI System outputs upon implementation, including the suitability of the data used to develop, train, validate and audit the model. Validation can take the form of comparing model performance on unseen data available at the time of model development to the performance observed on data post-implementation, measuring performance against expert review, or other methods.'
- New York (§III.B, documentation list): 'a description of testing conducted at least annually to assess the output of AIS models, including drift that may result from the use of machine learning or other automated updates'
- Source: Insurance Circular Letter No. 7 (2024) · NY DFS, retrieved 2026-08-18 via in-app browser page text (https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07)

### Vendors and outside data

#### Same thing, different words: The one place the two texts are the same text. DFS says in its own comment summary that it took this clause from the NAIC model bulletin, so a carrier reading both is looking at one requirement, not two.

- Item id: ny-third-party-clause-from-naic
- NAIC model bulletin (§4.2, p.7): 'Where appropriate and available, the inclusion of terms in contracts with third parties that: a) Provide audit rights and/or entitle the Insurer to receive audit reports by qualified auditing entities. b) Require the third party to cooperate with the Insurer with regard to regulatory inquiries and investigations related to the Insurer's use of the third-party's product or services.'
- New York (§III.D ¶3): 'Where appropriate and available, insurers should include terms in their contracts with third-party vendors that: (i) provide audit rights or entitle the insurer to receive audit reports by qualified auditing entities; and (ii) require the third-party vendor to cooperate with the insurer regarding regulatory inquiries and investigations related to the insurer's use of the third-party vendor's product or services.'
- Source: Insurance Circular Letter No. 7 (2024) · NY DFS, retrieved 2026-08-18 via in-app browser page text (https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07)

### What you tell the customer

#### Extra requirement here: A hard deadline the model has nowhere: fifteen days to tell an applicant why the automated route rejected them, with the manual underwriting route left running in the meantime.

- Item id: ny-15-day-notice
- Not in the model bulletin. Basis for that reading: The model bulletin contains no deadline of any kind: the pattern for a number followed by "day" or "days" matches 0 times, "within [number]" 0 times, "deadline" 0 times. pypdf, 2026-08-18.
- New York (§IV.F ¶3): 'Within 15-days of such a determination an insurer should provide notice to the applicant in writing … and the notice should identify the reason or reasons that the applicant cannot be underwritten for insurance using ECDIS or AIS. During the notice period the insurer should continue the non ECDIS or AIS-based underwriting process. An insurer's failure to provide this notice may be considered an unfair trade practice under Insurance Law Article 24.'
- Source: Insurance Circular Letter No. 7 (2024) · NY DFS, retrieved 2026-08-18 via in-app browser page text (https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07)

#### Goes further here: An adverse decision has to come with the source of the information behind it, and a vendor's trade secrets are not an excuse for vagueness. The model bulletin asks only for notice that AI is in use.

- Item id: ny-adverse-action-source-disclosure
- NAIC model bulletin (§1.9, p.5): 'The AIS Program should include processes and procedures providing notice to impacted consumers that AI Systems are in use and provide access to appropriate levels of information based on the phase of the insurance life cycle in which the AI Systems are being used.'
- New York (§IV.E ¶2-3): 'the reason or reasons provided to the insured or potential insured … should include details about all information upon which the insurer based any declination, limitation, rate differential, or other adverse underwriting decision, including the source of the specific information … An insurer may not rely on the proprietary nature of a third-party vendor's algorithmic processes to justify the lack of specificity related to an adverse underwriting or pricing action.'
- Source: Insurance Circular Letter No. 7 (2024) · NY DFS, retrieved 2026-08-18 via in-app browser page text (https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07)


## What the regulator asks for

| Obligation | Who | Cadence | Due | Citation |
|---|---|---|---|---|
| Two routes in: a regular or targeted examination under § 309, or a demand for a special report under § 308. The circular letter says both reach the use of these systems. | All insurers authorized to write in New York | on-request |  | §I, Purpose and Background |
| The reasoning behind the testing has to be written down, not just the result, and produced to the Department when asked. | Any insurer using ECDIS or AIS in underwriting or pricing | on-request |  | §II.C, Documentation |
| Evidence that someone with authority read and approved the policies this year. A signature and a date is the artefact an examiner can check. | Board, board committee, or senior management under delegated authority | annual | At least once a year | §III.B |
| Discrimination testing before go-live and on a regular cadence after; model output testing including drift at least annually. | Any insurer running AIS in underwriting or pricing | annual | Before go-live, then at least yearly | §II.C, Frequency of Testing |
| Complaints about these systems are a record class of their own, kept under 11 NYCRR 243 and producible on request. Note the register: this one says must, not should. | All insurers using AIS or ECDIS | continuous |  | §III.B, final paragraph |
| Written notice of why the automated route could not underwrite the applicant, plus a way to review the underlying data for accuracy, given at the time of that notice. | Insurers running an automated underwriting route alongside a manual one | event-driven | Within 15 days | §IV.F ¶4 |

- §I, Purpose and Background: 'The Department may audit and examine an insurer's use of ECDIS and AIS, including within the scope of regular or targeted examinations pursuant to New York Insurance Law ("Insurance Law") § 309, or a request for special report pursuant to Insurance Law § 308.'
- §II.C, Documentation: 'An insurer should appropriately document the processes and reasoning behind its testing methodologies and analysis for unfair or unlawful discrimination commensurate with the insurer's use of ECDIS and AIS … An insurer should be prepared to make such documentation available to the Department upon request.'
- §III.B: 'An insurer's board of directors or other governing body, committees thereof, or senior management through delegated authority, should review and approve the insurer's ECDIS and AIS-related policies and procedures at least annually…'
- §II.C, Frequency of Testing: 'Unfair or unlawful discrimination testing and analysis should be administered prior to putting AIS into production and on a regular cadence thereafter, as well as whenever material updates or changes are made to either the ECDIS or AIS.'
- §III.B, final paragraph: 'Insurers must be prepared to respond to consumer complaints and inquiries about the use of AIS and ECDIS by implementing procedures to receive and address such complaints. Insurers must maintain any records of complaints regarding AIS or ECDIS in accordance with 11 NYCRR 243 and be prepared to make such records available to the Department upon request.'
- §IV.F ¶4: 'This review process needs to be provided at the time the applicant is notified that the application cannot be processed under the underwriting process utilizing ECDIS or AIS described in paragraph 44 above. An insurer's failure to provide a review process may be considered an unfair trade practice under Insurance Law Article 24.'

NAIC AI Systems Evaluation Tool pilot: not participating. Its own examination powers, under Insurance Law sections 308 and 309, are what apply instead. (https://content.naic.org/sites/default/files/call_materials/Pilot%20Project%20Summary.pdf)

## If you write in more than one state

New York is the deepest testing regime of the three and the narrowest in reach. Two separate exercises apply to underwriting and pricing only, and nothing in the circular letter touches claims or fraud, so a carrier can be fully compliant in New York and untouched on the practices Colorado and the model bulletin both cover. What does not travel is the Colorado file: New York wants the reasoning behind the methodology, six named statistics as candidates, and a fifteen-day letter to the applicant. (This paragraph is InsureAI Wire's reading, resting on: ny-proxy-assessment, ny-three-step-assessment, ny-quantitative-metrics, ny-scope-underwriting-pricing, ny-15-day-notice.)

## What InsureAI Wire has written about New York

- NYDFS Circular Letter No. 7 and the AI Underwriting Proxy Test (https://insureaiwire.com/ny-dfs-circular-letter-7/) · The full guide to Circular Letter No. 7: which insurers it reaches, the proxy test NYDFS expects, and where the notice duty stops.
- NYDFS Warns Frontier AI Models Amplify Cybersecurity Risk (https://insureaiwire.com/news/nydfs-frontier-ai-cybersecurity-advisory/) · NYDFS warned regulated entities in May 2026 that frontier models amplify cybersecurity exposure, on a separate track from the underwriting letter.
- AI in Life Insurance Underwriting and the New Regulatory Test (https://insureaiwire.com/ai-in-life-insurance-underwriting/) · Where New York's testing procedure parts company with Colorado's for life carriers, and the one wrinkle that is easy to get backwards.

## Sources read

- Insurance Circular Letter No. 7 (2024), July 11, 2024 · NY DFS, retrieved 2026-08-18 via in-app browser page text (Cloudflare managed challenge blocks curl and WebFetch) (https://www.dfs.ny.gov/industry-guidance/circular-letters/cl2024-07)
- Model Bulletin: Use of Artificial Intelligence Systems by Insurers, adopted December 4, 2023 · NAIC, retrieved 2026-08-18 via curl + pypdf (9 pages, 28,577 characters) (https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf)
- AI Systems Evaluation Tool Pilot: Pilot Project Summary · NAIC, retrieved 2026-08-18 via curl + pypdf (357,714 bytes; the 12-state list on p.1 does not include New York) (https://content.naic.org/sites/default/files/call_materials/Pilot%20Project%20Summary.pdf)

Last reviewed Aug 18, 2026.