Insurance

Insurance regulators moved on AI earlier than most. The NAIC model bulletin and the states adopting it expect a written program governing any AI system that influences underwriting, pricing, or claims outcomes, and an agent that moves a reserve or accelerates a claim decision sits inside that frame as a regulated decision-maker.

A written program is the floor. Market-conduct review reaches for the operating evidence underneath it: what the agent was permitted to do, and whether the permission held on each decision it touched.

An agent that retrieves rating-adjacent data can pull a prohibited factor, or a proxy for one, into a decision without anyone instructing it to. The exposure exists whether or not the final output mentions the factor.

The control belongs at the read. Constrain what an underwriting or claims agent may retrieve, and record what it actually consulted, so the inputs to a contested decision are known rather than inferred.

Consumers can contest a denied claim or an adverse underwriting action, and regulators can compel the file. For an agent-touched decision, the file has to show what the agent did, what policy permitted it, what information it acted on, and where a human approved.

Per action is the unit. A quarterly governance attestation does not answer a question about one claimant's Tuesday.

Start agents where decisions are reviewable and reversible, with approval required on anything adverse, and widen permissions as the record accumulates. Each expansion is backed by the decisions the agent already made under tighter policy. That sequence reads to an examiner as governance operating, because it is.