The Use of Artificial Intelligence Systems by Insurers

STATE OF CONNECTICUT INSURANCE DEPARTMENT Bulletin No. MC-25 February 26, 2024 USE OF ARTIFICIAL INTELLIGENCE SYSTEMS BY INSURERS TO: All Insurers Licensed to Do Business In Connecticut (“Insurers”) RE: The Use of Artificial Intelligence Systems in Insurance This Bulletin updates and replaces the Department’s Notice issued on April 20, 2022, concerning the usage of big data and avoidance of discriminatory practices. The Connecticut Insurance Department (“Department”) reminds all Insurers that decisions or actions affecting consumers made and supported by advanced analytical and computational technologies, including AI Systems (as defined below), must comply with all applicable insurance laws and regulations. This includes unfair trade practice and unfair discrimination laws. This bulletin sets forth the Department’s expectations for Insurers’ governance of the development, acquisition and use of certain AI (as defined below) technologies, including the AI Systems. This bulletin also advises Insurers of the type of information and documentation that the Department may request during an investigation or examination of an Insurer’s use of such technologies and AI Systems. Connecticut domestic Insurers must complete the Artificial Intelligence Certification (“Certification”), which is due on or before September 1, 2024, and annually thereafter. The Certification can be accessed here https://www.catalog.state.ct.us/cid/portalApps/DataCertification.aspx. If an Insurer certifies that it demonstrates compliance with applicable laws related to its use of AI Systems through alternative means, the Insurer must provide a description of the alternative means as part of its the Certification. SECTION 1: INTRODUCTION, BACKGROUND AND LEGISLATIVE AUTHORITY Background AI is transforming the insurance industry. AI technologies are deployed across all stages of the insurance life cycle, including product development, marketing, sales and distribution, underwriting and pricing, policy servicing, claim management, and fraud detection. As such, AI may facilitate the development of innovative products, improve consumer interface and service, simplify and automate processes, and promote efficiency and accuracy. The Department encourages the development and use of innovation and AI Systems that contribute to safe and stable insurance markets. However, AI and AI Systems, can present unique risks to consumers, including the potential for inaccuracies, unfair discrimination, data vulnerability, lack of transparency and explainability. Insurers must take actions to minimize these risks. In addition, the Department expects that Insurers’ decisions and the actions taken using AI Systems will comply with all applicable federal and state laws and regulations. www.ct.gov/cid P.O. Box 816 Hartford, CT 06142-0816 Affirmative Action/Equal Employment Opportunity Employer The Department recognizes the NAIC’s Principles of Artificial Intelligence1 as appropriate guidance for Insurers as they develop and use AI Systems. Those principles emphasize the importance of the fair and ethical use of AI, accountability, compliance with state laws and regulations, transparency, and need for a safe, secure, fair and robust system. These fundamental principles should guide Insurers in their development, acquisition and use of AI Systems, and underlie the expectations set forth in this bulletin. Bulletin Authority – Connecticut Insurance Law Insurers’ development and use of AI Systems must comply with all applicable insurance laws and regulations. Below are key provisions of the Connecticut Insurance Law that Insurers must consider in conjunction with AI Systems. Please note that the provisions highlighted below are not intended to be an exhaustive listing of the applicable law applicable to the use of AI Systems. 1. Connecticut Unfair Insurance Practices Act The regulatory guidance and expectations set forth in Section 3 and Section 4 of this bulletin rely in part on the Connecticut Unfair Insurance Practices Act (“CUIPA”). Conn. Gen. Stat. §38a-815 to §38a-819. CUIPA defines practices that constitute unfair methods of competition or unfair or deceptive acts and practices, and prohibits such acts and practices. CUIPA also defines unfair claim settlement practices and sets the standards for the investigation and disposition of claims. See Conn. Gen. Stat. § 38a-816(6). Insurers in Connecticut must avoid violations of any CUIPA provisions. As such, Insurers are expected to adopt practices, including governance frameworks and risk management protocols, that are designed to ensure that the use of AI Systems does not result in any unfair trade acts or practices prohibited under CUIPA. 2. Corporate Governance Annual Disclosure Report In the required corporate governance annual disclosure report (“CGAD Report”), Insurers must report on governance practices, and provide a summary of the Insurer’s corporate governance structure, policies, and practices. The content, form, and filing requirements for CGAD Report are set forth in Conn. Gen. Stat. §38a-142a. The CGAD Report must include a description of each Insurer’s processes by which its board and senior management ensure an appropriate amount of oversight of the critical risk areas impacting the Insurer's business activities. See Conn. Gen. Stat. §38a-142a(c)(5). This includes the Insurer’s use of AI Systems to support actions and decisions that affect consumers. 3. Insurance Rate Requirements Insurers must comply with all Connecticut insurance laws and regulations regarding rates, rating plans, rating rules, practices and standards, referred to in this bulletin as the “Rating Laws.” For example, some Rating Laws mandate that insurance rates are not excessive, inadequate, unfairly discriminatory, or discriminate based on protected classes. (e.g., for personal and commercial risk insurance rating practices for property and casualty see Conn. Gen. Stat. §38a-663 to §38a-696; for 1 NAIC Principles of Artificial Intelligence https://content.naic.org/sites/default/files/inline­ files/AI%20principles%20as%20Adopted%20by%20the%20TF_0807.pdf 2 health insurance see Conn. Gen. Stat. §§38a-481, 38a-501a, 38a-528a, and 38a-556; for life insurance see Conn, Gen. Stat. §38a-446 and §38a-447). Insurers in Connecticut using AI Systems must avoid any violations of the Rating Laws. The Rating Laws apply regardless of the methodology that the Insurer used to develop the applicable rates, rating rules, and rating plans. That means that an Insurer is responsible for ensuring that all applicable rates, rating rules, and rating plans developed using AI techniques and Predictive Models (as defined below) do not result in rates or practices that violate the Rating Laws. 4. Market Conduct Examinations and Investigations Conn. Gen. Stat. §38a-15 and §38a-16 establish the framework pursuant to which the Department performs market conduct examinations and investigations, which can be undertaken as part of the Department’s authority to periodically monitor the market practices of Insurers or to address illegal practices by Insurers brought to the Department’s attention by individual consumer complaints made by consumers asserting illegal practices by Insurers. An Insurer’s conduct in Connecticut, including its use of AI Systems to make or support actions and decisions that affect consumers is subject to review and action by the Department. Section 4 of this Bulletin provides guidance regarding the kinds of information and documents that the Department may request in the context of an AI-focused market conduct examination or investigation. SECTION 2: DEFINITIONS The terms used in this bulletin shall have the meaning set forth in this section. “Adverse Consumer Outcome” refers to a decision by an Insurer that is subject to insurance regulatory standards enforced by the Department that adversely impacts the consumer in a manner that violates those standards. “Algorithm” means a clearly specified mathematical process for computation; a set of rules that, if followed, will give a prescribed result. “AI System” is a machine-based system that can, (1) for a given set of objectives, generate outputs such as predictions, recommendations, content (such as text, images, videos, or sounds), or other output influencing decisions made in real or virtual environments; and (2) are designed to operate with varying levels of autonomy. “Artificial Intelligence” or “AI” refers to (1) a branch of computer science that uses data processing systems that perform functions normally associated with human intelligence, such as reasoning, learning, and self-improvement; or (2) the capability of a device to perform functions that are normally associated with human intelligence such as reasoning, learning, and selfimprovement. Machine Learning is a subset of Artificial Intelligence. “Degree of Potential Harm to Consumers” refers to the severity of an unfair or deceptive act or practice prohibited under Connecticut Law in relation to the impact that a consumer might experience as a result of an Adverse Consumer Outcome. 3 “Generative Artificial Intelligence” or “Generative AI” refers to a class of AI Systems that generate content in the form of data, text, images, sounds, or video, that is similar to, but not a direct copy of pre-existing data or content. “Machine Learning” refers to the ability of a computer or system to learn from provided data without being explicitly programmed. “Model Drift” refers to the decay of a model’s performance over time arising from underlying changes such as the definitions, distributions, and/or statistical properties between the data used to train the model and the data on which it is deployed. “Predictive Model” refers to the mining of historic data using Algorithms and/or Machine Learning to identify patterns and predict outcomes that can be used to make or support decisions. “Third Party” means an organization other than an Insurer that provides services, data, or other AI related resources. SECTION 3: REGULATORY GUIDANCE AND EXPECTATIONS Insurers’ decisions subject to regulatory oversight that are made using AI Systems must comply with the legal and regulatory standards that apply to those decisions, including CUIPA and the appliable Rating Laws. These standards require, at a minimum, that such decisions (1) are not based on and do not constitute unfair and deceptive acts and practices; and (2) that do not result in excessive, inadequate or unfairly discriminatory insurance rates. In the absence of proper controls, AI has the potential to increase the risk of Adverse Consumer Outcomes. To address this risk and ensure compliance with all appliable laws, it is important that Insurers adopt and implement controls specifically related to their use of AI. Robust governance, risk management controls, and internal audit functions play critical roles in mitigating the risk that decisions driven by AI Systems will violate any applicable insurance laws and regulations. Accordingly, all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an “AIS Program”) for the responsible use of AI Systems that make or support decisions related to regulated insurance practices and products. The AIS Program should be designed to mitigate the risk of Adverse Consumer Outcomes and promote compliance with all applicable insurance laws and regulations. In addition, the AIS Program should specifically address the development and use of verification and testing methods to identify errors and bias in Predictive Models and AI Systems, as well as the potential for unfair discrimination in the decisions and outcomes resulting from the use of Predictive Models and AI Systems. The controls and processes that an Insurer adopts and implements as part of its AIS Program should be reflective of, and commensurate with, the Insurer’s own assessment of the degree and nature of risk posed to consumers by its AI Systems, considering: (i) the nature of the decisions made, informed, or supported using an AI System(s); (ii) the type and Degree of Potential Harm to Consumers resulting from the use of an AI System(s); (iii) the extent to which humans are involved in the final decision-making process; (iv) the transparency and explainability of outcomes to the affected consumer; and (v) the extent and scope of the insurer’s use or reliance on data, Predictive Models, and AI Systems from Third Parties. 4 An Insurer’s decisions made or supported using an AI System(s) are subject to the Department’s examination to determine whether such decisions are compliant with all applicable insurance laws and regulations. AIS Program Guidelines 1.0 General Guidelines 1.1 The AIS Program should be designed to comply with all applicable insurance laws and regulations, and to mitigate the risk that the Insurer’s use of an AI System(s) will result in Adverse Consumer Outcomes. 1.2 The AIS Program should address governance, risk management controls, and internal audit functions. 1.3 The AIS Program should place the responsibility for (i) the development, implementation, monitoring and oversight of the AIS Program, and (ii) setting the Insurer’s strategy for AI Systems on senior management accountable to the board or an appropriate committee of the board. 1.4 The AIS Program should be tailored to and proportionate with the Insurer’s use and reliance on AI and AI Systems, and should set controls and procedures focused on the mitigation of Adverse Consumer Outcomes. The scope of the controls and procedures applicable to a given AI System use case should reflect and align with the Degree of Potential Harm to Consumers with respect to that use case. 1.5 The AIS Program may be independent of or part of the Insurer’s existing Enterprise Risk Management (ERM) program, and may adopt, incorporate, or rely upon, in whole or in part, a framework or standards developed by an official third-party standard organization, such as the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework, Version 1.0.2 1.6 The AIS Program should address the use of AI Systems across the insurance product life cycle, including areas such as product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, and fraud detection. 1.7 The AIS Program should address all phases of an AI System’s life cycle, including design, development, validation, implementation (both systems and business), use, on­ going monitoring, updating and retirement. 1.8 The AIS Program should address the AI Systems used with respect to regulated insurance practices whether developed by the Insurer or a Third Party. 1.9 The AIS Program should include processes and procedures addressing the provision of notice to affected consumers that AI Systems are in use and provide access to appropriate levels of information based on the phase of the insurance product life cycle in which the AI Systems are being used. 2 NIST Artificial Intelligence Risk Management Framework 1.0 https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf 5 2.0 Governance The AIS Program should include a governance framework for the oversight of an Insurer’s AI Systems. Governance should prioritize transparency, fairness, and accountability in the design and implementation of the AI Systems, recognizing that proprietary and trade secret information must be protected. An Insurer may consider adopting new internal governance structures or rely on the Insurer’s existing governance structures. In developing its governance framework, the Insurer should address the following items: 2.1 The policies, processes, and procedures, including risk management and internal controls, to be followed at each stage of an AI System life cycle, from proposed development to retirement. 2.2 The requirements adopted by the Insurer to document compliance with the AIS Program policies, processes, procedures, and standards. Documentation requirements should be developed in accordance with the guidelines provided in Section 4. 2.3 The Insurer’s internal AI System governance accountability structure, such as: a) The formation of centralized, federated, or otherwise constituted committees comprised of representatives from appropriate disciplines and units within the Insurer, such as business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance, and legal. b) Scope of responsibility and authority, chains of command, and decisional hierarchies. c) The independence of decision-makers and lines of defense at successive stages of the AI System life cycle. d) Monitoring, auditing, escalation, and reporting protocols and requirements. e) Development and implementation of ongoing training and supervision of personnel. 2.4 As it specifically relates to Predictive Models, the Insurer’s processes and procedures for designing, developing, verifying, deploying, using, updating, and monitoring Predictive Models, including a description of methods used to detect and address errors, performance issues, outliers, or unfair discrimination in the insurance practices resulting from the use of the Predictive Model. 3.0 Risk Management and Internal Controls The AIS Program should document the Insurer’s risk identification, mitigation, and management framework and internal controls for AI Systems generally and at each stage of the AI System life cycle. Risk management and internal controls should address the following items: 3.1 The oversight and approval process for the development, acquisition and use of AI Systems, as well as the identification of constraints and controls on automation and design to align and balance function with risk. 6 3.2 Data practices and accountability procedures, including data currency, lineage, quality, integrity, bias analysis and minimization, and suitability. 3.3 Management and oversight of Predictive Models (including Algorithms used therein), including: a) Inventories and descriptions of the Predictive Models. b) Detailed documentation of the development and use of the Predictive Models. c) Assessments such as interpretability, repeatability, robustness, regular tuning, reproducibility, traceability, Model Drift, and the auditability of these measurements where appropriate. 3.4 Validating, testing, and retesting as necessary to assess the generalization of AI System outputs upon implementation, including the suitability of the data used to develop, train, validate and audit the model. Validation can take the form of comparing model performance on unseen data available at the time of model development to the performance observed on data post-implementation, measuring performance against expert review, or other methods. 3.5 The protection of non-public information, particularly consumer information, including unauthorized access to the Predictive Models themselves. 3.6 Data and record retention. 3.7 As it specifically relates to Predictive Models: a narrative description of the model’s intended goals and objectives and how the model is developed and validated to ensure that the AI Systems that rely on such models correctly and efficiently predict or implement those goals and objectives. 4.0 Third Party AI Systems and Data Each AIS Program should address the Insurer’s process for acquiring, validating, using, or relying on (i) Third Party data to develop AI Systems, and (ii) AI Systems developed by a Third Party, which may include, as appropriate, the establishment of standards, policies, procedures, and protocols relating to the following considerations: 4.1 Due diligence and the methods employed by the Insurer to assess the Third Party and its data or AI Systems to ensure that decisions made or supported from such AI Systems that could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the Insurer itself. 4.2 Where appropriate and available, the inclusion of terms in contracts with Third Parties that: a) Provide audit rights and/or entitle the Insurer to receive audit reports by qualified auditing entities. 7 b) Require the Third Party to cooperate with the Insurer to promptly address regulatory inquiries and investigations related to the Insurer’s use of the Third Party’s product or services. 4.3 The performance of contractual obligations of Third Parties regarding audits and/or other activities to confirm the Third Party’s compliance with contractual and, where applicable, regulatory requirements. SECTION 4: REGULATORY OVERSIGHT AND EXAMINATION CONSIDERATIONS The Department is responsible for oversight of an Insurer’s conduct in Connecticut, including its use of AI Systems to make or support decisions that affect consumers. Regardless of the existence or scope of a written AIS Program, in the context of an investigation or market conduct examination, an Insurer should be prepared to provide information to the Department about its development, acquisition, and use of AI Systems and Predictive Models, any outcomes (including Adverse Consumer Outcomes) from the use of those AI Systems, and any other information or documentation deemed relevant by the Department. Insurers should expect investigation or market conduct inquiries to include (but not be limited to) the Insurer’s governance framework, risk management, and internal controls (see Section 3). In addition to conducting a review of any of the items listed in this Bulletin, the Department may also ask questions regarding any specific model, AI System, or its application, including requests for the following types of information and/or documentation: 1. Information and Documentation Management, and Use Protocols Relating to AI System Governance, Risk 1.1. Information Program, including: and documentation related to or evidencing the Insurer’s AIS a) The written AIS Program. b) Information and documentation relating to or evidencing the adoption of the AIS Program. c) The scope of the Insurer’s AIS Program, including any AI Systems and technologies not included in or addressed by the AIS Program. d) How the AIS Program is tailored to and proportionate with the Insurer’s use and reliance on AI Systems, the risk of Adverse Consumer Outcomes, and the Degree of Potential Harm to Consumers. e) The policies, procedures, guidance, training materials, and other information relating to the adoption, implementation, maintenance, monitoring, and oversight of the Insurer’s AIS Program, including: i. Processes and procedures for the development, acquisition and use of AI Systems, such as: 8 (1) Identification of constraints and controls on automation and design. (2) Data governance and controls, any practices related to data lineage, quality, integrity, bias analysis and minimization, suitability, and Data Currency. ii. Processes and procedures related to the management and oversight of Predictive Models, including measurements, standards, or thresholds adopted or used by the Insurer in the development, validation, and oversight of models and AI Systems. iii. Protection of non-public information, particularly consumer information, including unauthorized access to Predictive Models themselves. 1.2. Information and documentation relating to the Insurer’s pre-acquisition or pre-use due diligence, monitoring, oversight, and auditing of data or AI Systems developed by a Third Party. 1.3. Information and documentation relating to or evidencing the Insurer’s implementation and compliance with its AIS Program, including documents relating to the Insurer’s monitoring and audit activities such as: a) Documentation relating to or evidencing the formation and ongoing operation of the Insurer’s coordinating bodies for the oversight of the development, acquisition, and use of AI Systems. b) Documentation related to data practices and accountability procedures, including data lineage, quality, integrity, bias analysis and minimization, suitability, and Data Currency. c) Management and oversight of Predictive Models and AI Systems, including: i. The Insurer’s inventories and descriptions of Predictive Models, and AI Systems used by the Insurer to make or support decisions that may result in Adverse Consumer Outcomes. ii. As to any specific Predictive Model or AI System that is the subject of an investigation or examination: (1) Documentation of compliance with all applicable AIS Program policies, protocols, and procedures in the oversight of the development, acquisition and use of Predictive Models and AI Systems deployed by the Insurer. (2) Information about oversight of data used in the development and use of the specific model or AI System, including the data 9 source, provenance, data lineage, quality, integrity, bias analysis and minimization, suitability, and Data Currency. (3) Information related to the techniques, measurements, thresholds, and similar controls used by the Insurer. d) Documentation related to validation, testing, and auditing, including evaluation of Model Drift to assess the reliability of outputs that influence the decisions made based on Predictive Models. Note that the nature of validation, testing, and auditing should be reflective of the underlying components of the AI System whether based on Predictive Models or Generative AI. 2. Third Party AI Systems and Data If and investigation or examination concerns data, Predictive Models, or AI Systems collected or developed in whole or in part by Third Parties, the Insurer should also expect the Department to request the following additional types of information and documentation. 2.1 Due diligence conducted on Third Parties and their data, models, or AI Systems. 2.2 Contracts with Third Party AI System, model, or data vendors, including terms relating to representations, warranties, data security and privacy, data sourcing, intellectual property rights, confidentiality and disclosures, and/or cooperation with regulators. 2.3 Audits and/or confirmation processes performed regarding Third Party compliance with contractual and, where applicable, regulatory obligations. 2.4 Documentation pertaining to validation, testing, and auditing, including evaluation of Model Drift. The Department recognizes that Insurers may demonstrate their compliance with the applicable laws related to their use of AI Systems through alternative means, including through practices that differ from those described in this bulletin. The goal of the bulletin is not to prescribe specific practices or to prescribe specific documentation requirements. Rather, the goal is to ensure that Insurers are aware of the Department’s expectations pertaining to the governance and management of AI Systems, and information and documents about an Insurer’s AI Systems that the Department may require. As in all cases, investigations and market conduct actions may be performed using procedures that vary in nature, extent, and timing in accordance with regulatory judgment. Work performed may include inquiry, examination of company documentation, or any of the continuum of market actions described in the NAIC’s Market Regulation Handbook. These activities may involve the use of contracted specialists with relevant subject matter expertise. Nothing in this bulletin limits the authority of the Department to conduct any regulatory investigation, examination, or enforcement action relative to any act or omission of any Insurer that the Department is authorized to perform. Insurance Commissioner __________________________ Andrew N. Mais 10