Regulatory Assessment

BB-RNW-0169 FLAG

CO · auto · renewal · decided 2026-10-21 14:52 UTC · Bluebonnet Mutual Insurance Company (fictional)

On 2026-10-21, price-opt v7.2 (an internally developed system) produced 'rate' in a CO auto renewal transaction. Inputs included telematics, credit, geography, vehicle, claims history. External consumer data and information sources were present. No human reviewed the output before it took effect. The outcome was not adverse to the consumer. RegBench applied 10 rule(s) in force on 2026-10-21 and recorded 1 finding(s); the most serious is 'ECDIS used outside an attested governance and risk management framework (amended Regulation 10-1-1)' (medium, L3).

FLAG: 1 finding(s) under rules 2026.10+dbe5ddf6, corpus 2026-10-30-5f07c521. Routed to the carrier's compliance reviewer with cited findings.

Findings (1)

medium L3 black letter flag exhibit A, B co.reg-10-1-1.governance-framework-amended

ECDIS used outside an attested governance and risk management framework (amended Regulation 10-1-1)

Finding. The decision used external consumer data and information sources, or a model built on them, in a line the amended regulation covers (individually issued life, private passenger auto, health benefit plans), and the system is not attested as covered by the governance and risk management framework.

Basis. Regulation 10-1-1 § 5.A, as amended effective 15 October 2025, requires covered insurers using ECDIS to establish a risk-based framework with documented governing principles, board oversight, senior management accountability, a cross-functional governance group, an up-to-date inventory with version control, documented testing and monitoring, vendor selection and annual reviews; § 6 requires an annual officer-attested compliance report.

Required action. Add the system to the Regulation 10-1-1 inventory, attest framework coverage, and include it in the next annual report filed through SERFF.

Excerpt: co-reg-10-1-1-s5 · state regulation (government edict) · in force from 2025-10-15

Applies to insurers offering individually issued life insurance, private passenger automobile insurance and health benefit plans. "Insurers ... that use ECDIS, as well as algorithms and predictive models that use ECDIS in any insurance practice, must establish a risk-based governance and risk management framework that facilitates and supports policies, procedures, systems, and controls designed to determine whether the use of such ECDIS, algorithms, and predictive models potentially result in unfair discrimination with respect to race and remediate unfair discrimination, if detected through quantitative testing requirements established by the Division." Required components include documented governing principles (1), board or board-committee oversight (2), senior management accountability with "regular reporting to senior management on the performance and potential risks" (3), a documented cross-functional governance group (4), for health plans a provider "ultimately responsible for the decisions" when ECDIS-based tools inform denials or modifications (5), documented policies and procedures (6), complaint and inquiry processes (7), risk assessment (8), a "documented up-to-date inventory, including version control" (9), explanation of material inventory changes (10), a "documented description of quantitative testing conducted pursuant to requirements established by the Division" (11), ongoing performance monitoring "accounting for model drift" (12), documented vendor selection (13) and annual reviews (14).

Excerpt: co-reg-10-1-1-s6 · state regulation (government edict) · in force from 2025-10-15

Insurers using ECDIS must submit a narrative progress report (life: 1 June 2024; private passenger auto and health: 1 December 2025) and, annually, "a report summarizing compliance with the requirements in Section 5 and the title and qualifications of each individual responsible for ensuring compliance" (life: 1 December 2024 and annually; auto and health: 1 July 2026 and annually), signed by an officer attesting to compliance, filed through SERFF; insurers not using ECDIS file an officer attestation to that effect.

Point in time

Law as of
2026-10-21
Rules version
2026.10+dbe5ddf6
Corpus snapshot
2026-10-30-5f07c521
Engine
regbench-engine/0.4.0 · deterministic-1
Fingerprint
a7a0f57cf9cc1b1d0edf0b72
Evaluated
2026-10-30 11:23:22 UTC
Exhibit C case file
yes

Ledger

Entry
#169 · assessment · recorded 2026-10-21T14:56:33+00:00
Hash
9fc2b501ba4c44b73e9f15fb74a3624810d98aac201ed8e3c9084589eebf55b1
Previous
8cfe1e1f5308589b0a35c7100cd25592e701846f521b8c64d4a7a2bb119d00c3
Stored copy intact
yes, hashes match

Verify the whole chain Case file JSON

Carrier review

Resolved by compliance · outcome remediated · 51.1 hours after it opened · Resolved in the carrier's review queue (synthetic).

Recorded facts

AI system
price-opt v7.2 · internal · high-risk class: pricing
Governance attested
False
Testing report
test://bluebonnet/price-opt/2026Q2
Model documentation
doc://bluebonnet/price-opt/7.2
Feature classes
telematics, credit, geography, vehicle, claims_history
Protected factors used
none
External data (ECDIS)
True
Consumer report / credit
False / True
Data sources
cra://demo-bureau/score, telematics://bluebonnet/program
Decision
rate · score 0.544 · premium +5.8%
Human review
none
Adverse to consumer
False
Notice
not recorded · reasons: False · specific: False · external data disclosed: False
Appeal channel
–
Consumer token
tok_996481a0ff