Mark each Pass, Fail or Unverified, with an evidence reference and accountable carrier owner. Fail and Unverified both block production approval; a synthetic-data or otherwise authorised remediation test may still proceed.
These are proposed procurement gates, not a claim that every item is a universal legal requirement.
| Gate | Evidence required to pass | Stop condition | Carrier owner |
|---|---|---|---|
| G1. Lawful scope and authority | Task-by-task responsibility matrix; counsel’s jurisdictional review; required individual and entity licences verified; approval permissions tested | Production support can make unauthorised coverage, reserve, payment or settlement decisions | Claims counsel and claims leadership |
| G2. Safe and authorised data use | Approved data-flow map, access controls, processing locations, subprocessor inventory, retention and permitted-use terms | Unapproved data destination, training use, access or material unresolved security exposure | Security and privacy |
| G3. Recoverable evidence and records | Buyer retrieves source evidence, working and final versions, changes and approvals from a test file and an export | Material evidence or decision history cannot be recovered | QA and records management |
| G4. Minimum technical safety | Independent acceptance testing; no unresolved critical defects; approved containment and retest process | Fabricated evidence, wrong-claim contamination or other critical defect remains unresolved | Technical claims and QA |
| G5. Measurable population | Agreed cohort, eligibility rules, denominators, cost categories and access to file-level results | Supplier excludes difficult assignments, hides fallback work or refuses outcome-level verification | Transformation and finance |
| G6. Continuity and reversibility | Tested fallback, accountable incident owner, working export and funded transition arrangement | A failure would leave files inaccessible or without an executable continuation route | Operations and technology |
The NAIC model AI bulletin addresses governance, validation, third-party diligence and examination access. Separately, New York DFS’s October 2025 third-party guidance states that covered entities cannot delegate responsibility for cybersecurity compliance to a provider. These support treating control diligence as a prerequisite rather than a small scoring bonus. Applicability still requires legal review. (content.naic.org)
Sources cited on this page
- content.naic.orgcontent.naic.org