Artificial Intelligence Systems

WEST VIRGINIA INSURANCE BULLETIN No. 24-06 Insurance Bulletins are issued when the Commissioner renders formal opinions, guidance or expectations on matters or issues, explains how new statutes or rules will be implemented or applied, or advises of interpretation or application of existing statutes or rules. ► ARTIFICIAL INTELLIGENCE SYSTEMS ◄ The purpose of this Bulletin is to remind insurers regulated by the Offices of the West Virginia Insurance Commissioner (OIC) that decisions or actions impacting consumers that are made or supported by advanced analytical and computational technologies, including Artificial Intelligence (AI) Systems, must comply with all applicable state insurance laws and rules. This includes, but is not limited to, laws and rules that address unfair trade practices, unfair claims settlement practices, and unfair discrimination. An AI System is a machine-based system that can, for a given set of objectives, generate outputs such as predictions, recommendations, content, or other output influencing decisions made in real or virtual environments. Use of AI Systems is transforming the insurance industry, but it can also present unique risks to consumers, including the potential for inaccuracy, unfair discrimination, data vulnerability, and lack of transparency. The OIC recognizes the Principles of Artificial Intelligence that the National Association of Insurance Commissioners (NAIC) adopted in 2020 as an appropriate source of guidance for insurers as they develop and use AI Systems. Those principles emphasize the importance of the fairness and ethical use of AI; accountability; compliance with state and federal laws and regulations; transparency; and a safe, secure, fair, and robust system. All insurers authorized to do business in West Virginia should develop, implement, and maintain a written program (AIS Program) for the responsible use of AI Systems that makes, or supports, decisions related to regulated insurance practices. Controls and processes that an insurer utilizes as part of its AIS Program should be reflective of, and commensurate with, the insurer’s own assessment of the degree and nature of risk posed to consumers by the AI Systems that it uses, considering: (i) the nature of the decisions being made, informed, or supported using the AI System; (ii) the type and degree of potential harm to consumers resulting from the use of AI Systems; (iii) the extent to which humans are involved in the final decision-making process; (iv) the transparency and explainability of outcomes to the impacted consumer; and (v) the extent and scope of the insurer’s use or reliance on data, predictive models, and AI Systems from third parties. The OIC recommends the following AIS Program guidelines be considered by insurers: 1.0. General Guidelines 1.1. The AIS Program should be designed to mitigate the risk that the insurer’s use of an AI System will result in adverse consumer outcomes. (An “adverse consumer outcome” refers to a decision by an insurer 2 that is subject to insurance regulatory standards enforced by the OIC that adversely impacts the consumer in a manner which violates those standards.) 1.2. The AIS Program should address governance, risk management controls, and internal audit functions. 1.3. The AIS Program should vest responsibility for the development, implementation, monitoring, and oversight of the AIS Program, and for setting the insurer’s strategy for AI Systems with senior management accountable to the board or an appropriate committee of the board. 1.4. The AIS Program should be tailored to and proportionate with the insurer’s use and reliance on AI and AI Systems. Controls and procedures should be focused on the mitigation of adverse consumer outcomes and the scope of the controls and procedures applicable to a given AI System use case should reflect and align with the degree of potential harm to consumers with respect to that use case. 1.5. The AIS Program may be independent of or part of the insurer’s existing Enterprise Risk Management (ERM) program. The AIS Program may adopt, incorporate, or rely upon, in whole or in part, a framework or standards developed by an official third-party standard organization, such as the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework, Version 1.0. 1.6. The AIS Program should address the use of AI Systems across the insurance life cycle, including areas such as product development and design, marketing, use, underwriting, rating (and pricing), case management, claim administration (including claim payments), and fraud detection. 1.7. The AIS Program should address all phases of an AI System’s life cycle, including design, development, validation, implementation (for both systems and business), use, ongoing monitoring, updating, and retirement. 1.8. The AIS Program should address the AI Systems used with respect to regulated insurance practices whether developed by the insurer or a third-party vendor. 1.9. The AIS Program should include processes and procedures to provide notice to impacted consumers that AI Systems are in use and provide free access to appropriate levels of information based on the phase of the insurance life cycle in which the AI Systems are being used. 2.0. Governance The OIC recommends that an insurer’s AIS Program include a governance framework for the oversight of AI Systems used by the insurer. Governance would ideally prioritize transparency, fairness, and accountability in the design and implementation of AI Systems while recognizing that proprietary and trade secret information must be protected. An insurer may consider adopting new internal governance structures or rely on the insurer’s existing governance structure; however, in developing its governance structure, the OIC suggests than an insurer consider addressing the following items: 2.1. The policies, processes, and procedures, including risk management and internal controls, to be followed at each stage of an AI System’s life cycle from proposed development to retirement. 2.2. The requirements adopted by the insurer to document compliance with the AIS Program policies, processes, procedures, and standards. 2.3. The insurer’s internal AI System governance accountability structure, such as: 3 2.3.a. The formation of centralized, federated, or otherwise constituted committees comprised of representatives from appropriate disciplines and units within the insurer, such as business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance, and legal; 2.3.b. Scope of responsibility and authority, chains of command, and decisional hierarchies; 2.3.c. The independence of decision-makers and lines of defense at successive stages of the AI System’s life cycle; 2.3.d. Monitoring, auditing, escalation, and reporting protocols and requirements; and 2.3.e. Development and implementation of ongoing training and supervision of personnel. 2.4. With respect to predictive models (meaning the mining of historic data using algorithms and/or machine learning to identify patterns and predict outcomes that can be used to make or support the making of decisions), the insurer’s processes and procedures for designing, developing, verifying, deploying, using, updating, and monitoring predictive models, including a description of methods used to detect and address errors, performance issues, outliers, or unfair discrimination in the insurance practices resulting from the use of the predictive model. 3.0. Risk Management and Internal Controls The OIC also recommends that an AIS Program document the insurer’s risk management framework and internal controls for AI Systems generally and at each stage of the AI System’s life cycle. Risk management and internal controls would ideally address the following items: 3.1. The oversight and approval process for the development, adoption, or acquisition of AI Systems, as well as the identification of constraints and controls on automation and design to align and balance function with risk. 3.2. Data practices and accountability procedures, including data currency, lineage, quality, integrity, bias analysis and minimization, and suitability. 3.3. Management and oversight of predictive models, including: 3.3.a. Inventories and descriptions of the predictive models; 3.3.b. Detailed documentation of the development and use of the models; and 3.3.c. Assessments such as interpretability, repeatability, robustness, regular tuning, reproducibility, traceability, model drift, and the auditability of these measurements where appropriate. 3.4. Validating, testing, and retesting as necessary to assess the generalization of AI System outputs upon implementation, including the suitability of the data used to develop, train, validate, and audit a predictive model. Validation can take the form of comparing model performance on unseen data available at the time of model development to the performance observed on data post-implementation, measuring performance against expert review, or other appropriate methods. 3.5. The protection of non-public information, particularly consumer information, including unauthorized access to the predictive models themselves. 3.6. Data and record retention. 4 3.7. A narrative description of the predictive model’s intended goals and objectives, and how the model is developed and validated to ensure that the AI Systems which rely on such models correctly and efficiently predict or implement those goals and objectives. 4.0. Third-Party AI Systems and Data The OIC further recommends that an AIS Program address the insurer’s process for acquiring, using, or relying on: (i) third-party data to develop AI Systems; and (ii) AI Systems developed by a third party, which may include, as appropriate, the establishment of standards, policies, procedures, and protocols relating to the following considerations: 4.1. Due diligence and the methods employed by the insurer to assess the third party and its data or AI Systems to ensure that decisions made or supported from such AI Systems that could lead to adverse consumer outcomes will meet the legal standards imposed on the insurer itself. 4.2. Where appropriate and available, the inclusion of terms in contracts with third parties that: 4.2.a. Provide audit rights and/or entitle the insurer to receive audit reports by qualified auditing entities; and 4.2.b. Require the third party to cooperate with the insurer regarding regulatory inquiries and investigations related to the insurer’s use of the third party’s product or services. 4.3. The performance of contractual rights regarding audits and/or other activities to confirm the third party’s compliance with contractual and, where applicable, regulatory requirements. The OIC recognizes that insurers may demonstrate their compliance with West Virginia and federal law in their use of AI Systems through means that differ from those described in this Bulletin. However, in the context of an OIC investigation or market conduct action, an insurer can expect to be asked about its development, deployment, and use of AI Systems irrespective of the existence or scope of a written AIS Program. As in all cases, investigations and market conduct actions may be performed using procedures that vary in nature, extent, and timing in accordance with regulatory judgment. Work performed may include inquiry, examination of company documentation, or any of the continuum of market actions described in the NAIC’s Market Regulation Handbook. These activities may involve the use of contracted specialists with relevant subject matter expertise. Nothing in this Bulletin limits the authority of the OIC to conduct any regulatory investigation, examination, or enforcement action relative to any act or omission of an insurer that the OIC is authorized to perform. Furthermore, nothing in this Bulletin alleviates an insurer’s responsibility to comply with state law regardless of the insurer’s use of an AI System. Please email any questions concerning this Insurance Bulletin to OICBulletins@wv.gov. Issued: August 9, 2024 ______________________________ Allan L. McVey CPCU, ARM, AAI, AAM, AIS Insurance Commissioner