SR-UW-0727 FLAG
On 2026-09-25, rx-score v3 (a third-party system from RxData Labs (fictional)) produced 'rate' in a NY life underwriting transaction. Inputs included rx history, credit, consumer report, application data. External consumer data and information sources were present. A consumer report was used. No human reviewed the output before it took effect. The outcome was adverse to the consumer; a notice was sent on 2026-09-28 with specific reasons. RegBench applied 11 rule(s) in force on 2026-09-25 and recorded 5 finding(s); the most serious is 'Underwriting or pricing AI used without a documented disparate-impact assessment' (high, L4).
FLAG: 5 finding(s) under rules 2026.10+c4982313, corpus 2026-10-30-9c5dad5a. Routed to the carrier's compliance reviewer with cited findings.
Evidence (missing). Missing evidence: ai_system.governance_attested, ai_system.model_doc_ref, ai_system.testing_report_ref. Supplied but unverified: inputs.data_source_refs.
Findings (5)
Underwriting or pricing AI used without a documented disparate-impact assessment
Finding. ECDIS or an AI system was used in underwriting or pricing and the transaction references no comprehensive assessment, including disparate-impact analysis, for the system.
Basis. Circular Letter No. 7 § II.B says an insurer should not use ECDIS or AIS unless it has determined they do not result in unfair or unlawful discrimination, following a three-step assessment; § II.C expects testing before production and on a regular cadence, documented and available to the Department; Insurance Law § 2606 and § 2303 supply the statutory prohibitions.
Required action. Attach the system's documented assessment reference; route to compliance review.
Excerpt: ny-dfs-cl7-2024-II-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
An insurer should not use ECDIS or AIS for underwriting or pricing unless it has determined that the data source or model does not use or is not based on a protected class and does not result in unfair or unlawful discrimination; the insurer remains responsible when it relies on a vendor and "may not rely solely on a third-party's claim of non-discrimination"; the comprehensive assessment proceeds in three steps: whether the use produces a disproportionate adverse effect on a protected class, whether a legitimate, lawful and fair rationale exists, and whether a less discriminatory alternative is available (summary of paragraphs 13–15).
Excerpt: ny-dfs-cl7-2024-II-C · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
Insurers should document the testing methods and analysis, commensurate with the use, complexity and materiality of the AIS, and make them available to the Department on request; testing should occur before an AIS is put into production, on a regular cadence afterwards and following material changes; acceptable metrics include adverse impact ratios, denial odds ratios, marginal effects, standardized mean differences and the drivers of disparity; the insurer should be able to explain "at all times" how its AIS operates (summary of paragraphs 16–19).
Excerpt: ny-ins-2606 · state statute (government edict) · in force from 1984-09-01
"(a) Except as provided in section one thousand one hundred eight of this chapter, no individual or entity subject to the supervision of the superintendent shall because of race, color, creed, national origin, or disability: (1) Make any distinction or discrimination between persons as to the premiums or rates charged for insurance policies or in any other manner whatever. (2) Demand or require a greater premium from any persons than it requires at that time from others in similar cases. (3) Make or require any rebate, discrimination or discount upon the amount to be paid or the service to be rendered on any policy. ..."
Excerpt: ny-ins-2303 · state statute (government edict) · in force from 1984-09-01
"Rates shall not be excessive, inadequate, unfairly discriminatory, destructive of competition or detrimental to the solvency of insurers. In determining whether rates comply with the foregoing standards, the superintendent shall include all income earned by such insurer ... on all its investments of any kind and wherever located. ..."
Underwriting or pricing AI outside an attested governance framework
Finding. The underwriting or pricing system is not attested as covered by board oversight, senior management responsibility and written, annually reviewed policies.
Basis. Circular Letter No. 7 § III.A expects board oversight and senior management responsibility for ECDIS and AIS, and § III.B expects written policies reviewed at least annually.
Required action. Attest the system's coverage under the governance framework and link the latest internal audit.
Excerpt: ny-dfs-cl7-2024-III-A · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
The board of directors sets oversight and risk appetite for the use of ECDIS and AIS, may delegate duties and should receive timely and relevant reporting; senior management is responsible for day-to-day implementation, including "overseeing model risk management" (summary of paragraphs 21–24).
Excerpt: ny-dfs-cl7-2024-III-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
Written policies should be reviewed at least annually; documentation should cover the AIS inventory (including systems in development or recently retired), how each AIS operates (inputs, sources, purpose, usage, restrictions, risks), change tracking with rationale and approvers, monitoring including policy exceptions, and annual output testing including drift; consumer complaint procedures with records available to the Department (summary of paragraphs 25–30).
Third-party ECDIS or AI vendor without documented standards and audit rights
Finding. A third-party system contributed to the decision and the carrier has not attested that the vendor is covered by written standards, error-correction procedures and audit rights.
Basis. Circular Letter No. 7 § III.D keeps the insurer responsible for third-party ECDIS and AIS and expects written vendor standards and, where appropriate, contract terms providing audit rights and cooperation with regulatory inquiries; § II.B adds that an insurer may not rely solely on a vendor's claim of non-discrimination.
Required action. Record the vendor standards, audit rights and evaluation for the system.
Excerpt: ny-dfs-cl7-2024-III-D · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
Insurers remain responsible for understanding the ECDIS and AIS they obtain from third parties and for ensuring they comply with applicable law; insurers should adopt written standards for acquiring and using vendor ECDIS and AIS, procedures for reporting and correcting bad data, and, where appropriate, contract terms providing audit rights and vendor cooperation with regulatory inquiries (summary of paragraphs 35–37).
Excerpt: ny-dfs-cl7-2024-II-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
An insurer should not use ECDIS or AIS for underwriting or pricing unless it has determined that the data source or model does not use or is not based on a protected class and does not result in unfair or unlawful discrimination; the insurer remains responsible when it relies on a vendor and "may not rely solely on a third-party's claim of non-discrimination"; the comprehensive assessment proceeds in three steps: whether the use produces a disproportionate adverse effect on a protected class, whether a legitimate, lawful and fair rationale exists, and whether a less discriminatory alternative is available (summary of paragraphs 13–15).
Adverse outcome from a high-risk AI system with no human review
Finding. A high-risk system produced an adverse outcome that took effect without human review.
Basis. Doctrine: examiners applying the NAIC bulletin's governance and control expectations, and the AI Risk Evaluation Supplement's Exhibit B question on whether there is a human in the loop for direct-consumer-impact uses, ask first about human oversight of adverse automated outcomes; an unreviewed adverse decision is the case file most likely to be sampled.
Required action. Route to the carrier's reviewer; record the review and any override on the transaction.
Excerpt: naic-ai-bulletin-s3-1-ais-program · NAIC model guidance; binding in a state only as adopted (see adoptions register) · in force from 2023-12-04
"all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices. The AIS Program should be designed to mitigate the risk of Adverse Consumer Outcomes ... The Department also encourages the development and use of verification and testing methods to identify errors and bias in Predictive Models and AI Systems, as well as the potential for unfair discrimination in the decisions and outcomes resulting from the use of Predictive Models and AI Systems."
Underwriting or pricing AI with no inventory documentation reference
Finding. The system produced an underwriting or pricing outcome, and the transaction references no documentation of how it operates, its inputs and sources, or its change history.
Basis. Circular Letter No. 7 § III.B expects an up-to-date AIS inventory with a description of each system's inputs, sources, purpose, usage, restrictions and risks, change tracking and annual output testing.
Required action. Link the system to its inventory documentation.
Excerpt: ny-dfs-cl7-2024-III-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
Written policies should be reviewed at least annually; documentation should cover the AIS inventory (including systems in development or recently retired), how each AIS operates (inputs, sources, purpose, usage, restrictions, risks), change tracking with rationale and approvers, monitoring including policy exceptions, and annual output testing including drift; consumer complaint procedures with records available to the Department (summary of paragraphs 25–30).
Point in time
- Law as of
- 2026-09-25
- Rules version
- 2026.10+c4982313
- Corpus snapshot
- 2026-10-30-9c5dad5a
- Engine
- regbench-engine/0.5.0 · deterministic-1
- Fingerprint
- 63b66273aed31fc0246e1199 (pattern grouping, not an integrity check)
- Input digest
- d67f6607c20641701d82a24fb35daa6081f930558e44d912b76d3f63238491d9
- Evaluated
- 2026-10-31 05:42:54 UTC
- Exhibit C case file
- yes
Ledger
- Entry
- #6230 · assessment · recorded 2026-09-25T13:41:07+00:00
- Hash
- 33b22fcaebcbf98472e421b3e4f8759c86ae39011595454d83a5200aa25c35f7
- Previous
- 4dbf49863746f641cc8caaf7bf8fe7d134628230e8f6b48be20a5a6b4b187e8c
- Stored copy intact
- yes, hashes match
- Assessed input intact
- yes, revision 1 matches the input digest
Carrier review
Resolved by underwriter · outcome remediated · 30.0 hours after it opened · Resolved in the carrier's review queue (synthetic).
Recorded facts revision 1
As asserted by the carrier. References are recorded, not verified: RegBench holds no copy of the documents they name.
- AI system
- rx-score v3 · third party (RxData Labs (fictional)) · high-risk class: underwriting
- Governance attested
- False
- Testing report
- none recorded
- Model documentation
- none recorded
- Feature classes
- rx_history, credit, consumer_report, application_data
- Protected factors used
- none
- External data (ECDIS)
- True
- Consumer report / credit
- True / True
- Data sources
- vendor://rxdata/score, cra://demo-bureau/attributes
- Decision
- rate · score 0.622 · premium +36.1%
- Human review
- none
- Adverse to consumer
- True
- Notice
- sent 2026-09-28 · reasons: True · specific: True · external data disclosed: True
- Appeal channel
- –
- Consumer token
- tok_a8943b97ff