NY DFS Circular Letter No. 7, issued on 11 July 2024, is the New York Department of Financial Services' statement of what it expects from insurers that use AI systems and external consumer data in underwriting and pricing: data that is actuarially valid and not unfairly discriminatory, testing before and after a system goes live, board and senior management oversight, written policies, comprehensive documentation, vendor oversight, and notice to consumers. Its inventory requirement is the one most programs underestimate. It asks for systems in use, systems under development and systems recently retired, so a list of models in production does not answer it. Keeping all three states current is what Botminds' AI Governance & Model Inventory does for every AI system an insurer runs.
The letter is addressed to all insurers authorized to write insurance in New York, Article 43 corporations, health maintenance organizations, licensed fraternal benefit societies and the New York State Insurance Fund (NY DFS Insurance Circular Letter No. 7). Its documentation paragraph lists seven items, and the second is the inventory:
“an up-to-date inventory of all AIS implemented for use, under development for implementation, or recently retired;”
NY DFS Insurance Circular Letter No. 7 (2024), ¶29, item 2
What is NY DFS Circular Letter No. 7? A summary in four parts
The letter runs to 45 paragraphs in four parts: purpose and background, fairness principles, governance and risk management, and transparency. It uses two defined terms throughout: AIS, for AI systems used in whole or in part to supplement traditional underwriting or pricing or to act as a proxy for it, and ECDIS, for external consumer data and information sources used in the same ways or to identify lifestyle indicators. Its background explains why DFS wrote it: “ECDIS may reflect systemic biases and its use can reinforce and exacerbate inequality.”
The fairness part asks insurers to show that external data is actuarially sound, saying insurers “should be able to demonstrate that the ECDIS are supported by generally accepted actuarial standards of practice” (¶11), and not to use ECDIS or AI in underwriting or pricing unless the insurer can establish that the use is not unfairly or unlawfully discriminatory (¶15). It sets out an analysis in steps, including a documented search for a less discriminatory alternative, and testing before production, on a regular cadence and after material changes (¶15–19). The statistical metrics it encourages are covered in depth in the letter's testing requirements; this guide stays with governance and the inventory.
NY DFS Circular Letter No. 7, summarised in eight expectations
- Actuarially valid data (¶11–12)
External data should be supported by generally accepted actuarial standards of practice.
- No unfair discrimination (¶13–15)
Establish that each use is not unfairly or unlawfully discriminatory, including a documented search for a less discriminatory alternative.
- Testing at the right moments (¶16–19)
Before production, on a regular cadence and whenever the data or the system materially changes, using several statistical measures.
- Board oversight, management responsibility (¶21–24)
The board oversees and may delegate duties with reporting lines back; senior management runs the program day to day.
- Written policies, approved yearly (¶25–28)
Formal policies and procedures with roles, monitoring, reporting and training, reviewed and approved at least annually.
- Comprehensive documentation (¶29–30)
Seven items, from risk assessment and the inventory to change tracking, monitoring, output testing and data lifecycle.
- Vendor oversight (¶35–37)
Responsibility stays with the insurer; written vendor standards; audit and regulator-cooperation terms where available.
- Transparency (¶38–45)
Disclosure and notice to consumers where ECDIS or AI is used, and clarification of the earlier Circular Letter No. 1 (2019).
Who does Circular Letter 7 apply to, and to which AI?
It applies to the insurers it is addressed to, and to their use of AI and external data in underwriting and pricing. That scope matters for the inventory. A New York insurer's claims, fraud and service tools are not what this letter is about, though other New York rules govern how those functions are run, and an insurer writing in other states will meet them under the NAIC's model bulletin there.
New York has not issued the NAIC bulletin itself. The NAIC's adoption map lists it, with California, Colorado and Texas, among four states with insurance-specific AI regulation or guidance instead, while 29 jurisdictions had adopted the bulletin as of 8 October 2026 (NAIC adoption map). The practical answer for a multi-state insurer is one inventory of every AI system, with a field for each rule set that applies, filtered to underwriting and pricing systems when New York asks.
Why New York's inventory includes systems in development and retired ones
Because the decisions DFS examines were made by the systems that existed when they were made. A complaint about a 2025 underwriting decision, or an exam that samples last year's policies, leads to the model that priced them, which may since have been replaced. An inventory that drops a system when it is switched off leaves the insurer unable to say which model decided, on what data, tested how.
The in-development rows serve the other end of the life cycle. The letter asks for discrimination testing before a system is put into production, which means the system has to be known, owned and tested before it goes live. A system that appears in the inventory only on its first day in production was approved, if at all, somewhere the inventory cannot show. The NAIC bulletin makes the same point in general terms: its program covers every phase of a system's life cycle, from design through retirement (guideline 1.7).
AI Governance & Model Inventory: live, in development and retired in one sample register
All 161 AI systems by life-cycle state
- In use: 148 · 92%
- Not in production: 13 · 8%
The 13 not in production
- In development: 7 · 54%
- Retired, last 24 months: 6 · 46%
The 148 in use, by who built them
- From vendors: 87 · 59%
- Built in-house: 61 · 41%
What does “recently retired” mean, and what should you keep?
DFS does not define it, so define it in your policy and apply it consistently. Two anchors help. The first is your exposure: as long as decisions a system made can still be complained about, examined or litigated, its row should stay. The second is your retention schedule; the NAIC bulletin lists data and record retention among the elements of the program (guideline 3.6). The sample insurer on this page reports systems retired in the last 24 months; another insurer might choose the length of its exam cycle.
A retired row needs more than a date. Keep the reason it was retired, what replaced it, the last validation and test results, the versions it ran and the period each was live, and where the documentation is held. NIST's framework treats retirement as a governance step of its own: GOVERN 1.7 calls for processes to decommission and phase out AI systems safely, without increasing risk or reducing the organization's trustworthiness (NIST AI 100-1).
The seven documentation items in ¶29, and what each takes
The inventory is one of seven. The letter asks insurers to “maintain comprehensive documentation for their use of all AIS, including all ECDIS relied upon for such AIS,” and lists what that documentation includes. The table summarises each item and the evidence that usually answers it.
Circular Letter No. 7, ¶29: the documentation New York expects, item by item
| Item | What the letter asks for | Evidence that answers it |
|---|---|---|
| 1 | A process for identifying and assessing operational, financial and compliance risks, with internal controls | The risk-tier rule and the controls attached to each tier |
| 2 | An up-to-date inventory of AIS in use, under development or recently retired | One register with a status field and dates for each change of status |
| 3 | How each AIS operates: inputs and their sources, purpose, products, restrictions and safeguards | A model card per system, each line traced to a document |
| 4 | A process for tracking changes in the use of ECDIS and AIS over time, with documented rationale | A change log with the reason and approver of each change |
| 5 | A process for monitoring usage and performance, including exceptions and reporting | Usage counts, monitoring reports and exception logs |
| 6 | Testing conducted at least annually to assess AIS outputs, including drift | Dated output and drift tests per system |
| 7 | Data lifecycle management, including ECDIS acquisition, storage, usage and sharing | Data inventories and agreements for each external source |
Items 3 and 4 are where the inventory turns into documentation. Item 3 asks for “a description of how each AIS operates, including any ECDIS or other inputs and their sources,” and item 4 for a process that tracks how the insurer's use of external data and AI changes over time, with the reasons documented. Together they mean every row needs a description that can be traced to a source and a history of what changed and why. Our inventory template turns those items into fields.
An examiner's inventory question answered in three states
Who signs off under Circular Letter 7? Board, management and policies
The board oversees, senior management runs the program, and written policies hold it together. The letter gives the board oversight of the insurer's activities and lets it delegate “specific duties and authorities” for that oversight to board committees and senior management, provided lines of reporting run back to it (¶21–22). Senior management carries day-to-day implementation, ideally through a cross-functional management committee drawn from legal, compliance, risk management, product development, underwriting, actuarial and data science (¶23–24). It asks insurers to formalize their development and management of ECDIS and AIS in written policies and procedures, and for the board, a board committee or delegated senior management to review and approve them “at least annually” (¶25–26).
For vendors, the letter keeps responsibility with the insurer: insurers retain responsibility for understanding tools, ECDIS and AIS that vendors developed or deployed, should write standards for acquiring and relying on them, and, where appropriate and available, should contract for audit rights and for the vendor's cooperation with regulatory inquiries (¶35–37). Our vendor questionnaire guide shows how to read those terms out of the contracts themselves.
How does Circular Letter 7 differ from the NAIC AI bulletin?
It is narrower in scope and more specific in method. The NAIC bulletin covers AI across the insurance life cycle, claims and fraud included, and leaves the method of governance to the insurer. Circular Letter No. 7 covers underwriting and pricing only, but within that field it says more: actuarial support for external data, a stepped analysis for unfair discrimination with a search for less discriminatory alternatives, testing at named moments, several statistical measures, seven named documentation items and consumer notice. On inventories the two meet: the bulletin asks for inventories and descriptions of predictive models and AI systems that can lead to adverse consumer outcomes, and New York asks for the same with in-development and retired systems spelled out.
For a multi-state insurer the practical consequence is that the New York requirements are the stricter template for underwriting and pricing systems, and the bulletin the broader one for everything else. An inventory built to New York's three states, with a field that marks underwriting and pricing systems and their external data sources, answers both. The NAIC's adoption map lists New York among four states with their own insurance-specific texts, beside California, Colorado and Texas, so in New York it is this letter, not the bulletin, that sets out the Department's expectations for AI in underwriting and pricing.
Why an annual survey misses the inventory New York asks for
A survey asks owners what they have; New York asks what exists. The gap is widest for vendor systems, which arrive in releases rather than purchases, and for retirements, which owners rarely report because nothing is left to own. It is also widest between surveys: a system developed and switched on in March is invisible until next year's survey.
Take the sample insurer as it runs through AI Governance & Model Inventory: Calder Ridge Insurance Group, a fictional carrier writing personal auto, homeowners, small commercial and term life in 14 states. Its register is built from owner filings and from documents. In the quarter to 12 October, the AI finder read 412 contracts, release notes, invoices and vendor questionnaires; 17 of the 148 systems in use had been found that way rather than filed. The change watcher reads change requests and release notes daily, so a refit, a retrain or a switch-off moves a system's status the day it happens, and a drafting agent prepares the three-state answer from the register.
One register in AI Governance & Model Inventory, kept by owners and by documents
The NAIC's draft evaluation tool asks the same question from the other side: its first exhibit counts systems currently in use and those implemented in the past 12 months (NAIC tool, Exhibit A). An inventory with status dates answers New York's three states and the NAIC's counts from the same rows. Our guide to the evaluation tool covers its four exhibits.
Questions people ask
When was NY DFS Circular Letter No. 7 issued?
On 11 July 2024, as Insurance Circular Letter No. 7 (2024). It is published on the Department of Financial Services' website under industry guidance, and the NAIC's adoption map lists it among New York's insurance-specific AI guidance.
Does Circular Letter 7 apply to claims AI?
Its subject is the use of AI systems and external consumer data in underwriting and pricing, so claims and fraud tools fall outside its paragraphs. Many insurers still keep them in the same inventory, because other states' versions of the NAIC bulletin cover claims expressly.
What is ECDIS in Circular Letter 7?
External consumer data and information sources: data used to supplement traditional medical, property or casualty underwriting or pricing, as a proxy for it, or to identify lifestyle indicators. The letter excludes some familiar sources from the term, such as an MIB Group member information exchange, a motor vehicle report, prescription drug data and a criminal history search.
How often must insurers test AI systems under Circular Letter 7?
Discrimination testing before production, on a regular cadence and whenever the data or system materially changes (¶17), and output testing, including drift, at least annually as part of the documentation (¶29). The letter encourages several statistical metrics rather than one.
Does New York require board approval of AI policies?
The letter asks for written policies and procedures reviewed and approved at least annually by the board, a board committee or senior management to whom the board delegates it, with regular reporting back to the board.