Required, contested, and not asked of you

Range the obligations from the ones that clearly bind an insurer using AI in motor claims today, through the ones genuinely in dispute, to the ones nobody is asking for. The middle is where the interesting arguments are, and it is smaller than the discussion suggests.

The settled end

Every market with insurance regulation has rules about how claims must be handled — periods for acknowledgement and decision, a prohibition on unreasonable delay, a requirement that a denial be explained, a duty to investigate before refusing. In the United States these travel under the heading of unfair claim settlement practices, adopted state by state from a long-standing model; elsewhere they appear as conduct rules or in the general law of insurance contracts. Their common property, for present purposes, is that they are technology-neutral. They do not mention models, and they apply in full to decisions a model produced.

That has a consequence insurers often skip. If a valuation is unreasonably low, it is an unreasonable valuation whether a person or a system produced it. If a decline cannot be explained, the defect is the absent explanation, not the method. An insurer arguing that a decision came from a validated model is not answering a regulator’s question about that decision; it is describing how it arrived at something it still has to justify.

The same holds for discrimination law. Prohibitions on unfair discrimination in insurance long predate machine learning, and they attach to outcomes rather than intentions. A model that produces a differential outcome through a proxy nobody selected for that purpose has produced a differential outcome, and the absence of intent is not an answer under rules framed around effect.

Record-keeping belongs at this end too. Claim files have always had to be retained and reconstructible. Where part of the reasoning now sits in a model and its inputs, retaining the file in the old sense retains less than it used to.

The instrument that has done the most to state this explicitly for AI is the NAIC model bulletin Use of Artificial Intelligence Systems by Insurers, adopted by the NAIC’s Executive (EX) Committee and Plenary on 4 December 2023. It is not a statute. It is a model text written for a state insurance department to issue as its own — the department’s name and its statutory citations are left as blanks in the published version — and it creates no new prohibitions. What it does is tell insurers that decisions and actions affecting consumers that are made or supported by AI systems must comply with all applicable insurance laws and regulations, including those addressing unfair trade practices and unfair discrimination; that the laws it relies on include the Unfair Claims Settlement Practices Act, which is the claims-side one; that an insurer is expected to develop, implement and maintain a written programme — the bulletin calls it an AIS Program — for the responsible use of AI systems that make or support decisions on regulated insurance practices, covering claim administration and payment along with the rest of the insurance life cycle; that the programme should address those systems whether the insurer built them or acquired them from a third party, with due diligence and, where available, contractual audit and cooperation rights; and that in an investigation or market conduct action an insurer can expect to be asked for the written programme, its inventories and documentation of predictive models, its validation and testing, and its third-party diligence and contracts. Read as an announcement of new law it is thin; read as notice that existing law will be enforced against model-driven decisions, it is the clearest statement available. How many departments have issued it, and in what form each did, is not something we have counted.

The contested middle

What counts as a decision that must be explained. A score that routes a claim is not obviously a decision about the claim, and a valuation that a handler accepts without changing it is not obviously the handler’s decision. Insurers tend to treat the model as an input and the human as the decision-maker; a claimant’s representative will argue that where the human never departs from the output, the model decided. Nothing settles this in most places, and the practical answer is to make the human’s contribution visible on the file rather than to win the argument in the abstract.

Whether human review must be substantive. Instruments and guidance increasingly speak of human oversight, and almost none define it. A queue with a reviewer who agrees with the system nearly always satisfies every written requirement we are aware of and satisfies nothing a regulator would be reassured by on inspection. The gap between the formal requirement and the thing it was meant to secure is wide open, and an insurer choosing to close it is acting ahead of the rules.

Whether a claimant is owed knowledge of the method. The clearest text we have read on this is Article 22 of the EU General Data Protection Regulation, which gives a data subject the right not to be subject to a decision “based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”, and which — where the decision is necessary for a contract, or rests on explicit consent — requires the controller to implement suitable measures including at least the right to obtain human intervention, to express a point of view and to contest the decision. How far that reaches into insurance claims handling, where a human is usually somewhere in the process, turns on whether a particular workflow is in fact solely automated. That is a question about the workflow, not about the article, and it is genuinely unsettled. For data-protection regimes outside the EU this piece states nothing.

Testing obligations for proxy discrimination. The example usually cited is Colorado’s Senate Bill 21-169 of 2021, Restrict Insurers’ Use Of External Consumer Data. On the Colorado General Assembly’s own record of the act, it prohibits an insurer from using an external consumer data and information source, algorithm or predictive model that unfairly discriminates on the protected characteristics it lists, and directs the Commissioner of Insurance to adopt rules — for specific types of insurance, by insurance practice — requiring an insurer to report the external data sources it uses and how it uses them, to establish and maintain a risk management framework designed to determine whether that use unfairly discriminates, to report the results and the action taken, and to provide an attestation from its chief risk officer. Two things there are easy to miss. The duty operates through rules made type by type and practice by practice rather than across an insurer’s whole book, so whether it reaches motor claims handling in that state is a question about the rules actually adopted; and where a duty of this shape does exist it is among the more demanding things in the field, because it requires an insurer to look for a harm it may find.

Where the EU AI Act bites, and where it does not. Regulation (EU) 2024/1689 was published in the Official Journal on 12 July 2024, entered into force on the twentieth day after that, and by its Article 113 applies from 2 August 2026 — with Chapters I and II from 2 February 2025, a further group of chapters and Article 78 from 2 August 2025, and Article 6(1) and its corresponding obligations from 2 August 2027. Its high-risk annex reaches insurance at one point. Annex III, point 5(c) lists “AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance”. Motor claims handling is not that. This matters in both directions — an insurer should not assume its motor claims models are high-risk under that item, and should not assume they are unregulated, since the general law described above continues to apply and we have not read the Regulation exhaustively for other provisions that might reach a particular use.

Discoverability in litigation. Whether a score, a model specification or a reserve history is obtainable by a claimant is a procedural question, answered differently across jurisdictions, and the triage piece treats what follows from it. It belongs in the contested middle because the answers are still being worked out case by case.

The end where nothing is required

No regulator we are aware of requires an insurer to publish its model, disclose its features, meet a stated accuracy threshold, or offer claimants a general right to have a claim handled by a person. Proposals of each kind exist in the discourse. None of them is a live obligation in the markets this section covers, and an insurer planning as though they were is planning for a world that may not arrive.

That absence cuts both ways. It means the compliance burden is lighter than the anxiety suggests. It also means nobody is going to hand an insurer a test it can pass and be finished, so the governance question stays a matter of judgement.

The line

Here is where we would draw it. An insurer should be able to do four things, and should not wait for any of them to be required: state the reason for an individual claim decision in terms of that claim’s facts; show that a person’s judgement entered the file and when; test its models for differential outcomes and keep the record of having tested, including the results it did not want; and reconstruct a decision — inputs, model version, threshold in force — months after the fact.

Those four are not a reading of any single instrument. They are what every instrument in the settled end already implies, what the contested middle will most likely converge on, and what a claimant’s lawyer will look for first regardless of which rule applies. An insurer that can do them is defensible under law that exists. One that cannot is exposed now, and the exposure has nothing to do with whether an AI statute ever arrives.