A claims adjuster's job has always had an uncomfortable duality to it: apply the policy language faithfully, and simultaneously represent, in the mind of the policyholder on the other end of the phone, the moment the insurance company either kept its promise or did not. Claims processing is the operational center of gravity for most insurers — intake, documentation review, triage, and, for a meaningful share of files, a determination that materially affects a policyholder's financial position at what is often the worst moment of their year. It is also an area where regulators have moved faster and more specifically on AI than in almost any other industry, precisely because the downstream decision so directly and visibly affects consumers, in a way that a bank's internal model risk rarely does in the same immediate, personal register.
1. The Unfair Claims Practices Baseline
Every U.S. state maintains some form of Unfair Claims Settlement Practices Act, restricting how and why a claim may be denied, delayed, or undervalued, and establishing the standard against which a regulator or a court will measure the insurer's conduct. These statutes predate AI by decades but apply to it without modification: an automated triage or denial recommendation is judged by exactly the same standard as a human adjuster's decision would be. There is no AI carve-out, no lighter standard for a machine-generated outcome, and insurers who assume otherwise are working from a mistaken premise that will not survive a regulatory inquiry.
The practical consequence is that automation which speeds up a process without preserving the reasoning behind an outcome creates exposure under this baseline, entirely independent of any AI-specific rule layered on top of it. A tool that flags a claim as low-priority or recommends denial, without leaving behind a record of why, has not merely created an AI-governance problem — it has potentially created an unfair-claims-practices problem under a statute that has existed since long before anyone was talking about algorithms, and that fact tends to surprise insurers who have organized their compliance thinking entirely around the newer, AI-specific frameworks.
2. AI-Specific Fairness Requirements
Layered on top of that baseline, the National Association of Insurance Commissioners' Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted in 2023, directs insurers to establish a written AI governance program, to document the data and logic behind AI-influenced decisions, and to test proactively for unfair discrimination in outcomes. These obligations apply whether the AI system was built in-house by the insurer's own data science team or licensed from an outside vendor — the Model Bulletin does not distinguish between the two, and an insurer cannot outsource its governance obligation simply by outsourcing the underlying technology.
Colorado's SB21-169, codified at C.R.S. § 10-3-1104.9, goes further for life insurance specifically, requiring insurers to test external consumer data and the algorithms built on it for unfairly discriminatory outcomes, and to report the testing methodology to the state regulator on request. Other states are actively adopting comparable frameworks, generally modeled closely on the NAIC bulletin, which means an insurer building a compliance program around a single state's requirements today is very likely building the floor of a multi-state obligation that will only expand. The EU AI Act separately classifies AI systems used for risk assessment and pricing in life and health insurance as high-risk under Annex III, which matters directly for any insurer with EU-domiciled business or reinsurance relationships.
3. Explainability as a Design Constraint, Not an Afterthought
Adverse-action and claim-denial notice requirements mean an insurer must be able to state, in terms a policyholder and a regulator can both evaluate, why a given outcome was reached — not in the abstract sense of "the model considered many factors," but in the concrete sense of which factors, weighted how, produced this specific result for this specific claim. A workflow tool that produces a recommendation without a legible, auditable reasoning trail is a governance liability regardless of how statistically accurate its recommendations turn out to be, because accuracy and explainability are answers to two different questions, and regulators are asking the second one.
This is a genuinely difficult engineering problem, and it is worth naming honestly rather than waving away: the more sophisticated an automation system becomes, the harder it can be to produce a reasoning trail that is both accurate and comprehensible to a policyholder without a technical background. The Model Bulletin's documentation expectation cannot be satisfied retroactively for a system that was not built to preserve that trail from the outset — bolting an explanation layer onto a system after regulators start asking questions is considerably harder, and less convincing, than designing the system from day one to log its own reasoning in a form a human reviewer can actually read.
4. Matching Deployment Model to Data Sensitivity
In practice, insurers are best served by treating deployment architecture as part of the fairness-and-governance answer, not as a separate IT decision made after the compliance framework has already been designed around an assumed technology stack. High-volume, lower-sensitivity claims triage — routing a straightforward property claim, flagging incomplete documentation — is well suited to a masked secure-cloud deployment, where speed and scale matter most and personally identifying information is stripped automatically before any processing occurs, narrowing the compliance surface to the masking layer itself.
Underwriting workflows that draw on more sensitive medical, financial, or behavioral data — the kind of data that, if mishandled, produces exactly the proxy-discrimination concerns the Colorado statute and the NAIC bulletin are both aimed at — are frequently better served by a fully on-premises deployment, what we refer to as Flow-Edge or Flow-OnPrem, which keeps the underlying data, and the model's access to it, entirely inside the insurer's own audited environment. This is not merely a data-protection argument; it is also a fairness-testing argument, because an insurer that controls the full data pipeline internally can test that pipeline for discriminatory outcomes far more rigorously than one relying on a third party's black-box processing.
5. The Cost of Getting This Wrong
It is worth dwelling briefly on what failure actually looks like here, because "regulatory exposure" can sound abstract until it is made concrete. An insurer using an opaque automation tool for claims triage that turns out to systematically deprioritize claims from a particular geographic region — even unintentionally, even as a byproduct of a correlated but facially neutral variable — faces not one but three simultaneous problems: an unfair-claims-practices inquiry under the state's existing statute, an AI-governance inquiry under the NAIC bulletin or its state-specific equivalent, and, if the pattern is severe enough, the kind of reputational story that follows an insurer for years regardless of how the regulatory matter is ultimately resolved.
The uncomfortable truth is that this failure mode does not require bad intent anywhere in the organization. It requires only an automation system that was optimized for speed and accuracy on aggregate metrics, deployed without the explainability and fairness-testing infrastructure needed to catch the problem before a regulator or a plaintiff's attorney does. This is precisely why treating deployment architecture and fairness governance as one integrated design decision, rather than two sequential ones, is the practical difference between an insurer that catches its own problem in a quarterly review and one that learns about it from a subpoena.
6. Conclusion
Regulators, across the NAIC bulletin, the Colorado statute, and the EU AI Act alike, have made clear that "the algorithm decided" is not an adequate answer to a policyholder or a state insurance commissioner, and it will only become a less adequate answer as these frameworks mature and enforcement catches up to rulemaking. An automation architecture that documents its data handling, preserves a legible reasoning trail, and matches its deployment model to the sensitivity of the underlying decision is what converts AI-driven claims processing from a standing regulatory exposure into a defensible, genuinely auditable operational advantage — the kind an insurer can point to proactively, rather than explain defensively.