CO-LIFE-0088 HOLD
On 2026-09-14, rx-score v3 (a third-party system from RxData Labs (fictional)) produced 'decline' in a CO life underwriting transaction. Inputs included rx history, credit, consumer report, application data. External consumer data and information sources were present. A consumer report was used. No human reviewed the output before it took effect. The outcome was adverse to the consumer; no notice to the consumer is recorded. RegBench applied 10 rule(s) in force on 2026-09-14 and recorded 7 finding(s); the most serious is 'Adverse action based on a consumer report with no FCRA notice recorded' (critical, L0).
HOLD: 7 finding(s) under rules 2026.10+dbe5ddf6, corpus 2026-10-30-5f07c521. Held for the carrier's compliance review before the outcome is communicated; the carrier decides.
Carrier note (data, never evaluated): Term life application declined on vendor mortality score built from prescription history and credit attributes.
Findings (7)
Adverse action based on a consumer report with no FCRA notice recorded
Finding. The decision was adverse to the consumer and was based in whole or in part on a consumer report, but no adverse action notice is recorded on the transaction.
Basis. FCRA § 615(a) requires the user of a consumer report to notify the consumer of an adverse action, identify the consumer reporting agency, state that the agency did not make the decision, and explain the consumer's rights to a free report and to dispute. A denial, increase in charge or unfavorable change in insurance terms in connection with underwriting is an adverse action under § 603(k)(1)(B)(i).
Required action. Hold the outcome for compliance review; generate the notice with every required element before the decision is communicated, and record notice_sent_at on the transaction.
Excerpt: us-fcra-1681m-a · federal statute (public domain) · in force from 1971-04-25
"If any person takes any adverse action with respect to any consumer that is based in whole or in part on any information contained in a consumer report, the person shall (1) provide oral, written, or electronic notice of the adverse action to the consumer; (2) provide to the consumer written or electronic disclosure of a numerical credit score [used in taking the adverse action, with the information required by § 1681g(f)(1)]; (3) provide to the consumer orally, in writing, or electronically (A) the name, address, and telephone number of the consumer reporting agency ... that furnished the report ... and (B) a statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide the consumer the specific reasons why the adverse action was taken; and (4) provide ... notice of the consumer's right (A) to obtain ... a free copy of a consumer report ... within 60 days ... and (B) to dispute ... the accuracy or completeness of any information in a consumer report."
Excerpt: us-fcra-1681a-k-1-b-i · federal statute (public domain) · in force from 1997-09-30
"a denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount of, any insurance, existing or applied for, in connection with the underwriting of insurance."
Adverse outcome from an ECDIS-driven model with no unfair-discrimination testing on record
Finding. External consumer data and information sources drove an adverse outcome, and the transaction references no testing showing the model does not unfairly discriminate.
Basis. C.R.S. § 10-3-1104.9 prohibits using ECDIS, algorithms or predictive models in a way that unfairly discriminates on the listed characteristics and directs the Commissioner's rules to establish how an insurer demonstrates it has tested for that; the Division's quantitative testing standards remain under development, so the finding asks for the insurer's own testing record.
Required action. Attach the system's unfair-discrimination testing report reference; route the outcome to compliance review.
Excerpt: co-crs-10-3-1104-9 · state statute (government edict) · in force from 2021-09-07
"[A]n insurer shall not, with regard to any insurance practice: (a) Unfairly discriminate based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression; or (b) [use any external consumer data and information source, algorithm or predictive model in a way that unfairly discriminates, as defined by rules adopted by the commissioner]." Subsection (3)(a) directs the commissioner to "adopt rules for specific types of insurance, by insurance practice" establishing means by which an insurer "may demonstrate, to the extent practicable, that it has tested whether its use" of such sources or models unfairly discriminates; subsection (3)(b) requires insurers to "establish and maintain a risk management framework or similar processes or procedures" and to "provide an attestation by one or more officers that the insurer has implemented the risk management framework". Subsection (8) defines an external consumer data and information source as "a data or an information source that is used by an insurer to supplement traditional underwriting" and defines unfair discrimination to include use that "results in a disproportionately negative outcome for such classification or classifications" beyond what is justified.
ECDIS used outside an attested governance and risk management framework (amended Regulation 10-1-1)
Finding. The decision used external consumer data and information sources, or a model built on them, in a line the amended regulation covers (individually issued life, private passenger auto, health benefit plans), and the system is not attested as covered by the governance and risk management framework.
Basis. Regulation 10-1-1 § 5.A, as amended effective 15 October 2025, requires covered insurers using ECDIS to establish a risk-based framework with documented governing principles, board oversight, senior management accountability, a cross-functional governance group, an up-to-date inventory with version control, documented testing and monitoring, vendor selection and annual reviews; § 6 requires an annual officer-attested compliance report.
Required action. Add the system to the Regulation 10-1-1 inventory, attest framework coverage, and include it in the next annual report filed through SERFF.
Excerpt: co-reg-10-1-1-s5 · state regulation (government edict) · in force from 2025-10-15
Applies to insurers offering individually issued life insurance, private passenger automobile insurance and health benefit plans. "Insurers ... that use ECDIS, as well as algorithms and predictive models that use ECDIS in any insurance practice, must establish a risk-based governance and risk management framework that facilitates and supports policies, procedures, systems, and controls designed to determine whether the use of such ECDIS, algorithms, and predictive models potentially result in unfair discrimination with respect to race and remediate unfair discrimination, if detected through quantitative testing requirements established by the Division." Required components include documented governing principles (1), board or board-committee oversight (2), senior management accountability with "regular reporting to senior management on the performance and potential risks" (3), a documented cross-functional governance group (4), for health plans a provider "ultimately responsible for the decisions" when ECDIS-based tools inform denials or modifications (5), documented policies and procedures (6), complaint and inquiry processes (7), risk assessment (8), a "documented up-to-date inventory, including version control" (9), explanation of material inventory changes (10), a "documented description of quantitative testing conducted pursuant to requirements established by the Division" (11), ongoing performance monitoring "accounting for model drift" (12), documented vendor selection (13) and annual reviews (14).
Excerpt: co-reg-10-1-1-s6 · state regulation (government edict) · in force from 2025-10-15
Insurers using ECDIS must submit a narrative progress report (life: 1 June 2024; private passenger auto and health: 1 December 2025) and, annually, "a report summarizing compliance with the requirements in Section 5 and the title and qualifications of each individual responsible for ensuring compliance" (life: 1 December 2024 and annually; auto and health: 1 July 2026 and annually), signed by an officer attesting to compliance, filed through SERFF; insurers not using ECDIS file an officer attestation to that effect.
Third-party ECDIS model without documentation of purpose, inputs and vendor oversight
Finding. A third-party model that consumes ECDIS produced the decision, and the transaction carries no reference to documentation of the model's purpose, inputs and vendor oversight.
Basis. Regulation 10-1-1 § 5.A.9 requires a documented up-to-date inventory with version control and a description and purpose for each ECDIS, algorithm and model; § 5.B keeps the insurer responsible for vendor-supplied models and requires documented vendor selection and oversight.
Required action. Record the vendor model's documentation reference in the inventory and the vendor oversight record.
Excerpt: co-reg-10-1-1-s5 · state regulation (government edict) · in force from 2025-10-15
Applies to insurers offering individually issued life insurance, private passenger automobile insurance and health benefit plans. "Insurers ... that use ECDIS, as well as algorithms and predictive models that use ECDIS in any insurance practice, must establish a risk-based governance and risk management framework that facilitates and supports policies, procedures, systems, and controls designed to determine whether the use of such ECDIS, algorithms, and predictive models potentially result in unfair discrimination with respect to race and remediate unfair discrimination, if detected through quantitative testing requirements established by the Division." Required components include documented governing principles (1), board or board-committee oversight (2), senior management accountability with "regular reporting to senior management on the performance and potential risks" (3), a documented cross-functional governance group (4), for health plans a provider "ultimately responsible for the decisions" when ECDIS-based tools inform denials or modifications (5), documented policies and procedures (6), complaint and inquiry processes (7), risk assessment (8), a "documented up-to-date inventory, including version control" (9), explanation of material inventory changes (10), a "documented description of quantitative testing conducted pursuant to requirements established by the Division" (11), ongoing performance monitoring "accounting for model drift" (12), documented vendor selection (13) and annual reviews (14).
Excerpt: co-reg-10-1-1-s5-b-vendors · state regulation (government edict) · in force from 2025-10-15
The insurer remains responsible for the ECDIS, algorithms and predictive models it obtains from vendors or other external resources, must document its vendor selection and oversight, and vendors may produce documents directly to the Division (summary of § 5.B).
AI-flagged non-renewal or decline with no notice recorded (pattern of the 2026 Pennsylvania agreement)
Finding. An AI system flagged the risk and the policy was declined or not renewed without a notice to the consumer being recorded; this is the fact pattern of the Pennsylvania Attorney General's 2026 agreement with an auto insurer over an AI-enabled underwriting review tool.
Basis. Precedent: as reported, the insurer agreed to follow the Pennsylvania Insurance Department's AI guidance, to extend document deadlines and to accept additional proof after a cancellation without adequate notice. Regulators in other states read the same headlines; the pattern deserves a reviewer's attention wherever it appears.
Required action. Confirm the notice and document deadlines before the cancellation or decline takes effect; record the notice on the transaction.
Excerpt: precedent-pa-geico-2026 · enforcement precedent reported by secondary sources; persuasive only · in force from 2026-05-22
Announced by Pennsylvania Attorney General Dave Sunday on 22 May 2026: a new policyholder in West Philadelphia was selected by an underwriting-review tool with artificial-intelligence features during the insurer's 60-day review of new policyholders and lost coverage without realising it after believing she had sent the requested residency documents. GEICO agreed to act in line with the Pennsylvania Insurance Department's guidance on insurers' use of AI, to extend the document-submission period for selected new policyholders by one week, to accept one form of residency verification (a current driver's licence suffices when its address matches the policy), and to train customer-service staff on the revised requirements. No admission of wrongdoing; no monetary term reported.
Adverse outcome from a high-risk AI system with no human review
Finding. A high-risk system produced an adverse outcome that took effect without human review.
Basis. Doctrine: examiners applying the NAIC bulletin's governance and control expectations, and the AI Risk Evaluation Supplement's Exhibit B question on whether there is a human in the loop for direct-consumer-impact uses, ask first about human oversight of adverse automated outcomes; an unreviewed adverse decision is the case file most likely to be sampled.
Required action. Route to the carrier's reviewer; record the review and any override on the transaction.
Excerpt: naic-ai-bulletin-s3-1-ais-program · NAIC model guidance; binding in a state only as adopted (see adoptions register) · in force from 2023-12-04
"all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices. The AIS Program should be designed to mitigate the risk of Adverse Consumer Outcomes ... The Department also encourages the development and use of verification and testing methods to identify errors and bias in Predictive Models and AI Systems, as well as the potential for unfair discrimination in the decisions and outcomes resulting from the use of Predictive Models and AI Systems."
ECDIS model with no documented testing or performance monitoring reference
Finding. The decision used an ECDIS-driven model for which the transaction references no documented testing or ongoing performance monitoring.
Basis. Regulation 10-1-1 § 5.A.11 requires a documented description of quantitative testing conducted pursuant to the Division's requirements (which remain under development) and § 5.A.12 requires ongoing performance monitoring accounting for model drift.
Required action. Record the testing and monitoring documentation reference for the model.
Excerpt: co-reg-10-1-1-s5 · state regulation (government edict) · in force from 2025-10-15
Applies to insurers offering individually issued life insurance, private passenger automobile insurance and health benefit plans. "Insurers ... that use ECDIS, as well as algorithms and predictive models that use ECDIS in any insurance practice, must establish a risk-based governance and risk management framework that facilitates and supports policies, procedures, systems, and controls designed to determine whether the use of such ECDIS, algorithms, and predictive models potentially result in unfair discrimination with respect to race and remediate unfair discrimination, if detected through quantitative testing requirements established by the Division." Required components include documented governing principles (1), board or board-committee oversight (2), senior management accountability with "regular reporting to senior management on the performance and potential risks" (3), a documented cross-functional governance group (4), for health plans a provider "ultimately responsible for the decisions" when ECDIS-based tools inform denials or modifications (5), documented policies and procedures (6), complaint and inquiry processes (7), risk assessment (8), a "documented up-to-date inventory, including version control" (9), explanation of material inventory changes (10), a "documented description of quantitative testing conducted pursuant to requirements established by the Division" (11), ongoing performance monitoring "accounting for model drift" (12), documented vendor selection (13) and annual reviews (14).
Point in time
- Law as of
- 2026-09-14
- Rules version
- 2026.10+dbe5ddf6
- Corpus snapshot
- 2026-10-30-5f07c521
- Engine
- regbench-engine/0.4.0 · deterministic-1
- Fingerprint
- 57e72cf53d656f6b0474ba54
- Evaluated
- 2026-10-30 11:23:25 UTC
- Exhibit C case file
- yes
Ledger
- Entry
- #1123 · assessment · recorded 2026-09-14T15:01:25+00:00
- Hash
- 2772bcd57c6e348c99369492daacdf86951d1a732d210b3c383220c742192483
- Previous
- 4b7388bfc6650316348ff6958f00f5b96ff5ee257a12b6fe7d98e61f88ac4096
- Stored copy intact
- yes, hashes match
Carrier review
Resolved by underwriter · outcome remediated · 7.4 hours after it opened · Resolved in the carrier's review queue (synthetic).
Recorded facts
- AI system
- rx-score v3 · third party (RxData Labs (fictional)) · high-risk class: underwriting
- Governance attested
- False
- Testing report
- none recorded
- Model documentation
- none recorded
- Feature classes
- rx_history, credit, consumer_report, application_data
- Protected factors used
- none
- External data (ECDIS)
- True
- Consumer report / credit
- True / True
- Data sources
- vendor://rxdata/score, cra://demo-bureau/attributes
- Decision
- decline · score 0.91 · codes RX4, CR2
- Human review
- none
- Adverse to consumer
- True
- Notice
- not recorded · reasons: False · specific: False · external data disclosed: False
- Appeal channel
- underwriting-review@summitrange.example
- Consumer token
- tok_showcase_0088