Originally published in ON THE RISK, the Journal of the Academy of Life Underwriting, March 2024
A hot topic on this year’s conference circuit has been the use of artificial intelligence (AI) in life insurance underwriting. While the industry is still in the early phases of determining how to best tap AI’s potential, there are significant opportunities to better and more efficiently assess risk with AI. New generative AI tools are expected to change the way we do business as an industry. With AI’s ability to absorb and assess data at a rapid pace, the possibilities are very exciting.
However, with this potential comes certain challenges and it will be important that the industry balance the benefits with the risks inherent in these tools. Accelerated underwriting techniques use external data sources in applying algorithms to make, manage or influence underwriting decisions about an applicant. These underwriting algorithms have the potential to unfairly discriminate on the basis race or other protected classes, which has raised concerns of state and federal regulators.
States are considering how to hold insurance companies accountable to ensure that their external data sources and algorithms do not unfairly discriminate – this is referred to as “algorithmic accountability.”
Current Regulatory Events
Below is a summary of the current state regulatory events as of the writing of this article:
1. Colorado Legislation (SB 169)
In June of 2021, Colorado Governor Polis signed Senate Bill (SB) 169 into law, which aims to protect Colorado consumers from insurance practices that result in unfair discrimination on the basis of race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression. Specifically, SB 169 prohibits insurers from using any external consumer data and information sources (ECDIS), algorithms, or predictive models with regard to any insurance practice that unfairly discriminates.
In follow up to the bill’s passage, rules are developed that detail how companies should test and demonstrate that their use of ECDIS is not unfairly discriminatory. The bill directs the state Insurance Commissioner to work with stakeholders (insurance companies, insurance agents/producers, consumer representatives, and other interested parties) before these rules are adopted. To accomplish this, the Commissioner will hold separate stakeholder meetings to address specific types of insurance (e.g., life, auto, health), as well as specific insurance practices (e.g., marketing, underwriting, claims management).
In September 2023, Colorado adopted the first such rule which focused on life insurance underwriting – Regulation 10-1-1 Governance and Risk Management Framework Requirements for Life Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models (Colorado Governance Regulation).
Colorado Governance Regulation
Effective November 14, 2023, this regulation requires that life insurers doing business in Colorado must establish a governance and risk management framework, which must be in place by December 1, 2024, and attested to annually. While there are many detailed aspects of the regulation, key components include:
- Documented governing principles that provide the guidance necessary for ensuring oversight of the use of ECDIS (and the algorithms and predictive models that use it) and that they are reasonably designed to prevent unfair discrimination.
- Oversight by the board of directors or a committee of the board.
- Senior management responsibility and accountability.
- Creation and maintenance of a cross-functional governance group with representation from key functional areas (including underwriting and actuarial functions among others).
- Documented policies, processes and procedures for the design, development, testing, deployment, use and ongoing monitoring of use of consumer data.
- Including internal supervision and training for relevant personnel on the responsible and compliant use of this data.
- Processes and protocols for addressing consumer complaints and inquiries
- Description of testing conducted to detect unfair discrimination resulting from the use of external consumer data as well as the algorithms and predictive models that use it.
- Including documentation of the methodology, assumptions, results, and steps taken to address unfairly discriminatory outcomes. - Annual reviews of the governance structure and risk management framework.
This regulation requires immediate attention from life insurers who do business in Colorado. Beyond meeting the December 1, 2024, deadline to have the governance and risk management framework in place, insurers must submit a progress report on their efforts by June 1, 2024! You may be called upon to inventory use of ECDIS to assist your legal, compliance and/or risk areas with this report.
Colorado Draft Testing Regulation
Following on the heels of the adoption of the Colorado Governance Regulation, Colorado released a proposed regulation (10-2-XX on Qualitative Testing of ECDIS, Algorithms, and Predictive Models Used for Life insurance Underwriting for Unfairly Discriminatory Outcomes) that will require life insurers to perform quantitative testing to ensure their use of ECDIS is not unfairly discriminatory based on race or ethnicity, and report results to the state. In this case, the regulation only applies to life insurers using ECDIS in underwriting, covering application and premium data through December 31, 2023. However, annual testing will be required for subsequent years.
The proposed regulation would require carriers to assign race and ethnicity before testing their algorithms set to ensure they do not discriminate against protected classes in terms of both application approval decisions and premium rates, taking into account policy type, face amount, age, gender and tobacco use. A key challenge for the industry will be the assignment of race and ethnicity and who will establish and manage the results. Most carriers do not want to store it within their operating systems. If quantitative testing reveals that there may be an unfairly discriminatory outcome, insurers will be required to perform additional testing to identify the cause and take reasonable corrective steps.
This second regulation also provides clarity on the definition of ECDIS, as the definition in the governance regulation does not include “traditional underwriting factors” such as MIB data, MVR records, prescription drug history or other information related to application questions such as medical information, family history and disabilities.
2. NAIC Model Bulletin
In December 2023, the NAIC adopted a model bulletin on the use of artificial intelligence systems by insurers. It establishes expectations for insurers around the use and governance of AI technology, encouraging companies to develop, implement and maintain a written program for the use of AI systems that:
- Is designed to mitigate risk of decisions that are inaccurate, arbitrary or capricious, unfairly discriminatory or otherwise violate unfair trade practice laws.
- Cover governance processes, risk management controls and internal audit functions.
- Including validation, testing and auditing of AI systems.
- Is tailored to and proportional with the insurer’s use and reliance on AI.
- Addresses the use of AI across all phases of the insurance product life cycle.
- Deals with uses of AI that impact the consumer, whether developed by the insurer or a third party.
While the NAIC bulletin is principles-based and not overly prescriptive, in addition, it is not binding in and of itself, it is meant to be a model for states to use – helping regulators move more quickly (in most cases without any legislative involvement or need for administrative rulemaking) and facilitating a consistent approach across states. Only time will tell how quickly and to what extent this bulletin will be adopted, but regulatory activity in this area is moving quickly and it would not be surprising if several states were to adopt the bulletin in some form, in 2024.
Implications for Underwriters
Clearly for most organizations underwriting leadership will play a key role in establishing inventory lists of EDCIS and implementing governance models. As noted, the Colorado model requires a cross-functional governance group where underwriting will likely be at the table
The time to act is now
Given the implications of these legislative actions are far reaching, it is critical that insurers proactively begin to plan their governance models and testing frameworks now - and avoid the need to scramble in order to become compliant as new regulations take hold.
References:
3 Colo. Code Regs. § 702-10 (2023) https://drive.google.com/file/d/1dlPKJCDo76iHfJZDopQEhTDCmKbuYnNI/view?pli=1
3 Colo. Code Regs. § 702-10 (proposed September 27, 2023). https://drive.google.com/file/d/1BMFuRKbh39Q7YckPqrhrCRuWp29vJ44O/view
Nat’l Ass’n of Ins. Comm’r. Model Bulletin: Use of Artificial Intelligence Systems by Insurers (December 4, 2023). https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf
About Christie Corado, General Counsel, Corporate Secretary and Chief Privacy Officer, MIB and John Allen, Regulatory Compliance Counsel, MIB
Christie Corado was appointed General Counsel, Corporate Secretary and Chief Privacy Officer in 2021. She is responsible for overseeing MIB's activities in the areas of legal, regulatory and compliance as well as serving as Corporate Secretary and Chief Privacy Officer. Prior to joining MIB, Christie was Senior Vice President and Deputy General Counsel at Truist Insurance Holdings, Inc. where she was responsible for the legal and regulatory functions. Prior to that role, Christie was General Counsel of Crump Life Insurance Services, Inc., one of the life insurance industry's leading brokers and service providers, after initially serving as an Advanced Marketing Attorney with a general agency acquired by Crump. Christie serves on the Board of Directors of Finesca (formerly AALU/GAMA) and the Board of Governors of Saint Joseph's University Maguire Academy of Insurance and Risk Management. She has extensive insurance industry advocacy experience, including leadership roles on the legislative and regulatory committees of the Council of Insurance Agents and Brokers (CIAB) and the Wholesale Specialty Insurance Association (WSIA). She holds a J.D. from Widener University School of Law and a B.S. in Finance from Pennsylvania State University. She retains her insurance license and securities registration to maintain her deep understanding of insurance and securities products and challenges. John Allen currently serves as Regulatory Compliance Counsel at MIB. Prior to joining MIB in 2022, John served as Counsel and Corporate Secretary at California Casualty Management Company where he was responsible for the legal and regulatory matters impacting the company. Before working at California Casualty, John served as Counsel at Combined Insurance Company of America, a Chubb company. John holds a Bachelor of Science degree in finance from the University of Tennessee, a Master of Business Administration degree from San Diego State University, and a Juris Doctor degree from Thomas Jefferson School of Law.
