BB-RNW-0171 FLAG
On 2026-10-01, price-opt v7.2 (an internally developed system) produced 'rate' in a CO auto renewal transaction. Inputs included telematics, credit, geography, vehicle, claims history. External consumer data and information sources were present. No human reviewed the output before it took effect. The outcome was adverse to the consumer; a notice was sent on 2026-10-06 with specific reasons. RegBench applied 10 rule(s) in force on 2026-10-01 and recorded 3 finding(s); the most serious is 'ECDIS used outside an attested governance and risk management framework (amended Regulation 10-1-1)' (medium, L3).
FLAG: 3 finding(s) under rules 2026.10+c4982313, corpus 2026-10-30-9c5dad5a. Routed to the carrier's compliance reviewer with cited findings.
Evidence (missing). Missing evidence: ai_system.governance_attested. Supplied but unverified: ai_system.model_doc_ref, ai_system.testing_report_ref, inputs.data_source_refs.
Findings (3)
ECDIS used outside an attested governance and risk management framework (amended Regulation 10-1-1)
Finding. The decision used external consumer data and information sources, or a model built on them, in a line the amended regulation covers (individually issued life, private passenger auto, health benefit plans), and the system is not attested as covered by the governance and risk management framework.
Basis. Regulation 10-1-1 § 5.A, as amended effective 15 October 2025, requires covered insurers using ECDIS to establish a risk-based framework with documented governing principles, board oversight, senior management accountability, a cross-functional governance group, an up-to-date inventory with version control, documented testing and monitoring, vendor selection and annual reviews; § 6 requires an annual officer-attested compliance report.
Required action. Add the system to the Regulation 10-1-1 inventory, attest framework coverage, and include it in the next annual report filed through SERFF.
Excerpt: co-reg-10-1-1-s5 · state regulation (government edict) · in force from 2025-10-15
Applies to insurers offering individually issued life insurance, private passenger automobile insurance and health benefit plans. "Insurers ... that use ECDIS, as well as algorithms and predictive models that use ECDIS in any insurance practice, must establish a risk-based governance and risk management framework that facilitates and supports policies, procedures, systems, and controls designed to determine whether the use of such ECDIS, algorithms, and predictive models potentially result in unfair discrimination with respect to race and remediate unfair discrimination, if detected through quantitative testing requirements established by the Division." Required components include documented governing principles (1), board or board-committee oversight (2), senior management accountability with "regular reporting to senior management on the performance and potential risks" (3), a documented cross-functional governance group (4), for health plans a provider "ultimately responsible for the decisions" when ECDIS-based tools inform denials or modifications (5), documented policies and procedures (6), complaint and inquiry processes (7), risk assessment (8), a "documented up-to-date inventory, including version control" (9), explanation of material inventory changes (10), a "documented description of quantitative testing conducted pursuant to requirements established by the Division" (11), ongoing performance monitoring "accounting for model drift" (12), documented vendor selection (13) and annual reviews (14).
Excerpt: co-reg-10-1-1-s6 · state regulation (government edict) · in force from 2025-10-15
Insurers using ECDIS must submit a narrative progress report (life: 1 June 2024; private passenger auto and health: 1 December 2025) and, annually, "a report summarizing compliance with the requirements in Section 5 and the title and qualifications of each individual responsible for ensuring compliance" (life: 1 December 2024 and annually; auto and health: 1 July 2026 and annually), signed by an officer attesting to compliance, filed through SERFF; insurers not using ECDIS file an officer attestation to that effect.
Adverse outcome from a high-risk AI system with no human review
Finding. A high-risk system produced an adverse outcome that took effect without human review.
Basis. Doctrine: examiners applying the NAIC bulletin's governance and control expectations, and the AI Risk Evaluation Supplement's Exhibit B question on whether there is a human in the loop for direct-consumer-impact uses, ask first about human oversight of adverse automated outcomes; an unreviewed adverse decision is the case file most likely to be sampled.
Required action. Route to the carrier's reviewer; record the review and any override on the transaction.
Excerpt: naic-ai-bulletin-s3-1-ais-program · NAIC model guidance; binding in a state only as adopted (see adoptions register) · in force from 2023-12-04
"all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices. The AIS Program should be designed to mitigate the risk of Adverse Consumer Outcomes ... The Department also encourages the development and use of verification and testing methods to identify errors and bias in Predictive Models and AI Systems, as well as the potential for unfair discrimination in the decisions and outcomes resulting from the use of Predictive Models and AI Systems."
Geography and credit used together in an adverse decision (proxy pattern to test at portfolio level)
Finding. The decision used both geographic and credit inputs and was adverse to the consumer; the interaction of these inputs is a recognised proxy pattern for protected characteristics.
Basis. Doctrine: the bulletin's concern with unfair discrimination extends to proxies, and the Supplement's Exhibit C item 10a asks whether inputs, derived variables and outputs are evaluated "for potential proxy relationships"; a geography-by-credit interaction should be covered by portfolio-level outcome testing and the result referenced from the case file.
Required action. Confirm the system's portfolio outcome testing covers the geography-credit interaction; link the result.
Excerpt: naic-ai-bulletin-s3-1-ais-program · NAIC model guidance; binding in a state only as adopted (see adoptions register) · in force from 2023-12-04
"all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices. The AIS Program should be designed to mitigate the risk of Adverse Consumer Outcomes ... The Department also encourages the development and use of verification and testing methods to identify errors and bias in Predictive Models and AI Systems, as well as the potential for unfair discrimination in the decisions and outcomes resulting from the use of Predictive Models and AI Systems."
Point in time
- Law as of
- 2026-10-01
- Rules version
- 2026.10+c4982313
- Corpus snapshot
- 2026-10-30-9c5dad5a
- Engine
- regbench-engine/0.5.0 · deterministic-1
- Fingerprint
- 8e6205ef38c99b4b9ef1f689 (pattern grouping, not an integrity check)
- Input digest
- 8e4b22fe4e48d06b5239d2cb230d9ec4aeb5d749309c883fe12ee2ff347d0fe1
- Evaluated
- 2026-10-31 05:42:53 UTC
- Exhibit C case file
- yes
Ledger
- Entry
- #5674 · assessment · recorded 2026-10-01T03:32:43+00:00
- Hash
- be25ad6ce3c740a4045b0eac2d66cc70564cd5e00ad70ccc57708a1594965cd1
- Previous
- 9d1ef41648c9608cc4cac3031879a4bcfef2e7ec06a3dd6f67487f1058a326ff
- Stored copy intact
- yes, hashes match
- Assessed input intact
- yes, revision 1 matches the input digest
Carrier review
Resolved by compliance · outcome remediated · 30.3 hours after it opened · Resolved in the carrier's review queue (synthetic).
Recorded facts revision 1
As asserted by the carrier. References are recorded, not verified: RegBench holds no copy of the documents they name.
- AI system
- price-opt v7.2 · internal · high-risk class: pricing
- Governance attested
- False
- Testing report
- test://bluebonnet/price-opt/2026Q2
- Model documentation
- doc://bluebonnet/price-opt/7.2
- Feature classes
- telematics, credit, geography, vehicle, claims_history
- Protected factors used
- none
- External data (ECDIS)
- True
- Consumer report / credit
- False / True
- Data sources
- cra://demo-bureau/score, telematics://bluebonnet/program
- Decision
- rate · score 0.365 · premium +13.6%
- Human review
- none
- Adverse to consumer
- True
- Notice
- sent 2026-10-06 · reasons: True · specific: True · external data disclosed: False
- Appeal channel
- –
- Consumer token
- tok_f51295fbb6