Stage 5: What must be cleared before sharing live policyholder files?

Complete the authority, security and integration review before a live pilot—not after a successful demonstration. Synthetic or appropriately redacted files can support initial discovery while those approvals are pending.

Which legal distinctions require attention?

• AI governance: The NAIC model bulletin addresses risk-based governance, testing and third-party diligence, including audit arrangements and regulatory cooperation where appropriate. It is a model, not a single federal AI rule; check the relevant state position. (content.naic.org)
• Cybersecurity: For covered entities, New York’s Part 500 includes third-party service-provider security requirements. Applicability and exemptions require assessment rather than an assumption that every US insurer has identical obligations. (dfs.ny.gov)
• Licensing: Texas distinguishes adjusting activities from specified exemptions, including certain technical assistance to licensed adjusters and non-negotiating clerical work. That does not establish a nationwide exemption for anything labelled estimate writing. Ask counsel to assess actual tasks, supervision and jurisdictions. (tcss.legis.texas.gov)

Pre-data checklist

• ☐ Document which decisions remain with the carrier: coverage, reserving, settlement and disputed judgement.
• ☐ Map data flows through the supplier, subcontractors, model providers, storage and support teams.
• ☐ Agree permitted use, access, retention, deletion, incident handling and model-training restrictions.
• ☐ Review relevant assurance reports and exceptions; do not substitute a website badge for diligence.
• ☐ Establish named escalation owners and a route for stopping or reversing processing.
• ☐ Confirm that regulatory and audit evidence remains obtainable throughout the relationship.

New York DFS’s 21 October 2025 guidance specifically addresses third-party diligence, contracts, continuing oversight and termination. It also states that covered entities cannot delegate responsibility for cybersecurity compliance to a third party. (dfs.ny.gov)

What should the integration proof demonstrate?

Require a round-trip test: send an assignment and evidence package, receive editable outputs, make a revision, retrieve the history and verify the result in the actual carrier workflow. Include incorrect identifiers, duplicate submissions, missing attachments and failed transfers.

Verisk documents different integration paths for material packaged into Xactimate and attachments associated with a XactAnalysis assignment. Its documentation also makes clear that available workflows and API access depend on the agreement—so an integration claim is not proof of entitlement or implementation readiness. (developerportal.verisk.com)

Decision gate: Legal, security and technology approve the specific pilot scope and environment. Unresolved material issues prevent live-data release.

Working document: Evidence-to-Approval Control Audit.