Are authority, data and commercial responsibilities controlled?

10. Is the boundary between production and claims decisions explicit? — Critical gate

• 0 points: It is unclear who may determine coverage, approve scope changes, communicate decisions or authorise payment.
• 1 point: The supplier says a human reviews the file, but responsibilities and state-specific requirements are unverified.
• 2 points: Claims counsel and operations have approved a state-and-task responsibility map, required licensing checks and retained approval authorities.
• 3 points: A walkthrough demonstrates that unauthorised decisions are blocked or escalated, approval records are retained and reviewers have the evidence and time needed to challenge outputs.

Evidence to show: A task-level authority matrix, counsel’s applicability review and tested escalation examples.

Research context: Texas Chapter 4101 contains an adjuster definition, licensing requirements and exemptions, including specified technical-assistance circumstances. It illustrates why the actual tasks need legal review; it does not establish a nationwide exemption for “estimate writing”. (tcss.legis.texas.gov)

11. Are data access and downstream processing approved? — Critical gate

• 0 points: You cannot identify where claim information goes or who can access it.
• 1 point: You have a generic security statement or certification, but no workflow-specific assessment.
• 2 points: Security and legal have approved the data flow, access controls, processing locations, relevant subprocessors, retention, deletion, incident handling and permitted data uses—including model training where relevant.
• 3 points: Controls have been verified through appropriate evidence and testing, including access removal, an incident exercise and confirmation that actual processing matches the approved design.

Evidence to show: A data-flow map, due-diligence decision, contractual restrictions and control-verification records.

Research context: NAIC Model Law 668 addresses third-party security diligence. Separately, New York DFS’s October 2025 guidance recommends considering data-use, AI-training and exit provisions; applicability and exemptions require entity-specific review. (content.naic.org)

12. Can procurement compare the whole service and exit it safely?

• 0 points: Comparison is based on a headline price per estimate or file.
• 1 point: A quote exists, but revisions, exclusions, minimums, retained work or exit obligations remain unclear.
• 2 points: A common scope and pricing schedule defines QA, revisions, exceptions, complexity, surge terms, audit access, export rights and exit assistance.
• 3 points: Procurement has reconciled realistic invoice scenarios and tested export of carrier-owned data and required audit records, with agreed treatment of reusable configurations, access revocation and lawful retention.

Evidence to show: A normalised quote, exception-pricing examples, contractual clarification log and exit test.

Separate correction of a supplier error from newly supplied evidence or a carrier-requested scope change. For an internal option, document equivalent service commitments, cost allocation and migration dependencies.

Research context: New York DFS’s guidance covers contracting, ongoing oversight and termination, including data migration or deletion and removal of system access. Our commercial price-comparison criteria are additional desk recommendations. (dfs.ny.gov)