Artificial Intelligence State Insurance Regulation: A Year in Review

By: Paige Waters and Stephanie O'Neill Macro

Much of the activity surrounding the state insurance regulation of artificial intelligence (“AI”) in the insurance industry this year was prompted by the NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers (“Model Bulletin”). The NAIC adopted the Model Bulletin late in 2023 at its Fall Meeting. The Model Bulletin makes clear that existing laws (e.g. unfair and deceptive practices, corporate governance disclosures, rate requirements prohibiting rates from being excessive, inadequate, unfairly discriminatory or discrimination based on protected classes, etc.) continue to apply and will be enforced in connection with the use of AI by insurers. The Model Bulletin provides guidance to insurers with respect to regulators’ expectations for insurers to establish governance and risk management programs relating to the insurer’s use of AI. The Model Bulletin applies to all phases of the insurance life cycle, including product development & design, marketing, underwriting, rating and pricing, and claim adjudication and payment. While the Model Bulletin only applies to insurers licensed in a state, third party vendors (for example, TPAs and claim adjusters) will be impacted by the requirements that insurers conduct due diligence to assess the third party data or AIS and the inclusion of certain provisions in the third party vendor contracts. Broadly, the Model Bulletin addresses:

Program Guidelines

• General Guidelines
• Governance
• Risk Management and Internal Controls
• Third-Party AI Systems and Data

Regulatory Oversight and Examination Considerations

• Information and Documentation Relating to AI System Governance, Risk Management, and Use of Protocols
• Third-Party Systems and Data

The guidance contained in the Model Bulletin is principles based rather than prescriptive in nature.

STATES ADOPTING THE MODEL BULLETIN IN 2024

So far during 2024, 21 states have issued bulletins which are substantially similar to the Model Bulletin. North Carolina and Massachusetts are the most recent states to issue guidance based upon the Model Bulletin. The chart below lists all states that have adopted the Model Bulletin in 2024:

STATES ADOPTING AI REGULATIONS OR OTHER GUIDANCE IN 2024

Two states, Colorado and New York, saw regulatory activity in connection with insurers’ use of AI that differed from the Model Bulletin.

Colorado

The Colorado Division of Insurance (“Colorado Division”) promulgated regulations in late 2023, 3 CCR 702 Reg. 10-1-1 et seq. – Dated July 23, 2023 – “Governance and Risk Management Framework requirements for Life Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models” implementing in part Colo. Rev. Stat. s 10-3-1104.9. This regulation applies only to life insurers issuing individual life policies and to all phases of the insurance life cycle. In 2024, the Colorado Division held stakeholder meetings and/or issued draft regulations for comment relating to governance and risk management framework requirements applicable to private passenger auto insurers, and health insurers. Throughout 2024, the Colorado Division contended with whether to put forward separate regulations for private passenger auto insurers and health insurers with respect to governance and risk management framework requirements or to integrate the requirements into the existing regulations applicable to life insurers. On December 6, 2024, the Colorado Division released for comment proposed amendments to 3 CCR 702 Reg. 10-1-1 (relating to life insurers) to incorporate additional requirements for life insurers and to expand the regulation to be applicable to private passenger auto insurers and health insurers. Also, in 2024 the Colorado Division continued its work on developing regulations relating to quantitative testing of algorithms and predicative models used by life insurers to ensure that their use is not unfairly discriminatory based upon race or ethnicity, which have not yet been adopted. See DRAFT PROPOSED 3CCR 702-10 - Algorithm Predictive Model Quantitative Testing Regulation. This proposed regulation has prompted significant scrutiny and comment from insurers and interested parties including the development alternative proposed regulations by the American Council of Life Insurers. The regulations proposed and adopted are detailed and prescriptive in nature.

New York

In July of 2024, the New York Department of Financial Services (“NYDFS””) finalized and adopted Circular Letter 2024-7 – “Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing” (“NY Letter”) after receiving and considering comments from the insurance industry. While the NY Letter touches on many of the same principles as the Model Bulletin, it is narrower in its application and does not follow the Model Bulletin. On its face, the NY Letter applies to use of ECDIS and AIS in connection with underwriting and pricing, whereas the Model Bulletin applies to all phases of the insurance life cycle. However, insurers would be wise to consider applying the guidance to its use of AI across all of its insurance practices. In the NY Letter, the definition of artificial intelligence differs from the Model Bulletin. Likewise, the definition of ECDIS is different than that which exists in the Colorado regulations. The NYDFS’ definitions appear to be simpler; however, as states continue to adopt their own guidance and regulations, insurers will have to grapple with whether the differences in definitions are intentional or a difference without a distinction. The NY Letter requires insurers to oversee third party vendors and insurers are responsible for outcomes of that use. Insurers must incorporate certain provisions into their third party vendor contracts. The NY Letter is also principles based rather than prescriptive oriented.

Expected Future AI Trends in State Insurance Regulatory Compliance

As we head into 2025, we anticipate the following:

• More states will adopt the Model Bulletin.
• Regulators will increase their focus on insurers’ use of third party vendors as the NAIC Third-Party Data and Models (H) Task Force moves forward in its efforts to develop and propose a framework for the regulatory oversight of third-party data and predictive models.
• The NAIC Market Conduct Examination Guidelines (D) Working Group will “coordinate with the Innovation, Cybersecurity and Technology (H) Committee to develop market conduct examiner guidance for the oversight of regulated entities’ use of insurance and non-insurance consumer data and models using algorithms and artificial intelligence (AI)”..

• Regulators will exercise greater scrutiny over insurance company filings related to the use of new technological innovations, including artificial intelligence, predictive models and algorithms.
• Regulators will continue to explore how best to regulate insurers’ use of AI given the regulators’ limited resources and other demands on those resources.
• Regulators will continue to hire subject matter experts to assist with the development of regulation of new technologies and AI in the insurance industry.
• Class action litigation will increase in connection with the insurance industry’s use of artificial intelligence and technological innovations that may result in business practices that allegedly result in unfair discrimination or bias against the insurance buying public or claiming that AI used for insurance claims resulted in an unfair claims settlement practice.