AI governance software for insurers: every model and vendor AI tool listed, tested and signed off before an examiner asks
Every AI system listed, tested and signed off before an examiner asks.
See one case, screen by screen ↓Software that keeps one inventory of every AI system an insurer uses — built in-house or bought — with its risk tier, owner, tests and sign-offs, and maps each one to the AI rules that apply. AI Governance & Model Inventory adds six agents that find the AI nobody filed, draft model cards, check tests against cadence, map rules and draft the examiner’s answers.
How to choose AI solutions for insurance →
Updated
AI now runs in pricing, underwriting, claims triage, SIU referral, customer service and marketing, and much of it was bought: a scoring service, a claims platform that gained a recommendation feature in a release, a call-centre tool that now summarises calls. The inventory is a spreadsheet filled by an annual survey to the business units, and vendor AI only reaches it if someone thinks to file it. The contract amendments and release notes that switch on a machine-learning feature are read by procurement and IT, not by model risk.
Regulators now ask for one list of every AI system, the data it uses, how it was tested and who approved it — and New York says plainly that responsibility stays with the insurer, vendor tools included. Validation cadence slips when a rating plan is refit or a vendor retrains its model and nobody reopens sign-off. Vendor contracts often give audit rights over data security but not over the model. So when the AI section of a market conduct exam arrives, the answer is weeks of emails and screenshots.
Estimated split for answering a regulator’s AI questionnaire at a mid-size multi-line insurer, by email and from the register.
Six specialist agents find, describe, test and map every AI system, vendor tools included; four people sign each one and the CRO attests.
Monday, October 12, 2026, at Calder Ridge Insurance Group, a fictional carrier writing personal auto, homeowners, small commercial and term life in 14 states. A claims platform amendment arrived overnight. Here is what happens next, screen by screen, in the working solution.
Nadia opens the register: 147 AI systems, 61 built in-house and 86 from vendors, 22 High risk, 8 broken chains. A strip draws every system as one tick, grouped by pricing, underwriting, claims, fraud, life, customer service, marketing and operations. Rows with a broken sign-off chain sit at the top — a refit rating plan, a roof score waiting for its external data review, a letter-drafting tool with no owner. Three documents arrived overnight.
“147 AI systems · 8 broken chains”
Nadia presses “Read with AI finder”. It reads the 38 pages of Vantor Systems’ Amendment 4 to the ClaimsCore Master Subscription Agreement and writes a margin note against every clause that matters. §7.4 lets Vantor switch on machine-learning features without notice. §7.6 lets it train them on Calder Ridge’s de-identified claims, pooled with other insurers’ data. §12.2 gives audit rights over data security, not over the model. §14.1 does require cooperation with regulators.
“Vendor may enable Intelligent Features … that use machine learning to generate recommendations … without further notice.” — Amendment 4, §7.4
The finder matches §7.4 to ClaimsCore release notes 24.3 — Auto-Reserve Assist, a suggested initial reserve on new bodily-injury and PIP claims, on by default since Sep 3. It checks the register: no ClaimsCore reserve system among 147 rows. It counts use in the claim system: 2,316 claims, 212 adjusters, 71% of suggestions accepted unchanged. It proposes AIS-148, Initial reserve recommender, High risk, and the row lands at the top of the register with the clause quoted under it.
Proposes only — the AI governance lead registers or dismisses.
The model card is already drafted from three documents: purpose, where it runs, inputs (claim type, injury codes, venue, attorney representation, prior claim history), output, training data, who uses it, why it is High risk and its known limits. Reserves set settlement authority and offers on injury claims, so the output reaches a consumer’s claim payment. Since Sep 3 it has suggested $38.4M in reserves.
“Drafted by the model card writer from 3 documents; every line cites its source.”
Nadia registers AIS-148 and names Dev Malhotra, claims analytics lead, as model owner — he owns the claims severity, subrogation and total-loss models already. Registering confirms the finder’s proposal; the owner accepts the system in writing, and the first link of the chain turns solid.
She sends Vantor an evidence request under §14.1, the regulatory cooperation clause, with a copy to Owen Achebe in third-party risk: the model card, accuracy against incurred losses at 90 days by state, a monthly drift report, adverse impact tests by imputed race and ethnicity, sex and age band on injury claims, and the change log for every release since 24.0. Due Oct 26.
Until the system is validated, the adjuster saves their own reserve first and the suggestion appears after; differences over 25% go to a supervisor. Sam Whitfield approves it as business owner, and a compliance review opens with Grace Holloway. The chain now reads Dev Malhotra signed, Tomás Reyes, Grace Holloway and Sam Whitfield waiting.
The test evidence checker lists what AIS-148 needs before it can be signed: accuracy at 90 days, monthly drift monitoring, adverse impact by imputed race and ethnicity on BI claims, adverse impact by sex and age band, and independent validation by Calder Ridge. The vendor’s tests are requested for Oct 26; Tomás’s validation is scheduled for Nov 2.
The checker never marks a test passed and never runs a test on production data.
Market conduct examination MCE-2026-118 asks ten questions about AI systems, due Nov 14. The answers are drafted from the register, so B-1 now reads 148 in use (61 built in-house, 87 from vendors), 7 in development and 6 retired in the last 24 months, and B-2 says 17 systems were found in documents, including AIS-148 on Oct 12. Six answers are approved; the other four wait for Nadia’s approval.
Drafts only — never sends to a regulator.
The annual attestation to the Board Risk Committee is drafted from the same register: 148 systems, 87 from vendors and 17 found in documents; 139 with all four sign-offs; 9 open, each with an owner and a date to close — AIS-148 by Nov 20; 20 open gaps against the rules. Nadia prepares it, Ruth Okonjo reviews it for internal audit, and Marcus Iyer attests.
The same register, seen by the people who keep it — what their quarter looked like, and what it looks like now.
Six specialist agents find, describe, test and map every AI system, vendor tools included; four people sign each one and the CRO attests.
Reads vendor contracts, amendments, release notes, invoices and questionnaires for AI features, matches contract rights to shipped features and to usage in the claim and policy systems, checks the register and proposes a new row with a risk tier.
Drafts the model card for each system — purpose, where it runs, inputs, output, training data, users, risk tier reason, known limits and controls — from its documentation, release notes and validation reports.
Compares each system’s last validation, monitoring and discrimination tests with the cadence for its tier and its latest change, marks the validator link expired when out of date, and lists the tests a new system needs before use.
Maps every system to the AI rules of each state and line it is used in — NAIC bulletin states, NY Circular Letter 7, Colorado 10-1-1 and the company’s own model risk policy — and keeps the gap list.
Reads new change requests and vendor release notes every day; when a model is refit, retrained, gets new inputs or a new use, it reopens the sign-off links and tells the owner.
Answers each regulator question from the register and evidence files, drafts the examiner pack and the annual attestation, takes every figure from the register and marks what changed.
Sign each system in order; the Chief Risk Officer signs the annual attestation. The agents propose; a named person decides.
Ask in plain words, or tell it what to change. Every answer cites the clause, release note or policy it rests on.
Why is the reserve recommender rated High?
Because its output reaches a claim payment. It suggests the first reserve on new bodily-injury and PIP claims, and reserves set settlement authority and offers; policy MRP-4 rates anything that changes a claim payment as High. It has been used on 2,316 claims, 71% accepted unchanged, and New York expects it in the inventory.
Which vendor tools give us no audit rights over the model?
15 tools from 5 vendors: Vantor (3), Ostra (2), Brightline (4), Quillstone (5) and Sollis (1). Vantor’s Amendment 4 audits data security only and excludes models, a gap against the NAIC bulletin. Ostra renews first, on Nov 30.
Draft our answer on vendor audit rights for the examiner
Done, in question D-2 of MCE-2026-118: 15 tools from 5 vendors lack model audit rights, terms are renegotiated at each renewal, and every vendor’s regulator-cooperation clause is listed. Responsibility stays with us, as New York requires. It is waiting for your approval.
Re-open every link when a vendor release adds AI
Done. New rule: a vendor release that adds an AI feature re-opens all four links of every system it touches, as Vantor 24.3 should have. It applies from today; you can change it in Settings.
13 screens from the working solution, on its sample data. Pick one to see it large.
Risk tiers, cadence, who signs and what the AI finder reads are settings, not a project.
| Setting | Default | Choose from |
|---|---|---|
| High risk: output sets or changes a consumer’s price, eligibility, claim payment or fraud referral | Validate every 12 months | Any number of months |
| Medium risk: reaches a consumer but makes no decision | Validate every 24 months | Any number of months |
| Low risk: internal use only | Validate every 36 months | Any number of months |
| Material change re-opens sign-off | On | On · Off |
| Warn the owner before a validation expires | 60 days | Any number of days |
| Who signs High and Medium systems | Model owner, validator, compliance, business owner | Four links, in order |
| Invoices the AI finder reads | Over $10,000 | Any amount · On · Off |
| Rules in scope | NAIC bulletin, NY Circular Letter 7, Colorado 10-1-1 | On · Off per rule set, EU AI Act included |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate (4–6 weeks by email, and the split of days) · Rules named for context: NAIC Model Bulletin on the Use of AI Systems by Insurers (2023) · NY DFS Insurance Circular Letter No. 7 (2024), ¶29.2 inventory and ¶14 · Colorado SB21-169 and regulation 10-1-1. People, companies, vendors and products named on this page are fictional — characters and sample data in the working solution.
Software that keeps one inventory of every AI system an insurer uses — built in-house or bought — with its risk tier, owner, tests and sign-offs, and maps each one to the AI rules that apply. AI Governance & Model Inventory adds six agents that find the AI nobody filed, draft model cards, check tests against cadence, map rules and draft the examiner’s answers.
The AI finder reads every contract, amendment, release note, vendor questionnaire and invoice over $10,000 as it arrives. It matches a contract right to switch on AI with the release note that used it and with usage in your claim and policy systems, checks the register, and proposes a new row with the clause quoted. In the working solution, 17 of 148 systems were found this way.
The rule mapper maps every system to the rules of each state it is used in — the NAIC Model Bulletin, New York Insurance Circular Letter No. 7, Colorado regulation 10-1-1 — and to your own model risk policy, and keeps the list of open gaps. The EU AI Act can be switched on for life and health business in the EU.
The change watcher reads change requests and vendor release notes every day. A refit, a retrain, new inputs, a new use or a vendor release that changes the model reopens the sign-off chain, and an expired validation marks the validator link expired, until the system is signed again.
It drafts the answers from the register. For a market conduct exam’s AI systems evaluation questionnaire, the examiner pack writer drafts each answer with citations and refreshes it when a figure changes; the AI governance lead approves each answer and exports the pack. The design goal is one day from the register.
Yes. Agents read, draft and propose; they never register a system, sign a link or send anything to a vendor or regulator. The AI governance lead registers or dismisses found systems, four named people sign each system, and the Chief Risk Officer signs the annual attestation.
Yes. The definition of each tier, how often it is validated (12, 24 and 36 months in the working solution), whether a material change reopens sign-off, when owners are warned, who signs, what the AI finder reads and which rules are in scope are all settings.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your model risk policy, current inventory and a sample of vendor contracts and release notes — and it goes live once every quality gate has passed. We will walk you through it on your own documents first.
Each new rule mapped to its policy and owner the day it is published.
1-min demo50-State Regulatory ResearchEvery state answered side by side, each with the statute that says so.
1-min demoMarket Conduct Exam ManagementEvery examiner request tracked to its due date, answered from the file.
1-min demoWe’ll run AI Governance & Model Inventory on a sample of your own vendor contracts and release notes.