InsureAI Wire

State AI Regulation Tracker

New York

Reviewed Aug 18, 2026 Markdown →

New York regulates insurer AI under its own circular letter, Insurance Circular Letter No. 7 (2024), rather than the NAIC model bulletin. Every place its text departs from the NAIC model bulletin, Dec 2023 is set out below, with the evidence on both sides.

On this page

What's different

The national model vs New York
Point-by-point comparison of the NAIC model bulletin and New York's own text. Each row links to the evidence on both sides.
NAIC model New York
Proxy assessment — Show external data is not a stand-in for a class
Three-step assessment — Three-step test; step 3 repeats every year
Named statistics — Six named statistics offered as candidates
Notice deadline — Written notice within 15 days of the decision
Policy approval No review cadence set Board signs off on the policies at least yearly
Model testing Validate "as necessary" Test at least yearly, model drift included
Adverse action detail Tell consumers AI is in use Name the data source behind the decision
Practices covered Every regulated insurance practice Underwriting and pricing only
Vendor contract terms Audit rights where available Same clause, taken from the NAIC bulletin

Click a row for the evidence on both sides. An em dash means that instrument says nothing on the point.

Related coverage

3 selected items · Reviewed Aug 24, 2026

What we compared it with

Reviewed Aug 18, 2026

The circular letter came seven months after the NAIC adopted the model bulletin. DFS borrowed one clause and says so: the third-party contract terms in §III.D are drawn from the model bulletin. Everything else is New York's own construction, and it is aimed at underwriting and pricing only.

Every difference, with both texts

9 found

New York requires a proxy assessment: show that an external data source is not standing in for a protected class, and if it correlates, ask whether a legitimate business necessity requires using it anyway.

Show the exact wording Hide the exact wording

Not in the model bulletin

"proxy" 0 hits in the model bulletin (word-boundary count over the 9-page, 28,577-character text, pypdf, 2026-08-18). The model has no concept of a stand-in variable and asks only for "bias analysis and minimization" at §3.2.

New York §II.A, Proxy Assessment

Insurers must be able to demonstrate that the ECDIS employed for underwriting and pricing are not prohibited by the Insurance Law … Insurers should evaluate the extent to which such ECDIS are correlated with (i.e., proxy for) status in any protected classes that may result in unfair or unlawful discrimination. … If such correlations are identified, insurers should consider whether the use of such ECDIS is required by a legitimate business necessity.

Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

A second and separate test: a three-step comprehensive assessment for disproportionate adverse effects, which loops rather than ends. No prima facie showing stops at Step 1; no less discriminatory alternative means repeating Step 3 every year.

Show the exact wording Hide the exact wording

Not in the model bulletin

The model bulletin prescribes no test and no sequence: "quantitative" 0 hits, "disparate" 0 hits, "prima facie" 0 hits. Section 4 states outright that "The goal of the bulletin is not to prescribe specific practices or to prescribe specific documentation requirements." pypdf, 2026-08-18.

New York §II.B, Steps 1-3

Step 1: assessing whether the use of ECDIS or AIS produces disproportionate adverse effects … Step 2: assessing whether there is a legitimate, lawful, and fair explanation or rationale for the differential effect … Step 3: conducting and appropriately documenting a search and analysis for a less discriminatory alternative variable(s) or methodology … If no less discriminatory alternative exists, the insurer should conduct ongoing model risk management … and repeat Step 3 at least annually.

Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

New York goes as far as naming the statistics. Six metrics are listed by name, with the caveat that no one is expected to collect new data about individuals to compute them.

Show the exact wording Hide the exact wording

Not in the model bulletin

No metric is named anywhere in the model bulletin: "ratio" 0 hits, "odds" 0 hits, "metric" 0 hits, "quantitative" 0 hits. The single hit for "statistical" sits inside the definition of Model Drift, not in any testing expectation. §3.2 stops at "bias analysis and minimization". pypdf, 2026-08-18.

New York §II.C, Quantitative Assessment

Adverse Impact Ratio … Denials Odds Ratios … Marginal Effects … Standardized Mean Differences … Z-tests and T-tests … Drivers of Disparity … There is no expectation that insurers collect additional data from, or about, individuals to perform exemplary analysis.

Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

A hard deadline the model has nowhere: fifteen days to tell an applicant why the automated route rejected them, with the manual underwriting route left running in the meantime.

Show the exact wording Hide the exact wording

Not in the model bulletin

The model bulletin contains no deadline of any kind: the pattern for a number followed by "day" or "days" matches 0 times, "within [number]" 0 times, "deadline" 0 times. pypdf, 2026-08-18.

New York §IV.F ¶3

Within 15-days of such a determination an insurer should provide notice to the applicant in writing … and the notice should identify the reason or reasons that the applicant cannot be underwritten for insurance using ECDIS or AIS. During the notice period the insurer should continue the non ECDIS or AIS-based underwriting process. An insurer's failure to provide this notice may be considered an unfair trade practice under Insurance Law Article 24.

Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

New York puts a clock on board approval: policies and procedures reviewed and approved at least annually. The model bulletin lists governance items an insurer should consider addressing, with no cadence attached.

Show the exact wording Hide the exact wording

NAIC model bulletin §2.0 introduction, p.5

An Insurer may consider adopting new internal governance structures or rely on the Insurer's existing governance structures; however, in developing its governance framework, the Insurer should consider addressing the following items:

New York §III.B

An insurer's board of directors or other governing body, committees thereof, or senior management through delegated authority, should review and approve the insurer's ECDIS and AIS-related policies and procedures at least annually to ensure that they are kept current with changes in the insurer's use of ECDIS and AIS and best practices in the industry.

"annual" appears three times in the model bulletin and all three are references to the Corporate Governance Annual Disclosure Model Act (#305) in the legal-basis section, not a cadence for the AIS Program. pypdf, 2026-08-18.

Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

Model testing gets a floor. New York asks for testing at least annually including drift; the model bulletin asks for validation "as necessary" and offers methods a company "can" use.

Show the exact wording Hide the exact wording

NAIC model bulletin §3.4, p.6

Validating, testing, and retesting as necessary to assess the generalization of AI System outputs upon implementation, including the suitability of the data used to develop, train, validate and audit the model. Validation can take the form of comparing model performance on unseen data available at the time of model development to the performance observed on data post-implementation, measuring performance against expert review, or other methods.

New York §III.B, documentation list

a description of testing conducted at least annually to assess the output of AIS models, including drift that may result from the use of machine learning or other automated updates

Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

An adverse decision has to come with the source of the information behind it, and a vendor's trade secrets are not an excuse for vagueness. The model bulletin asks only for notice that AI is in use.

Show the exact wording Hide the exact wording

NAIC model bulletin §1.9, p.5

The AIS Program should include processes and procedures providing notice to impacted consumers that AI Systems are in use and provide access to appropriate levels of information based on the phase of the insurance life cycle in which the AI Systems are being used.

New York §IV.E ¶2-3

the reason or reasons provided to the insured or potential insured … should include details about all information upon which the insurer based any declination, limitation, rate differential, or other adverse underwriting decision, including the source of the specific information … An insurer may not rely on the proprietary nature of a third-party vendor's algorithmic processes to justify the lack of specificity related to an adverse underwriting or pricing action.

Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

The circular letter covers underwriting and pricing and says so explicitly. Claims handling, marketing and fraud detection are outside it. The model bulletin reaches every regulated insurance practice.

Show the exact wording Hide the exact wording

NAIC model bulletin Section 3, p.4

all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an "AIS Program") for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices.

New York §I, Purpose and Background

This Circular Letter also is not intended to address phases of the insurance product lifecycle other than underwriting and pricing.

Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

The one place the two texts are the same text. DFS says in its own comment summary that it took this clause from the NAIC model bulletin, so a carrier reading both is looking at one requirement, not two.

Show the exact wording Hide the exact wording

NAIC model bulletin §4.2, p.7

Where appropriate and available, the inclusion of terms in contracts with third parties that: a) Provide audit rights and/or entitle the Insurer to receive audit reports by qualified auditing entities. b) Require the third party to cooperate with the Insurer with regard to regulatory inquiries and investigations related to the Insurer's use of the third-party's product or services.

New York §III.D ¶3

Where appropriate and available, insurers should include terms in their contracts with third-party vendors that: (i) provide audit rights or entitle the insurer to receive audit reports by qualified auditing entities; and (ii) require the third-party vendor to cooperate with the insurer regarding regulatory inquiries and investigations related to the insurer's use of the third-party vendor's product or services.

Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

What the regulator asks for

6 items · 2 yearly
  • report on-request

    Two routes in: a regular or targeted examination under § 309, or a demand for a special report under § 308. The circular letter says both reach the use of these systems.

    All insurers authorized to write in New York

    §I, Purpose and Background · read it · hide
    The Department may audit and examine an insurer's use of ECDIS and AIS, including within the scope of regular or targeted examinations pursuant to New York Insurance Law ("Insurance Law") § 309, or a request for special report pursuant to Insurance Law § 308.

    Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

  • documentation on-request

    The reasoning behind the testing has to be written down, not just the result, and produced to the Department when asked.

    Any insurer using ECDIS or AIS in underwriting or pricing

    §II.C, Documentation · read it · hide
    An insurer should appropriately document the processes and reasoning behind its testing methodologies and analysis for unfair or unlawful discrimination commensurate with the insurer's use of ECDIS and AIS … An insurer should be prepared to make such documentation available to the Department upon request.

    Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

  • documentation At least once a year

    Evidence that someone with authority read and approved the policies this year. A signature and a date is the artefact an examiner can check.

    Board, board committee, or senior management under delegated authority

    §III.B · read it · hide
    An insurer's board of directors or other governing body, committees thereof, or senior management through delegated authority, should review and approve the insurer's ECDIS and AIS-related policies and procedures at least annually…

    Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

  • testing Before go-live, then at least yearly

    Discrimination testing before go-live and on a regular cadence after; model output testing including drift at least annually.

    Any insurer running AIS in underwriting or pricing

    §II.C, Frequency of Testing · read it · hide
    Unfair or unlawful discrimination testing and analysis should be administered prior to putting AIS into production and on a regular cadence thereafter, as well as whenever material updates or changes are made to either the ECDIS or AIS.

    Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

  • record retention continuous

    Complaints about these systems are a record class of their own, kept under 11 NYCRR 243 and producible on request. Note the register: this one says must, not should.

    All insurers using AIS or ECDIS

    §III.B, final paragraph · read it · hide
    Insurers must be prepared to respond to consumer complaints and inquiries about the use of AIS and ECDIS by implementing procedures to receive and address such complaints. Insurers must maintain any records of complaints regarding AIS or ECDIS in accordance with 11 NYCRR 243 and be prepared to make such records available to the Department upon request.

    Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

  • consumer notice Within 15 days

    Written notice of why the automated route could not underwrite the applicant, plus a way to review the underlying data for accuracy, given at the time of that notice.

    Insurers running an automated underwriting route alongside a manual one

    §IV.F ¶4 · read it · hide
    This review process needs to be provided at the time the applicant is notified that the application cannot be processed under the underwriting process utilizing ECDIS or AIS described in paragraph 44 above. An insurer's failure to provide a review process may be considered an unfair trade practice under Insurance Law Article 24.

    Insurance Circular Letter No. 7 (2024) · retrieved 2026-08-18

The NAIC's examination tool. New York is not among the twelve states trialling the NAIC's AI Systems Evaluation Tool. Its own examination powers, under Insurance Law sections 308 and 309, are what apply instead. Source ↗

If you write in more than one state

New York is the deepest testing regime of the three and the narrowest in reach. Two separate exercises apply to underwriting and pricing only, and nothing in the circular letter touches claims or fraud, so a carrier can be fully compliant in New York and untouched on the practices Colorado and the model bulletin both cover. What does not travel is the Colorado file: New York wants the reasoning behind the methodology, six named statistics as candidates, and a fifteen-day letter to the applicant.

Based on

Sources read

Not legal advice. How this tracker is sourced →

Compare with another state

California Own rules 6 differences · 2 standing obligations Colorado Own rules 9 differences · 5 standing obligations Texas Own rules 6 differences · 2 standing obligations

Or go back to the table of all 51 jurisdictions.