Can we examine the AI and data controls behind the subcontractor’s subcontractor?

Answer framing: Require enough contractual access, documentation and testing to govern the deployed workflow—not necessarily access to proprietary model weights.

Why it matters to buyers: The NAIC model AI bulletin addresses insurer governance, third-party due diligence, appropriate audit arrangements and cooperation with regulatory enquiries. Its implementation must be assessed by jurisdiction; the reviewed NAIC implementation map is dated 1 April 2026, not a complete statement of law as at this document’s research date. (content.naic.org)

New York DFS’s 21 October 2025 third-party guidance separately addresses due diligence, contracting, ongoing oversight and termination for covered entities. It expressly distinguishes clarification and recommended practices from new regulatory requirements. (dfs.ny.gov)

Put this to: claims counsel, the CISO, Gromowski and each supplier’s accountable control owner.

A good answer should supply a proposed control inventory covering:

• Every organisation that receives or can access claim data.
• Data categories, storage locations, access locations and retention periods.
• Approved uses, including whether model training or product improvement is permitted.
• Tenant separation, access permissions and incident notification.
• Model, prompt, rule and configuration changes that require assessment or approval.
• Validation records, material incidents and remediation.
• Audit evidence and regulatory cooperation obligations extending through relevant subcontractors.

Sharp follow-up: “If a model provider changes its terms or a subprocessor changes tomorrow, who notices, who approves the change and what can we suspend?”

Artifact to request: data-flow map, subprocessor register, contractual controls, validation summary and change log. Do not accept a security badge as a substitute for reviewing the relevant scope and exceptions.

Expert quote: [Reserved for approved quotation, contributor, role and interview date.]