As 2022 ended, various groups of the National Association of Insurance Commissioners (NAIC), as well as the Colorado Department of Insurance (CO DOI), continued to gain a better understanding of insurers’ use of consumer data, AI, and ML. They learned that insurers may be heavily relying on third party vendors. The regulators discussed the need that any regulation of insurers’ use of consumer data, AI, and ML blanket insurers as well as the third party vendors.

During the NAIC Fall National Meeting, the Big Data and Artificial Intelligence (H) Working Group (Big Data AI WG) and the Innovation, Cybersecurity, and Technology (H) Committee (H Committee) discussed the role of third party vendors and what regulatory actions should be taken in that connection.

The results of its survey on private passenger auto insurance informed the Big Data and AI WG about insurers’ reliance on third parties who provide operational support using AI or ML. The Working Group also posited the need for information from, and the enhanced regulatory oversight over, these third party vendors. In this regard, Workstream 2 of the Big Data AI WG plowed ahead and drafted proposed questions for regulators to ask insurers about data and models they use, including whether the data or model was obtained from third parties. The Working Group released the nine page draft of questions for a 62-day comment period. Industry representatives cautioned that the avalanche of questions could white out innovation and efficiency, precipitating consumer harm. Birny Birnbaum viewed such industry comments as mere slush, but cautioned about the antitrust concerns if multiple insurers rely on the same vendor.

Meanwhile, the H Committee forecasted that insurers and other licensees ultimately will be responsible. Thus, insurers should ensure that if they use consumer data, AI, and ML from third parties, such use complies with applicable law.

In addition, in its Life Insurance Stakeholder Meeting #5, the CO DOI conveyed that insurers will need to comply with model regulations even if they use third party vendors. Colorado’s Commissioner Conway emphasized that his state is “not going to have insurers hide behind third parties [and] that he does not want there to be roadblocks from those third parties.” The Commissioner reiterated that “it is [his] expectation that if [an insurer] is using third parties, then you will still need to comply with the regulations” and “[i]f insurers want to use third parties, that is not going to be a way to avoid compliance.”

To avoid a cold blast from regulators, insurers using third party vendors for consumer data, AI, or ML will need to ensure that the third party vendors cooperate with regulatory inquiries and are prepared to demonstrate, at a minimum, that no illegal discrimination or bias is occurring.