Supplement reference

Exhibit A: how much AI you use

Part One quantifies use; Part Two is a request list including a Model Inventory. Materiality scopes what Exhibit A captures.

Exhibit A

Part One, for each operational or program area (marketing; premium quotes and discounts; underwriting and eligibility; ratemaking, rate classification, schedule rating and premium audits; claims and adjudication; customer service; utilization management, utilization review, prior authorization and level-of-care determination; fraud, waste and abuse; investment and capital management; reserves and valuations; catastrophe triage; reinsurance; other insurance practices): the number of AI Systems currently in use, the number implemented in the past X months (regulator specifies X), and the use cases. AI Models are then counted by type (GLMs, generative or agentic AI, other AI or ML) first under Direct Consumer Impact and again under Material Financial Impact. The v4.0 Legal/Compliance and Producer Services rows are dropped. Part Two is a request list: the materiality calculation, the risk-assessment documentation, and a Model Inventory listing each model's name (a), how it is used (b), the broader use case (c), the program areas it is used within (d), inherent risk level (e), consumer impact (f), and financial impact (g).

Exhibit B: how you govern it (the AIS Program)

Two formats. Narrative questions Q1 to Q5, or a checklist with items 1 to 3p. In the checklist, every answer cites a document name and page number.

B Q1

Provide the AIS Program: who maintains it (a), governance structure, board reporting and frequency (b), how it is integrated, assessed and remediated (c), how the effectiveness of the program and of individual models is assessed and modified (d), how responsibility is assigned and kept consistent (e), integration with ORSA and ERM (f), and how autonomy, reversibility and reporting impact of AI Systems are assessed (g).

B Q2

Describe AI uses that: generate material financial impact (a); generate direct consumer impact (b), including whether there is a human in the loop, high-volume transactions, how exceptions and errors are found and resolved, and any staffing reductions; generate or impact material financial-statement information (c); generate or impact risk or control assessment (d); and the development, testing and implementation of material AI Systems (e).

B Q3

Policy for vendors, model design and testing: validation of internally developed systems, including independence from development (a), validation of third-party vendor-supplied systems (b), the frequency, scope and method of testing and verification (c), and how the company ensures explainability and transparency into any AI models that recommend or make decisions (d).

B Q4

Policy for, and oversight of, material AI Systems used by third-party providers including actuarial, claim, MGA, audit and other professional services; and the testing and verification performed (a).

B Q5

Anything else about framework design and evaluation, including which unit is responsible and how often it assesses (a).

checklist 1

Has the company adopted a written AIS Program; when; how often is it reviewed.

checklist 2

Were the board or management involved in adopting it, and what is their role (2a).

checklist 3

Where the AIS Program addresses each of: 3a assessing, mitigating and evaluating inherent risks including unfair trade practices, 3b compliance with state and federal laws, 3c adverse consumer outcomes, 3d data privacy and protection, 3e suitability for intended use, 3f ERM, 3g ORSA, 3h the software development lifecycle or broader AIS Program, 3i financial-reporting impact, 3j employee training and prohibited practices, 3k quantifying risk levels, 3l vendor procurement standards and guidance, 3m consumer complaint tracking, 3n consumer awareness via disclosures, 3o how the company determined materiality and what threshold it used for assessing AI risk, and 3p how it governs, monitors, tests and ensures transparency of AI Systems developed by vendors.

Exhibit C: detail on each high-risk AI model

15 fields in version 5.0 (was 13). Risk criteria are set by the company, with materiality a consideration.

C 1

Model name and version number.

C 2

Use cases and purpose of the model.

C 3

Model type used in the AI System (GLM, generative or agentic AI, or other AI or ML algorithm).

C 4

Model implementation date.

C 5

Model development: internal, owned third party, true third party, or a mix; vendor name.

C 6

Whether the company purchased the model, whether it was developed for the company, and whether the company can modify it.

C 7

Model risk classification (high, moderate, low, and so on).

C 8

Model risks: the potential for adverse consumer impact.

C 9

Model limitations on use cases or data inputs outside the training domain, and the guardrails in place.

C 10

AI model type by autonomy: automate, augment, or support.

C 11

How outputs are tested (drift, accuracy, unfair trade practices, unfair discrimination, degradation), how the model was validated before deployment, and how it is monitored on an ongoing basis.

C 12

Last date of model testing.

C 13

How the model affects financial statements, risk assessment, or controls.

C 14

How the model is reviewed for compliance with state and federal law, including unfair trade practices and unfair claims settlement laws.

C 15

Actions taken against the company for use of this model.

Exhibit D: what data feeds the models

Exhibit D

A header field lists the AI Systems or AI Models that rely on the data described in the submission. Then, for each of 25 data categories (aerial imagery; age, gender, ethnicity or race; consumer or other insurance or risk score; crime statistics; criminal convictions excluding auto; driving behavior; education level; facial or body detection, recognition or analysis; geocoding; geo-demographics; household composition; image and video analysis; income; job history; loss experience; medical including biometric, genetic, pre-existing and diagnostic; natural catastrophe hazard; online social media; personal financial information; reasonable accommodations or policy modifications; telematics or UBI; vehicle-specific data including VIN; voice analysis; weather; other non-traditional): the type of data element, how the AI Model uses it (output use within operations, or input data for training and testing), the internal data source, and the third-party data source or vendor name. The regulator may customize categories by line of business and may request a data dictionary depending on the responses.