Do not use a weighted score to compensate for an unresolved legal or control failure. Apply mandatory gates first. The examples below illustrate issues for counsel to assess; they are not a 50-state legal opinion.
| Issue | What the source establishes | Procurement consequence we recommend |
|---|---|---|
| AI governance | The NAIC’s December 2023 model bulletin addresses AI-supported insurance decisions, governance, third-party diligence and regulatory examination. Its state-adoption materials distinguish jurisdictional adoption. (content.naic.org) | Determine applicable state expectations; do not describe the model bulletin as one federal AI law |
| Third-party oversight | Pennsylvania’s April 2024 notice discusses vendor diligence, audit information, regulatory cooperation and testing. It distinguishes legal compliance from its suggested governance practices. (pacodeandbulletin.gov) | Obtain appropriate contractual access and evidence; assess the actual AI service, not merely a supplier-wide security badge |
| Adjuster licensing | Texas Chapter 4101 defines adjusting activities and contains exemptions, including specified technical-assistance and clerical roles. (tcss.legis.texas.gov) | Map actual tasks, supervision and communications to applicable requirements; do not rely solely on the label “estimate writer” |
| Property-estimate obligations | California’s guidance addresses property estimating and claims documentation obligations; the department also publishes a January 2026 guide. (insurance.ca.gov) | Have counsel and technical claims approve state-specific requirements and maintain them separately from generic carrier preferences |
What should the control pack contain?
Our recommended minimum is:
- A responsibility map covering production, QA, acceptance, coverage, reserving, payment and policyholder communications.
- A data-flow map showing storage, access, subprocessors and model providers.
- Agreed retention, deletion, legal-hold and export arrangements.
- Explicit restrictions or permissions for training and other secondary data use, propagated through relevant subcontractors.
- Security evidence scoped to the actual service and hosting arrangements.
- Rule and model inventories, change notification, validation records and rollback procedures.
- Evidence and change records sufficient for an authorised reviewer to reconstruct the work.
- A tested route for disagreement, abstention, manual handling and regulatory inquiry.
The proposed operating model should preserve substantive human acceptance and expressly exclude delegated claims authority unless the buyer intentionally contracts for it after legal review.
Sources cited on this page
- content.naic.orgcontent.naic.org
- pacodeandbulletin.govpacodeandbulletin.gov
- tcss.legis.texas.govtcss.legis.texas.gov
- insurance.ca.govinsurance.ca.gov