Model risk management at an insurance company: what examiners ask

Model risk management at an insurance company is the set of controls that keeps the insurer's models, from rating plans and reserving models to claims, fraud and underwriting scores, accurate, fit for their use and lawful, and it answers to state insurance examiners rather than to bank supervisors. Those examiners now ask the questions in the NAIC's model bulletin on AI: what models and AI systems the insurer uses, how each was developed, validated and monitored for drift, who approved it, what changed since, and what evidence exists for each answer. The hard part is keeping that evidence current when models are refit and vendors retrain theirs between reviews, which is the work Botminds' AI Governance & Model Inventory was built for.

The bulletin itself makes the point that one validation method does not fit every system. In its list of what a department may request, it adds a note on validation that applies to every model an insurer runs:

“Note that the nature of validation, testing, and auditing should be reflective of the underlying components of the AI System, whether based on Predictive Models or Generative AI.”

NAIC Model Bulletin: Use of AI Systems by Insurers, Section 4, item 1.3(d)

What is model risk management at an insurance company?

It is the discipline of knowing which models the company relies on, how wrong each could be, and what happens when it is. Insurers have practised it for decades on rating plans and reserves, through actuarial review, rate filings and financial examinations. What changed after 2023 is scope. The NAIC bulletin brings every AI system used in a regulated insurance practice into one program, so a call-summary tool, a generative letter assistant and a vendor's reserve suggestion now sit beside the rating plan, each needing an owner, a risk tier and evidence proportionate to the harm it could do.

The insurance version differs from the bank version in three ways. Its legal tests are insurance tests: rates that are not excessive, inadequate or unfairly discriminatory; claims handled under unfair claims settlement standards; no unfair discrimination in underwriting. Its regulators are state departments, examining through market conduct and financial exams. And its models are often bought: in the NAIC's homeowners survey, 42% of 2,413 listed models were developed by third parties, so validation frequently means validating something the insurer cannot see inside.

Does SR 11-7 apply to insurers? What replaced SR 11-7?

SR 11-7 was the Federal Reserve's 2011 guidance on model risk management for banking organizations, and on 17 April 2026 it was replaced. SR 26-2, issued with the OCC's Bulletin 2026-13 and the FDIC, supersedes SR 11-7 and the 2021 interagency statement on models used for anti-money-laundering compliance (Federal Reserve, SR 26-2; OCC Bulletin 2026-13). The new guidance says it is most relevant to banking organizations with over $30 billion in total assets, defines a model as a complex quantitative method with stated exclusions, and leaves generative and agentic AI outside its scope.

Neither text is addressed to insurers. Insurers often borrowed SR 11-7's vocabulary of conceptual soundness, outcomes analysis and effective challenge, because it was the most complete public framework, and that vocabulary is still useful. But an insurance examiner's authority comes from state insurance law and the documents states issue, of which the NAIC bulletin is now the most detailed on models. For how the bank guidance changed, and what it means for a bank's own models, see our guide to SR 26-2 and AML models.

Which rules do insurance examiners apply to models?

The bulletin first, where it has been issued, and the laws it rests on everywhere. Its program guidelines ask for an inventory and description of predictive models, detailed documentation of their development and use, and assessments of interpretability, robustness, drift and auditability (guideline 3.3); validation and retesting to check how outputs generalize once a model is live (3.4); and a narrative of each model's goals and how it was developed and validated to meet them (3.7) (NAIC Model Bulletin).

State texts add specifics. New York's Circular Letter No. 7 asks insurers using AI in underwriting and pricing to document “a description of testing conducted at least annually to assess the output of AIS models, including drift” and a process for tracking changes over time (CL7 ¶29). Colorado's amended regulation 10-1-1 asks life, private passenger auto and health insurers using external consumer data for a “Documented description of ongoing monitoring regarding the performance of algorithms and predictive models that use ECDIS including accounting for model drift” (3 CCR 702-10, 5.A.12). Rating models also meet the NAIC's review of predictive models in rate filings; our guide to GLM pricing models covers that side.

The examiner's questions, and the evidence that answers each

Read Section 4 of the bulletin beside Exhibit C of the NAIC's draft evaluation tool and the questions become concrete. The tool asks, for each high-risk system, its name and version, model type, implementation date, whether it was developed internally or by a third party, the company's risk classification, its risks and limitations and its degree of autonomy, then how outputs were tested and validated before deployment, how performance is monitored, the last date of testing, and how the model is reviewed for compliance with unfair trade practices and claims settlement laws (NAIC AI Systems Evaluation Tool, draft 4.0). The table pairs each question with the evidence that answers it.

What does “validated” mean to an insurance examiner?

It means the insurer tested how the model performs on data it did not learn from, before use and after, and wrote down what it found. The bulletin describes validation as checking how a system's outputs generalize after implementation, including whether the data used to build, train and audit it was suitable, and it names methods: comparing performance on unseen development data with performance observed after go-live, or measuring performance against expert review. It also lists assessments a program may cover, from interpretability and repeatability to robustness, reproducibility, traceability and drift.

For a model the insurer bought, validation has two halves. The vendor's evidence comes first. Take a sample insurer as it runs through AI Governance & Model Inventory: Calder Ridge Insurance Group, a fictional carrier writing personal auto, homeowners, small commercial and term life. When it found a vendor reserve model nobody had filed, it asked its claims-platform vendor for accuracy against incurred losses at 90 days by state, a monthly drift report and adverse impact tests. The insurer's own validation follows, on its own claims, by a validator independent of the model owner. The examiner will ask about the second half, because the bulletin holds vendor-supported decisions to the insurer's own standards. Worked examples for two common claims models are in our guides to validating fraud risk scores and litigation and severity scores.

Drift and monitoring: the questions between validations

An examiner asks how the insurer would know if a model stopped working. The bulletin defines model drift as the decay of a model's performance as the data it meets moves away from the data it learned from, and lists documentation on validation, testing and auditing, drift evaluation included, among the items a department may request. NIST's framework frames the same duty as post-deployment monitoring plans (MANAGE 4.1) (NIST AI 100-1).

Monitoring has to name a metric, a threshold, a frequency and an owner, and it has to survive the vendor. A drift report the vendor sends monthly is evidence only if someone reads it and the register shows the date it arrived. The insurer's policy should say what a breach of threshold does: reopen validation, trigger an interim control, or go to the committee.

When does a model change reopen the validation?

Whenever the change is material, and a model risk policy should define material in a list, not a principle. The usual list is a refit or retrain, new inputs, a new use, a change in the population the model scores, and a vendor release that changes the model. New York asks for discrimination testing again after any material change to the external data or the AI system (its testing requirements), and Colorado asks for a documented explanation of any material change in the inventory with its rationale.

The timeline below follows that vendor reserve model at the sample insurer. It shows where the days go when a vendor switches on a model nobody filed. The first 39 days are exposure, not process: the system suggested initial reserves on 2,316 injury claims before anyone in model risk knew it existed.

What should a model risk management policy at an insurer contain?

It should contain the rules an examiner will test the insurer against, written so that each can be checked system by system. The bulletin asks that documentation requirements be developed with its Section 4 requests in mind, which is a good drafting test: for every request on that list, the policy should say who produces the evidence and when.

Where AI Governance & Model Inventory fits for a validation team

It keeps the evidence and reopens the work; it does not do the validation. The test evidence checker compares each system's last validation, monitoring and discrimination tests with the cadence for its tier and with its latest change, marks the validator's link expired when either is out of date, and lists the tests a new system needs before use. The change watcher reads change requests and vendor release notes daily and reopens the sign-off chain when a model is refit, retrained, gets new inputs or a new use. Neither agent ever marks a test passed or runs a test on production data.

In the sample register on 12 October, that produced the validation team's work list without a meeting: a personal auto rating plan refit on 22 September with its sign-off reopened, an auto claim severity model whose 12-month validation had expired in March, a vendor SIU score retrained in a release on 6 October, and the newly found reserve recommender with five tests listed before use. Our guide to the NAIC evaluation tool shows how the same register answers the examiner's high-risk exhibit.

AI Governance & Model Inventory: last validation and cycle on every row, changes reopening sign-off

Examiner answers drafted from the same register

Questions people ask

What is model risk management?

The controls that identify an organisation's models, test whether each is sound for its use, watch it in production and limit the damage when it is wrong. In insurance the work answers to state examiners and, since 2023, to the NAIC bulletin's expectations for AI systems.

What is the difference between SR 26-2 and SR 11-7?

SR 26-2, issued on 17 April 2026, replaced SR 11-7 for banking organizations. It is described as most relevant to banks above $30 billion in assets, defines a model as a complex quantitative method and puts generative and agentic AI outside its scope. Neither letter addresses insurers.

Do insurance regulators require model validation?

The NAIC bulletin expects validation, testing and retesting as part of an insurer's AI program, and lists validation and drift documentation among what a department may request. New York and Colorado add specific testing and monitoring documentation for the insurers and lines they cover.

Is a vendor's validation report enough?

It is evidence, not a substitute. The bulletin holds decisions supported by vendor AI to the insurer's own legal standards and asks for due diligence on the vendor's systems; examiners will expect the insurer's own validation on its own data for High-risk uses.

How often should insurance models be revalidated?

No insurance text sets one number for every model. New York asks for output testing at least annually for AI used in underwriting and pricing; many insurers tie cadence to risk tier, for example 12 months for systems that affect price, eligibility, claim payment or fraud referral, and revalidate after every material change.