SR-UW-0655 FLAG
On 2026-10-16, rx-score v3 (a third-party system from RxData Labs (fictional)) produced 'approve' in a NY life rating transaction. Inputs included rx history, credit, consumer report, application data. External consumer data and information sources were present. A consumer report was used. No human reviewed the output before it took effect. The outcome was not adverse to the consumer. RegBench applied 10 rule(s) in force on 2026-10-16 and recorded 4 finding(s); the most serious is 'Underwriting or pricing AI used without a documented disparate-impact assessment' (high, L4).
FLAG: 4 finding(s) under rules 2026.10+dbe5ddf6, corpus 2026-10-30-5f07c521. Routed to the carrier's compliance reviewer with cited findings.
Findings (4)
Underwriting or pricing AI used without a documented disparate-impact assessment
Finding. ECDIS or an AI system was used in underwriting or pricing and the transaction references no comprehensive assessment, including disparate-impact analysis, for the system.
Basis. Circular Letter No. 7 § II.B says an insurer should not use ECDIS or AIS unless it has determined they do not result in unfair or unlawful discrimination, following a three-step assessment; § II.C expects testing before production and on a regular cadence, documented and available to the Department; Insurance Law § 2606 and § 2303 supply the statutory prohibitions.
Required action. Attach the system's documented assessment reference; route to compliance review.
Excerpt: ny-dfs-cl7-2024-II-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
An insurer should not use ECDIS or AIS for underwriting or pricing unless it has determined that the data source or model does not use or is not based on a protected class and does not result in unfair or unlawful discrimination; the insurer remains responsible when it relies on a vendor and "may not rely solely on a third-party's claim of non-discrimination"; the comprehensive assessment proceeds in three steps: whether the use produces a disproportionate adverse effect on a protected class, whether a legitimate, lawful and fair rationale exists, and whether a less discriminatory alternative is available (summary of paragraphs 13–15).
Excerpt: ny-dfs-cl7-2024-II-C · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
Insurers should document the testing methods and analysis, commensurate with the use, complexity and materiality of the AIS, and make them available to the Department on request; testing should occur before an AIS is put into production, on a regular cadence afterwards and following material changes; acceptable metrics include adverse impact ratios, denial odds ratios, marginal effects, standardized mean differences and the drivers of disparity; the insurer should be able to explain "at all times" how its AIS operates (summary of paragraphs 16–19).
Excerpt: ny-ins-2606 · state statute (government edict) · in force from 1984-09-01
"(a) Except as provided in section one thousand one hundred eight of this chapter, no individual or entity subject to the supervision of the superintendent shall because of race, color, creed, national origin, or disability: (1) Make any distinction or discrimination between persons as to the premiums or rates charged for insurance policies or in any other manner whatever. (2) Demand or require a greater premium from any persons than it requires at that time from others in similar cases. (3) Make or require any rebate, discrimination or discount upon the amount to be paid or the service to be rendered on any policy. ..."
Excerpt: ny-ins-2303 · state statute (government edict) · in force from 1984-09-01
"Rates shall not be excessive, inadequate, unfairly discriminatory, destructive of competition or detrimental to the solvency of insurers. In determining whether rates comply with the foregoing standards, the superintendent shall include all income earned by such insurer ... on all its investments of any kind and wherever located. ..."
Underwriting or pricing AI outside an attested governance framework
Finding. The underwriting or pricing system is not attested as covered by board oversight, senior management responsibility and written, annually reviewed policies.
Basis. Circular Letter No. 7 § III.A expects board oversight and senior management responsibility for ECDIS and AIS, and § III.B expects written policies reviewed at least annually.
Required action. Attest the system's coverage under the governance framework and link the latest internal audit.
Excerpt: ny-dfs-cl7-2024-III-A · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
The board of directors sets oversight and risk appetite for the use of ECDIS and AIS, may delegate duties and should receive timely and relevant reporting; senior management is responsible for day-to-day implementation, including "overseeing model risk management" (summary of paragraphs 21–24).
Excerpt: ny-dfs-cl7-2024-III-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
Written policies should be reviewed at least annually; documentation should cover the AIS inventory (including systems in development or recently retired), how each AIS operates (inputs, sources, purpose, usage, restrictions, risks), change tracking with rationale and approvers, monitoring including policy exceptions, and annual output testing including drift; consumer complaint procedures with records available to the Department (summary of paragraphs 25–30).
Third-party ECDIS or AI vendor without documented standards and audit rights
Finding. A third-party system contributed to the decision and the carrier has not attested that the vendor is covered by written standards, error-correction procedures and audit rights.
Basis. Circular Letter No. 7 § III.D keeps the insurer responsible for third-party ECDIS and AIS and expects written vendor standards and, where appropriate, contract terms providing audit rights and cooperation with regulatory inquiries; § II.B adds that an insurer may not rely solely on a vendor's claim of non-discrimination.
Required action. Record the vendor standards, audit rights and evaluation for the system.
Excerpt: ny-dfs-cl7-2024-III-D · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
Insurers remain responsible for understanding the ECDIS and AIS they obtain from third parties and for ensuring they comply with applicable law; insurers should adopt written standards for acquiring and using vendor ECDIS and AIS, procedures for reporting and correcting bad data, and, where appropriate, contract terms providing audit rights and vendor cooperation with regulatory inquiries (summary of paragraphs 35–37).
Excerpt: ny-dfs-cl7-2024-II-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
An insurer should not use ECDIS or AIS for underwriting or pricing unless it has determined that the data source or model does not use or is not based on a protected class and does not result in unfair or unlawful discrimination; the insurer remains responsible when it relies on a vendor and "may not rely solely on a third-party's claim of non-discrimination"; the comprehensive assessment proceeds in three steps: whether the use produces a disproportionate adverse effect on a protected class, whether a legitimate, lawful and fair rationale exists, and whether a less discriminatory alternative is available (summary of paragraphs 13–15).
Underwriting or pricing AI with no inventory documentation reference
Finding. The system produced an underwriting or pricing outcome, and the transaction references no documentation of how it operates, its inputs and sources, or its change history.
Basis. Circular Letter No. 7 § III.B expects an up-to-date AIS inventory with a description of each system's inputs, sources, purpose, usage, restrictions and risks, change tracking and annual output testing.
Required action. Link the system to its inventory documentation.
Excerpt: ny-dfs-cl7-2024-III-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11
Written policies should be reviewed at least annually; documentation should cover the AIS inventory (including systems in development or recently retired), how each AIS operates (inputs, sources, purpose, usage, restrictions, risks), change tracking with rationale and approvers, monitoring including policy exceptions, and annual output testing including drift; consumer complaint procedures with records available to the Department (summary of paragraphs 25–30).
Point in time
- Law as of
- 2026-10-16
- Rules version
- 2026.10+dbe5ddf6
- Corpus snapshot
- 2026-10-30-5f07c521
- Engine
- regbench-engine/0.4.0 · deterministic-1
- Fingerprint
- fe18ff0cdd18d034cc4fa9b6
- Evaluated
- 2026-10-30 11:23:24 UTC
- Exhibit C case file
- yes
Ledger
- Entry
- #655 · assessment · recorded 2026-10-16T08:15:59+00:00
- Hash
- 0b85b2c7fb307210eb6561d0082068e2e54d339bb9127e6cdc12e2cb9d556e81
- Previous
- 03cc98421026ed24560ddda88bc03d0bf29439916a72063ca28cd0b63f06001e
- Stored copy intact
- yes, hashes match
Carrier review
Resolved by compliance · outcome confirmed-no-change · 10.3 hours after it opened · Resolved in the carrier's review queue (synthetic).
Recorded facts
- AI system
- rx-score v3 · third party (RxData Labs (fictional)) · high-risk class: underwriting
- Governance attested
- False
- Testing report
- none recorded
- Model documentation
- none recorded
- Feature classes
- rx_history, credit, consumer_report, application_data
- Protected factors used
- none
- External data (ECDIS)
- True
- Consumer report / credit
- True / True
- Data sources
- vendor://rxdata/score, cra://demo-bureau/attributes
- Decision
- approve · score 0.248
- Human review
- none
- Adverse to consumer
- False
- Notice
- not recorded · reasons: False · specific: False · external data disclosed: False
- Appeal channel
- –
- Consumer token
- tok_94283bf2c7