Exam pack · NAIC AI Risk Evaluation Supplement v6.0 (exposure draft, 16 Oct 2026); v7.0 pending adoption vote, Fall National Meeting

Bluebonnet Mutual Insurance Company (fictional)

NAIC code DEMO-10101 · period 2026-07-02 to 2026-10-31 · all states · built 2026-10-30 11:45

Pack identifier: pack_e4072ef8b88d
Pack hash (on ledger #1375): c56fad6b39de203033bd60e843014f878c2cefc5e1ac9c22ef9f6c754297a454
Engine: regbench-engine/0.4.0 · rules 2026.10+dbe5ddf6 · corpus 2026-10-30-5f07c521
Totals: 577 assessments · 547 case files · 4 high-risk models
Confidentiality: Produced for the requesting state's examination or inquiry; to be held confidential under that state's authority. The carrier may assert trade-secret protection over model documentation it attaches.

Download JSON Print

Exhibit A · use of AI Exhibit B · AIS Program Exhibit C · high-risk models Exhibit D · model data RegBench disclosure Ledger

Exhibit B: (Checklist) AIS Program

1. Written AIS Program

adopted: 2025-03-18
approved by: Board Risk Committee
owner: Chief Compliance Officer
review frequency: annual
scope: all AI systems that make or support regulated insurance decisions

2. Board and management

involved: True
role: Board Risk Committee approved the program; receives RegBench operating-effectiveness reporting
accountability training: carrier to supply
materiality and risk assessment: Models touching more than 2% of annual written premium or any direct consumer outcome; rationale: FCEH financial-position test plus consumer-impact floor.

Subject-matter experts: AI Governance Office, compliance@bluebonnet.example; RegBench corpus desk (for assessment methodology questions)

Operating effectiveness (what the control actually did)

Assessments: 577 · PASS 464 (80.4%) HOLD 20 (3.5%) FLAG 93 (16.1%)
Findings by severity: high 76 medium 157 low 27 critical 4
Findings by layer: L0 18 L2 29 L3 26 L4 60 L5 5 L6 126
Adverse decisions: 87 assessed, 82 with at least one finding
Review queue: 113 opened · 102 resolved · 11 open · median 17.9 h · outcomes {'remediated': 57, 'overridden': 12, 'confirmed-no-change': 26, 'escalated': 7}
Versions in force: 2026.10+dbe5ddf6 / 2026-10-30-5f07c521
Ledger: verified, 690 entries

Human in the loop, by high-risk system (direct consumer impact)

System	Decisions	Adverse	Declared automation	Human reviewed
claims-fastpath	109	10	unknown	3.7%
fnol-fraud	120	6	automate	1.7%
price-opt	168	45	automate	19.0%
uw-triage	150	26	augment	38.7%

Most frequent findings in the period

Rule	Layer	Basis	Count
Geography and credit used together in an adverse decision (proxy pattern to test at portfolio level) doctrine.zip-credit-interaction-proxy	L6	doctrine (advisory)	70
Adverse outcome from a high-risk AI system with no human review doctrine.unreviewed-adverse-high-risk	L6	doctrine (advisory)	56
Consequential AI-supported decision taken without a person reviewing and agreeing tx.tdi.consequential-decision-without-human-review	L4	guidance	47
ECDIS used outside an attested governance and risk management framework (amended Regulation 10-1-1) co.reg-10-1-1.governance-framework-amended	L3	black letter	26
Credit-based adverse effect without the § 559.054 notice of reasons tx.559.credit-adverse-effect-notice	L2	black letter	14
Consumer report used with no data source reference recorded us.fcra.permissible-purpose-undocumented	L0	black letter	14
Third-party data used with no source recorded tx.tdi.third-party-data-source-unrecorded	L4	guidance	13
Algorithmic denial, reduction or fraud hold with no human review tx.542.algorithmic-denial-without-human-review	L2	black letter	9
Claim rejected or reduced without stated reasons tx.542.rejection-without-reasons	L2	black letter	6
AI-flagged non-renewal or decline with no notice recorded (pattern of the 2026 Pennsylvania agreement) precedent.ai-flagged-cancellation-without-notice	L5	precedent (advisory)	5
Adverse action based on a consumer report with no FCRA notice recorded us.fcra.adverse-action-notice	L0	black letter	4

3. Processes and procedures (Document Name and Page #)

Ref	How the insurance company…	Document name	Page	RegBench evidence
3a	Considers AI System risks within its Enterprise Risk Management (ERM)	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Not evidenced by RegBench; carrier AIS Program reference required.
3b	Considers AI System risks within the Own Risk and Solvency Assessment Report (ORSA), as applicable	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Not evidenced by RegBench; carrier AIS Program reference required.
3c	Assesses, mitigates, and evaluates inherent risks related to the use of AI System including the possibility of the company engaging in unfair trade practices	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Exhibit C item 13 and the case files: every decision assessed against unfair-trade-practice and unfair-claims-settlement provisions in force on the decision date.
3d	Determined 'materiality' and what threshold was used for assessing AI Systems risk and determined the company's risk assessment processes for its use of AI Systems	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Not evidenced by RegBench; carrier AIS Program reference required.
3e	Quantifies AI System risk levels	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Not evidenced by RegBench; carrier AIS Program reference required.
3f	Considers AI System risk impact on financial reporting	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Not evidenced by RegBench; carrier AIS Program reference required.
3g	Ensures AI Systems are compliant with applicable state and federal laws and regulations, including non-discrimination protections	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Case files: cited findings by provision, layer and severity; rules and corpus versions stamped on each assessment.
3h	Evaluates the risk of Adverse Consumer Impact	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Operating-effectiveness statistics: adverse decisions assessed, findings on adverse decisions, review outcomes.
3i	Considers data privacy and protection of consumer data used in AI Systems	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Not evidenced by RegBench; carrier AIS Program reference required.
3j	Considers consumer complaints resulting from AI Systems and whether they are identified, tracked, and addressed	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Not evidenced by RegBench; carrier AIS Program reference required.
3k	Promotes consumer awareness of the use of AI Systems through disclosures, policies, and procedures for consumer notification, as appropriate	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Case files: notice status (sent, reasons stated, specific reasons, external-data disclosure) recorded per adverse decision; notice findings.
3l	Trains employees about AI System use, ensures human oversight is appropriate, and defines prohibited practices (if any)	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Human-in-the-loop rates by system for direct-consumer-impact decisions; unreviewed adverse outcomes routed to review.
3m	Provides standards and guidance for procuring and engaging AI System vendors	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Exhibit A reconciliation: vendor systems observed in the decision stream against the declared inventory.
3n	Governs, monitors, tests and ensures transparency of AI Systems developed by vendors	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Third-party system findings (due diligence, documentation, testing references) per decision; Exhibit C for vendor models.
3o	Considers AI System risks within the software development lifecycle (SDLC) or within the broader AIS Program	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Not evidenced by RegBench; carrier AIS Program reference required.
3p	Evaluates whether AI Systems are suitable for their intended use and should continue to be used as designed	Bluebonnet Mutual Insurance Company (fictional) AIS Program	carrier to supply	Exhibit C item 10/10a: continuous assessment coverage and portfolio outcome tests per model.