AITC Comment Letter: Revised NAIC Model Bulletin: Use of Algorithms, Predictive Models, and AI Systems By Insurers
November 6, 2023
Commissioner Kathleen Birrane
Chair, Innovation, Cybersecurity, and Technology (H) Committee
National Association of Insurance Commissioners
1100 Walnut Street, Suite 1500
Kansas City, MO 64105
Re: Revised NAIC Model Bulletin: Use of Algorithms, Predictive Models, and Artificial Intelligence Systems By Insurers
Commissioner Birrane:
The American InsurTech Council (AITC) is an independent advocacy organization dedicated to advancing the public interest through the development of ethical, technology-driven innovation in insurance. We appreciate the opportunity to comment on these most recent revisions to the NAIC Model Bulletin: Use of Algorithms, Predictive Models, and Artificial Intelligence Systems By Insurers (Revised Model Bulletin).
We appreciate the leadership and hard work that you and other members of the Innovation, Cybersecurity, and Technology (H) Committee have committed to this extremely important project. We also appreciate consideration of AITC’s comments and recommendations in our previous comment letter, in particular clarification of definitions of several key terms such as “AI,” and the expansion of the definition of “AI systems.” Those changes reflect our view that regulatory focus should be on “AI” and how it is being utilized in specific use cases. Inclusion of a definition of “Generative AI,” is also an important addition.
Likewise, we are also concerned that actuarial methodologies that have been in use for many decades - but would not be considered “AI” as that term is commonly understood – could inadvertently be included in the Model Bulletin. A preferred approach is to avoid future debates over terms while focusing on substantive issues involving AI and how it is being applied in a specific business use case.
We would take this opportunity to once again urge the Committee to consider a few issues not yet addressed in the Revised Model Bulletin.
1. Include a Confidential Self-Audit of AI Processes. Insurance carriers that are interested in incorporating AI into one or more business process have a powerful self interest in developing a robust governance and risk framework tailored to their own unique risks. Inclusion of a confidential self-audit of AI processes and decisions would provide a framework for robust self-examination (including third-party providers) and, where necessary, remedial action.
2. Third Party AI Vendor Oversight. We appreciate the Committee’s effort to clarify expectations regarding use of AI systems provided by third party vendors. The “Where appropriate and available” standard contained in Section 4.2 is a helpful addition that should give insurance carriers and third-party vendors an opportunity to develop approaches that ensure the transparency that regulators expect while also ensuring legitimate IP concerns. We would also remind the Committee that smaller and medium sized companies have a significantly reduced ability to negotiate these terms into contracts with larger companies and those considerations should be taken into account by regulators.
3. Consider Utilizing a Pilot Project Approach. We reiterate here our previous recommendation that the NAIC conduct one or more pilot projects to develop a deeper understanding of how AI is utilized in practice, including companies’ risk management practices. This approach was utilized successfully with cybersecurity and would help the NAIC and other companies find best practices and yield new regulatory approaches to regulating this activity.
Thank you again for the opportunity to address our comments.
Respectfully Submitted,
Scott R. Harrison
Co-Founder, American InsurTech Council