AI Regulation Tracker / Insurance, underwriting and pricing
New York Tells Insurers to Prove Their AI Is Not Discriminating
NYDFS Insurance Circular Letter No. 7, adopted July 11, 2024, sets the Department's supervisory expectations for every insurer authorized in New York that uses artificial intelligence or external consumer data to underwrite or price. If you use these tools, you have to be able to prove the data and the models are actuarially sound, that they do not produce unfair or unlawful discrimination, and that you have the governance, vendor oversight, and consumer disclosure to back it up. This is older than this month, but it is in force, and national carriers writing New York business are inside it.
I want to be honest about the date up front, because it changes how you use this. Circular Letter No. 7 is not new. NYDFS put out the proposed version in January 2024 and adopted the final on July 11, 2024. What makes it worth your time now is that it is settled, it is in force, and it has become the template other state insurance regulators and the NAIC keep circling. If you underwrite or price with anything that looks like a model, this is the document that tells you what a regulator will ask to see.
The scope is deliberately wide. It applies, in the Department's words, to "All Insurers Authorized to Write Insurance in New York State, Article 43 Corporations, Health Maintenance Organizations, Licensed Fraternal Benefit Societies, and the New York State Insurance Fund." If you write New York business, you are in it, and it does not matter whether the model is homegrown or bought.
The core duty: prove it is fair, and prove it works
The center of the Circular is a two-part burden that sits on the insurer, not the regulator. First, actuarial validity. The Department expects that "Insurers should be able to demonstrate that the ECDIS are supported by generally accepted actuarial standards of practice and are based on actual or reasonably anticipated experience." A correlation that a model happened to find is not enough. You need a clear, statistically credible, rational relationship between the variable and the actual risk.
Second, and this is the part that trips people up, non-discrimination. It is not enough to leave protected characteristics out of the model. The Circular targets proxy discrimination, where a facially neutral variable stands in for a protected class. An insurer, per the guidance, should not use ECDIS or AIS unless it can establish that the source or model does not use and is not based in any way on a class protected under Insurance Law Article 26. That means you have to test for a disproportionate adverse effect on protected classes, and if you find one, either justify it on legitimate actuarial grounds or stop using the variable.
Governance, vendors, and the paper trail
The Circular does not stop at the math. It expects a control structure around it. In its terms, "An insurer should have a corporate governance framework that provides appropriate oversight of the insurer's use of ECDIS and AIS to ensure compliance with the Insurance Law." That means board and senior-management accountability, qualified people reviewing the models, written policies, and documentation you can hand to an examiner.
Vendor risk gets its own emphasis, and it is the line I would underline for any carrier leaning on outside AI. The Department is explicit that insurers retain responsibility for understanding the tools, external data, and AI systems used in underwriting and pricing even when a third party developed or deployed them. In practice that pushes you toward audit rights in your vendor contracts, the ability to get an independent audit report, and a contractual obligation that the vendor cooperate with regulatory inquiries. You cannot outsource the accountability, only the code.
Disclosure to the consumer
The last leg is transparency to the person on the other side of the decision. The guidance frames it plainly: "Disclosure is an essential mechanism to aid applicants in identifying and correcting any incorrect data used in underwriting and pricing decisions." When an adverse or otherwise consequential underwriting or pricing decision is driven by AI or external data, the insured should be told the specific reasons, in a way concrete enough that they can find and dispute a wrong input. Generic notices do not clear that bar.
Why a 2024 New York circular is a national compliance item
Here is the US hook, and it is the reason I put this in the tracker even though the ink is not fresh. New York is one of the largest insurance markets in the country, and almost every national carrier writes there. Because the Circular reaches any insurer authorized in New York and any model used on New York business, a firm that runs one underwriting or pricing stack across all fifty states effectively has to build to this standard firmwide. It is cheaper to meet the New York bar everywhere than to maintain a separate, weaker pipeline for other states. On top of that, the NAIC model bulletin and a growing set of state insurance departments echo the same expectations, so building to Circular Letter No. 7 is close to building to where the whole country is heading.
For the finance and accounting professionals who advise or sit inside these carriers, the practical work is documentation. The questions an examiner will ask are answerable only if someone kept the actuarial support, the disparate-impact testing, the governance minutes, and the vendor audit rights in order before the exam, not after.
Questions professionals are asking
Is Circular Letter No. 7 a law insurers can be fined under?
It is supervisory guidance, not a standalone statute or regulation with its own penalty schedule. It is written in "should" language. But it articulates how NYDFS expects insurers to comply with existing binding Insurance Law, including the Article 26 prohibition on unfair discrimination, and the Department supervises and examines against it. Failing to meet it can expose an insurer to market conduct findings and enforcement under the underlying law.
Who does it apply to?
All insurers authorized to write insurance in New York State, along with Article 43 corporations, health maintenance organizations, licensed fraternal benefit societies, and the New York State Insurance Fund, whenever they use AI systems or external consumer data and information sources in underwriting or pricing.
What is the difference between AIS and ECDIS?
ECDIS is external consumer data and information sources, meaning data drawn from outside the traditional underwriting process, such as consumer data used to supplement or replace traditional inputs. AIS is artificial intelligence systems, meaning the models and machine learning that process data to support underwriting or pricing. The Circular covers AIS whether or not it uses ECDIS, and covers ECDIS whether or not AI is involved.
Does using a third-party AI vendor shift the responsibility?
No. The Department is explicit that insurers retain responsibility for understanding any tools, external data, and AI systems used in underwriting and pricing even when a third party built or runs them. The practical response is audit rights, access to independent audit reports, and a contractual duty for the vendor to cooperate with regulators, all held by the insurer.
It is from 2024. Why does it matter now?
Because it is settled and in force, and because it has become a national reference point. New York is a major market, national carriers write there, and a single firmwide underwriting stack tends to be built to the strictest state. The NAIC model bulletin and other state insurance regulators are converging on the same expectations, so meeting Circular Letter No. 7 is close to meeting the emerging US standard.
RELATED BRIEFINGS
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how Circular Letter No. 7 (2024) applies to your models, your vendors, and your New York business with qualified counsel and your appointed actuary.