SR-UW-0747 FLAG
On 2026-09-17, rx-score v3 (a third-party system from RxData Labs (fictional)) produced 'rate' in a CT life underwriting transaction. Inputs included rx history, credit, consumer report, application data. A consumer report was used. A human reviewed the output by a underwriter. The outcome was adverse to the consumer; a notice was sent on 2026-09-23 with specific reasons. RegBench applied 8 rule(s) in force on 2026-09-17 and recorded 3 finding(s); the most serious is 'Adverse high-risk decision from a system with no adverse-outcome testing on record' (medium, L1).
FLAG: 3 finding(s) under rules 2026.10+c4982313, corpus 2026-10-30-9c5dad5a. Routed to the carrier's compliance reviewer with cited findings.
Evidence (missing). Missing evidence: ai_system.governance_attested, ai_system.model_doc_ref, ai_system.testing_report_ref. Supplied but unverified: inputs.data_source_refs.
Findings (3)
Adverse high-risk decision from a system with no adverse-outcome testing on record
Finding. The decision was adverse to the consumer and came from a high-risk AI system for which no testing for errors, bias or unfair discrimination is referenced.
Basis. The bulletin encourages verification and testing methods to identify errors and bias in predictive models and AI systems and the potential for unfair discrimination in their outcomes, and Section 4 lists validation, testing and auditing records among what an examiner may request.
Required action. Attach the system's latest testing report reference (errors, bias, unfair discrimination, drift).
Excerpt: naic-ai-bulletin-s3-1-ais-program · NAIC model guidance; binding in a state only as adopted (see adoptions register) · in force from 2023-12-04
"all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices. The AIS Program should be designed to mitigate the risk of Adverse Consumer Outcomes ... The Department also encourages the development and use of verification and testing methods to identify errors and bias in Predictive Models and AI Systems, as well as the potential for unfair discrimination in the decisions and outcomes resulting from the use of Predictive Models and AI Systems."
Excerpt: naic-ai-bulletin-s4-oversight · NAIC model guidance; binding in a state only as adopted (see adoptions register) · in force from 2023-12-04
"in the context of an investigation or market conduct action, an Insurer can expect to be asked about its development, deployment, and use of AI Systems ... and its outcomes (including Adverse Consumer Outcomes)". Requests may cover the written AIS Program, "inventories and descriptions of Predictive Models, and AI Systems used ... to make or support decisions that can result in Adverse Consumer Outcomes", documentation for any specific model including data source, provenance, lineage and bias analysis, and "validation, testing, and auditing, including evaluation of Model Drift"; and for third-party systems, "2.1 Due diligence conducted on third parties ... 2.2 Contracts with third-party AI System, model, or data vendors ... 2.3 Audits and/or confirmation processes performed regarding third-party compliance".
Third-party AI system without an attested due-diligence and contract record
Finding. A third-party AI system contributed to a high-risk decision, and the carrier has not attested that the system is covered by its AIS Program's third-party due-diligence standards and contract terms.
Basis. The bulletin, as adopted by this state, expects the AIS Program to address due diligence on third-party AI systems and data and contract terms providing audit rights and cooperation with regulatory inquiries; the carrier remains responsible for the outcomes.
Required action. Attach the vendor due-diligence record and contract terms (audit rights, regulatory cooperation) to the system's inventory entry and attest governance coverage.
Excerpt: naic-ai-bulletin-s3-4-third-party · NAIC model guidance; binding in a state only as adopted (see adoptions register) · in force from 2023-12-04
"Each AIS Program should address the Insurer's process for acquiring, using, or relying on (i) third-party data to develop AI Systems; and (ii) AI Systems developed by a third party, which may include, as appropriate, the establishment of standards, policies, procedures, and protocols relating to ... 4.1 Due diligence and the methods employed by the Insurer to assess the third party and its data or AI Systems ... to ensure that decisions made or supported from such AI Systems that could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the Insurer itself. 4.2 Where appropriate and available, the inclusion of terms in contracts with third parties that: a) Provide audit rights and/or entitle the Insurer to receive audit reports ... b) Require the third party to cooperate with the Insurer with regard to regulatory inquiries and investigations ..."
Excerpt: naic-ai-bulletin-s4-oversight · NAIC model guidance; binding in a state only as adopted (see adoptions register) · in force from 2023-12-04
"in the context of an investigation or market conduct action, an Insurer can expect to be asked about its development, deployment, and use of AI Systems ... and its outcomes (including Adverse Consumer Outcomes)". Requests may cover the written AIS Program, "inventories and descriptions of Predictive Models, and AI Systems used ... to make or support decisions that can result in Adverse Consumer Outcomes", documentation for any specific model including data source, provenance, lineage and bias analysis, and "validation, testing, and auditing, including evaluation of Model Drift"; and for third-party systems, "2.1 Due diligence conducted on third parties ... 2.2 Contracts with third-party AI System, model, or data vendors ... 2.3 Audits and/or confirmation processes performed regarding third-party compliance".
High-risk AI system with no model documentation reference
Finding. The AI system that produced this decision is in a high-risk class but the transaction carries no reference to model documentation.
Basis. Section 4 of the bulletin tells insurers to expect requests for inventories and descriptions of the predictive models and AI systems used to make or support decisions that can result in adverse consumer outcomes, together with validation, testing and auditing documentation.
Required action. Link the system to its model documentation (purpose, inputs, validation, monitoring) in the inventory.
Excerpt: naic-ai-bulletin-s4-oversight · NAIC model guidance; binding in a state only as adopted (see adoptions register) · in force from 2023-12-04
"in the context of an investigation or market conduct action, an Insurer can expect to be asked about its development, deployment, and use of AI Systems ... and its outcomes (including Adverse Consumer Outcomes)". Requests may cover the written AIS Program, "inventories and descriptions of Predictive Models, and AI Systems used ... to make or support decisions that can result in Adverse Consumer Outcomes", documentation for any specific model including data source, provenance, lineage and bias analysis, and "validation, testing, and auditing, including evaluation of Model Drift"; and for third-party systems, "2.1 Due diligence conducted on third parties ... 2.2 Contracts with third-party AI System, model, or data vendors ... 2.3 Audits and/or confirmation processes performed regarding third-party compliance".
Excerpt: naic-ai-bulletin-s3-1-ais-program · NAIC model guidance; binding in a state only as adopted (see adoptions register) · in force from 2023-12-04
"all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices. The AIS Program should be designed to mitigate the risk of Adverse Consumer Outcomes ... The Department also encourages the development and use of verification and testing methods to identify errors and bias in Predictive Models and AI Systems, as well as the potential for unfair discrimination in the decisions and outcomes resulting from the use of Predictive Models and AI Systems."
Point in time
- Law as of
- 2026-09-17
- Rules version
- 2026.10+c4982313
- Corpus snapshot
- 2026-10-30-9c5dad5a
- Engine
- regbench-engine/0.5.0 · deterministic-1
- Fingerprint
- ae9b3ac09c1d3f8ba9bdf51d (pattern grouping, not an integrity check)
- Input digest
- 2b5701ef136c4835da153a5883f644d2478fef9bab2936c706fd1ab0dad47933
- Evaluated
- 2026-10-31 05:42:54 UTC
- Exhibit C case file
- yes
Ledger
- Entry
- #6250 · assessment · recorded 2026-09-17T09:38:01+00:00
- Hash
- 79338b3b9bfa10bcafc08300eb5540c782c20687041f34a1bf02d1a713b69b5d
- Previous
- 21f50060d212194fe9d5a3ddc03114ca66f297fc55e0a6cac6873ad4a208a6ad
- Stored copy intact
- yes, hashes match
- Assessed input intact
- yes, revision 1 matches the input digest
Carrier review
Open since 2026-09-17T09:38:01+00:00. The carrier's reviewer decides; RegBench records the decision on the ledger.
Sign in as operator to record the review here; a carrier records it with its own API key.
Recorded facts revision 1
As asserted by the carrier. References are recorded, not verified: RegBench holds no copy of the documents they name.
- AI system
- rx-score v3 · third party (RxData Labs (fictional)) · high-risk class: underwriting
- Governance attested
- False
- Testing report
- none recorded
- Model documentation
- none recorded
- Feature classes
- rx_history, credit, consumer_report, application_data
- Protected factors used
- none
- External data (ECDIS)
- False
- Consumer report / credit
- True / True
- Data sources
- vendor://rxdata/score, cra://demo-bureau/attributes
- Decision
- rate · score 0.791 · premium +41.0%
- Human review
- yes (underwriter)
- Adverse to consumer
- True
- Notice
- sent 2026-09-23 · reasons: True · specific: True · external data disclosed: True
- Appeal channel
- –
- Consumer token
- tok_8c8486fa74