At the recent National Association of Insurance Commissioners (NAIC) meeting in Phoenix, Arizona (March 14–18), a new Third-Party Data and Models Task Force (Task Force) was created. The charges of the Task Force are twofold. The first charge is to develop and propose a framework for the regulatory oversight of third-party data and predictive models, including those utilizing artificial intelligence. The second charge is to monitor and report on state, federal, and international activities related to governmental oversight and regulation of third-party data and model vendors and their products and services. On April 5, 2024, the Task Force sent out a proposed 2024 Charges and Work Plan (Work Plan) seeking comments from interested regulators and parties.
Based on the Work Plan, in 2024 the Task Force will (i) research and gather information as to what types of artificial intelligence (AI)/machine learning (ML) models are currently being used by insurance companies that are provided by third parties and may require regulation; and (ii) evaluate the existing regulatory framework and explore any necessary updates or modifications. The goal of the Task Force is to develop and propose an optimal framework for the regulatory oversight of third-party data and predictive models. The Task Force may decide to draft new NAIC model laws or modify existing model laws in 2025.
Regulating insurers’ use of artificial intelligence systems has been the hot topic among the regulators since last summer when NAIC first published the proposed Model Bulletin on AI. Please see our previous analysis, “NAIC Considers Use of and Reliance on Third-Party AI Systems.” Insurers have been using third-party data and models in many aspects of their business, including rating, underwriting, marketing, and claims handling. The regulators have come to a consensus that “insurers are ultimately responsible for ensuring that insurance laws and regulations continue to be complied with while using data and models from third-party vendors.”
The new Task Force is another important step taken by NAIC after adopting the NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers (“Model Bulletin”) in December 2023. For a detailed discussion of the Model Bulletin, please refer to our previous analysis, “Best Practices for Utilizing AI/ML Tools as NAIC Adopts the Model Bulletin on Use of AI.”
Within the four months after the Model Bulletin was adopted by NAIC, eight states have adopted the Model Bulletin. Alaska became the first by issuing Bulletin B 24-01 on February 1, 2024. Seven other states have since followed. On April 6, 2024, Pennsylvania became the most recent state adopting the Model Bulletin by issuing Notice 2024-04 and joined Connecticut, Illinois, New Hampshire, Rhode Island, Vermont, and Nevada. Commissioner Gaffney (VT), chair of the Big Data and Artificial Intelligence (H) Working Group, commented during the meeting that several other states are very close to adopting, including Maryland. The NAIC is actively supporting and encouraging adoption by individual states and tracks the implementation of its Model Bulletin by an adoption map published on its website, which is updated monthly. Notably, besides adopting the Model Bulletin, Connecticut requires an annual certification of compliance with its bulletin No. MC-25.
Three other states have issued their own guidelines regarding insurers’ use of AI. California issued Bulletin 2022-5 on June 30, 2022, which orders insurance companies and other licensees to avoid bias and discrimination through the use of Big Data, and to provide transparency by informing consumers of the specific reasons of adverse underwriting decisions. Colorado passed the “Insurers Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models” (Colo. Rev. Stat. Sec. 10-3-1104.9) statute on July 6, 2021, which requires life insurers to establish a risk management system to prevent algorithms and predictive models that use external consumer data and information sources (ECDIS) from engaging in race-based discrimination, with an annual compliance attestation. Finally, on January 17, 2024, the New York Department of Financial Services published a Proposed Insurance Circular Letter that applies to all insurers authorized to write insurance in New York. The Circular aims to mitigate potential harm by encouraging the use of a risk management system similar to Colorado’s and by adopting some of the NAIC guidelines, including fairness principles, governance and risk management, and oversight of third-party vendors. More jurisdictions are moving in a similar direction, including New Jersey and the District of Columbia.
As we noted before, the Model Bulletin is principles-based and not prescriptive. However, judging from the creation of the Third-Party Data and Models Task Force and its Charges and Work Plan, it seems NAIC is actively working on proposing a unified regulatory framework and potentially a new set of model laws. Several potential regulating approaches include licensing of third-party providers by departments of insurance, and review and approval of models prior to use by insurers. Interested parties can provide comments to the Work Plan during the 30-day period through Monday, May 6, 2024.
*Veronica Rusu contributed to this alert.