Regulatory Assessment

NY-RATE-0231 HOLD

NY · life · rating · decided 2026-10-02 15:00 UTC · Summit Range Life Assurance Company (fictional)

On 2026-10-02, rx-score v3 (a third-party system from RxData Labs (fictional)) produced 'rate' in a NY life rating transaction. Inputs included rx history, credit, consumer report, application data. External consumer data and information sources were present. A consumer report was used. A human reviewed the output by a underwriter. The outcome was adverse to the consumer; a notice was sent on 2026-10-04 with specific reasons. RegBench applied 10 rule(s) in force on 2026-10-02 and recorded 5 finding(s); the most serious is 'Adverse underwriting or pricing decision without specific reasons or disclosure of external data and AI use' (high, L4).

HOLD: 5 finding(s) under rules 2026.10+dbe5ddf6, corpus 2026-10-30-5f07c521. Held for the carrier's compliance review before the outcome is communicated; the carrier decides.

Carrier note (data, never evaluated): Rated up 18% over standard; notice gave specific reasons but did not disclose that external data and an AI system were used.

Findings (5)

high L4 guidance hold exhibit C ny.cl7.adverse-decision-transparency

Adverse underwriting or pricing decision without specific reasons or disclosure of external data and AI use

Finding. The decision was adverse and the consumer notice does not record the specific reasons with their sources, or does not disclose that external data or an AI system was used.

Basis. Circular Letter No. 7 § IV expects notices to state whether AIS and external vendor data were used, to give the specific reasons including all information relied on and its source, and not to hide behind a vendor's proprietary algorithm; it cites Insurance Law §§ 3425, 3426 and 4224.

Required action. Hold until the notice states the specific reasons and sources and discloses the use of ECDIS or AIS.

Excerpt: ny-dfs-cl7-2024-IV · regulatory guidance interpreting N.Y. Insurance Law §§ 3425, 3426 and 4224 (government edict) · in force from 2024-07-11

Notices should state whether AIS is used, whether external vendor data is used, and the right to request information about the specific data behind the decision; adverse decision reasons should include details about all information relied on, including its source; an insurer may not cite a vendor's proprietary algorithms to avoid specificity (summary of paragraphs 38–41, which cite Insurance Law §§ 3425, 3426 and 4224(a)(2), (b)(2)).

high L4 guidance flag exhibit C ny.cl7.disparate-impact-assessment

Underwriting or pricing AI used without a documented disparate-impact assessment

Finding. ECDIS or an AI system was used in underwriting or pricing and the transaction references no comprehensive assessment, including disparate-impact analysis, for the system.

Basis. Circular Letter No. 7 § II.B says an insurer should not use ECDIS or AIS unless it has determined they do not result in unfair or unlawful discrimination, following a three-step assessment; § II.C expects testing before production and on a regular cadence, documented and available to the Department; Insurance Law § 2606 and § 2303 supply the statutory prohibitions.

Required action. Attach the system's documented assessment reference; route to compliance review.

Excerpt: ny-dfs-cl7-2024-II-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11

An insurer should not use ECDIS or AIS for underwriting or pricing unless it has determined that the data source or model does not use or is not based on a protected class and does not result in unfair or unlawful discrimination; the insurer remains responsible when it relies on a vendor and "may not rely solely on a third-party's claim of non-discrimination"; the comprehensive assessment proceeds in three steps: whether the use produces a disproportionate adverse effect on a protected class, whether a legitimate, lawful and fair rationale exists, and whether a less discriminatory alternative is available (summary of paragraphs 13–15).

Excerpt: ny-dfs-cl7-2024-II-C · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11

Insurers should document the testing methods and analysis, commensurate with the use, complexity and materiality of the AIS, and make them available to the Department on request; testing should occur before an AIS is put into production, on a regular cadence afterwards and following material changes; acceptable metrics include adverse impact ratios, denial odds ratios, marginal effects, standardized mean differences and the drivers of disparity; the insurer should be able to explain "at all times" how its AIS operates (summary of paragraphs 16–19).

Excerpt: ny-ins-2606 · state statute (government edict) · in force from 1984-09-01

"(a) Except as provided in section one thousand one hundred eight of this chapter, no individual or entity subject to the supervision of the superintendent shall because of race, color, creed, national origin, or disability: (1) Make any distinction or discrimination between persons as to the premiums or rates charged for insurance policies or in any other manner whatever. (2) Demand or require a greater premium from any persons than it requires at that time from others in similar cases. (3) Make or require any rebate, discrimination or discount upon the amount to be paid or the service to be rendered on any policy. ..."

Excerpt: ny-ins-2303 · state statute (government edict) · in force from 1984-09-01

"Rates shall not be excessive, inadequate, unfairly discriminatory, destructive of competition or detrimental to the solvency of insurers. In determining whether rates comply with the foregoing standards, the superintendent shall include all income earned by such insurer ... on all its investments of any kind and wherever located. ..."

medium L4 guidance flag exhibit B ny.cl7.governance-oversight

Underwriting or pricing AI outside an attested governance framework

Finding. The underwriting or pricing system is not attested as covered by board oversight, senior management responsibility and written, annually reviewed policies.

Basis. Circular Letter No. 7 § III.A expects board oversight and senior management responsibility for ECDIS and AIS, and § III.B expects written policies reviewed at least annually.

Required action. Attest the system's coverage under the governance framework and link the latest internal audit.

Excerpt: ny-dfs-cl7-2024-III-A · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11

The board of directors sets oversight and risk appetite for the use of ECDIS and AIS, may delegate duties and should receive timely and relevant reporting; senior management is responsible for day-to-day implementation, including "overseeing model risk management" (summary of paragraphs 21–24).

Excerpt: ny-dfs-cl7-2024-III-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11

Written policies should be reviewed at least annually; documentation should cover the AIS inventory (including systems in development or recently retired), how each AIS operates (inputs, sources, purpose, usage, restrictions, risks), change tracking with rationale and approvers, monitoring including policy exceptions, and annual output testing including drift; consumer complaint procedures with records available to the Department (summary of paragraphs 25–30).

medium L4 guidance flag exhibit A ny.cl7.third-party-accountability

Third-party ECDIS or AI vendor without documented standards and audit rights

Finding. A third-party system contributed to the decision and the carrier has not attested that the vendor is covered by written standards, error-correction procedures and audit rights.

Basis. Circular Letter No. 7 § III.D keeps the insurer responsible for third-party ECDIS and AIS and expects written vendor standards and, where appropriate, contract terms providing audit rights and cooperation with regulatory inquiries; § II.B adds that an insurer may not rely solely on a vendor's claim of non-discrimination.

Required action. Record the vendor standards, audit rights and evaluation for the system.

Excerpt: ny-dfs-cl7-2024-III-D · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11

Insurers remain responsible for understanding the ECDIS and AIS they obtain from third parties and for ensuring they comply with applicable law; insurers should adopt written standards for acquiring and using vendor ECDIS and AIS, procedures for reporting and correcting bad data, and, where appropriate, contract terms providing audit rights and vendor cooperation with regulatory inquiries (summary of paragraphs 35–37).

Excerpt: ny-dfs-cl7-2024-II-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11

An insurer should not use ECDIS or AIS for underwriting or pricing unless it has determined that the data source or model does not use or is not based on a protected class and does not result in unfair or unlawful discrimination; the insurer remains responsible when it relies on a vendor and "may not rely solely on a third-party's claim of non-discrimination"; the comprehensive assessment proceeds in three steps: whether the use produces a disproportionate adverse effect on a protected class, whether a legitimate, lawful and fair rationale exists, and whether a less discriminatory alternative is available (summary of paragraphs 13–15).

low L4 guidance flag exhibit A, C ny.cl7.inventory-documentation

Underwriting or pricing AI with no inventory documentation reference

Finding. The system produced an underwriting or pricing outcome, and the transaction references no documentation of how it operates, its inputs and sources, or its change history.

Basis. Circular Letter No. 7 § III.B expects an up-to-date AIS inventory with a description of each system's inputs, sources, purpose, usage, restrictions and risks, change tracking and annual output testing.

Required action. Link the system to its inventory documentation.

Excerpt: ny-dfs-cl7-2024-III-B · regulatory guidance interpreting N.Y. Insurance Law (government edict) · in force from 2024-07-11

Written policies should be reviewed at least annually; documentation should cover the AIS inventory (including systems in development or recently retired), how each AIS operates (inputs, sources, purpose, usage, restrictions, risks), change tracking with rationale and approvers, monitoring including policy exceptions, and annual output testing including drift; consumer complaint procedures with records available to the Department (summary of paragraphs 25–30).

Point in time

Law as of
2026-10-02
Rules version
2026.10+dbe5ddf6
Corpus snapshot
2026-10-30-5f07c521
Engine
regbench-engine/0.4.0 · deterministic-1
Fingerprint
f0e70192b148ecd55e4ff171
Evaluated
2026-10-30 11:23:25 UTC
Exhibit C case file
yes

Ledger

Entry
#1124 · assessment · recorded 2026-10-02T15:02:51+00:00
Hash
b855ee4cf874259c6fefb618c44edac7304fd83355b3296763aafb6d2db4ece3
Previous
2772bcd57c6e348c99369492daacdf86951d1a732d210b3c383220c742192483
Stored copy intact
yes, hashes match

Verify the whole chain Case file JSON

Carrier review

Resolved by compliance · outcome remediated · 6.7 hours after it opened · Resolved in the carrier's review queue (synthetic).

Recorded facts

AI system
rx-score v3 · third party (RxData Labs (fictional)) · high-risk class: underwriting
Governance attested
False
Testing report
none recorded
Model documentation
none recorded
Feature classes
rx_history, credit, consumer_report, application_data
Protected factors used
none
External data (ECDIS)
True
Consumer report / credit
True / True
Data sources
vendor://rxdata/score, cra://demo-bureau/attributes
Decision
rate · score 0.66 · premium +18.0% · codes RX2
Human review
yes (underwriter)
Adverse to consumer
True
Notice
sent 2026-10-04 · reasons: True · specific: True · external data disclosed: False
Appeal channel
underwriting-review@summitrange.example
Consumer token
tok_showcase_0231