Compliance evidence that is only produced when an examiner asks is a project. Evidence that is produced every month, sent, and receipted is a system. Premium and claims bordereaux already work this way between MGA and carrier. AI governance reporting should ride the same rails.
Who reports to whom
Four flows. Same underlying data, different cuts.
| From | To | Cadence | Instrument |
|---|---|---|---|
| Delegated operator (MGA, program administrator, TPA, embedded distributor) | Carrier or fronting partner | Monthly, with bordereaux | AI governance bordereaux (below) |
| AI vendor | Any insurance customer (carrier, operator, broker) | Quarterly, and on any material change | Vendor governance report (Vendors v0.1, clause 11) |
| Operator | Own leadership or board | Quarterly | Governance summary (Exhibit B Q1b) |
| Carrier or operator | Regulator | On inquiry, exam, or pilot request | Exam response pack, assembled from the above |
The regulator pack is not a separate document. It is the most recent bordereaux cycles plus the register, formatted to the exhibits. If the monthly flow is running, the exam response is a filter, not a scramble.
The AI governance bordereaux
A machine-readable file plus a one-page human summary. One file per reporting period, per program. Versioned, hashed, receipted by the carrier, like a premium bordereaux.
Section 1: Register state (Control 1)
- Register as of period end: every AI system, version, tier, autonomy, risk class, vendor.
- Diff since last period: new systems, retired systems, version changes, tier changes, with the change date and reason.
- Last validation date per system (Exhibit C ref 9).
Section 2: Decision volumes (Control 4)
Per system, per decision class:
- Decisions produced.
- Split by autonomy applied: automated, augmented, supported.
- Human actions: accepted, overridden, escalated. Override rate.
- Adverse outcomes routed to human, and their disposition.
This is the section that turns “augment” from a label into a number the carrier can see.
Section 3: Monitoring and validation (Control 6)
- Drift events: count, systems affected, threshold tripped, disposition.
- Validation runs completed this period, with report reference.
- Bias or fairness test results where run, with limitations stated.
- Open findings and their age.
Section 4: Data and vendors (Controls 7, 9)
- Data element changes (new Exhibit D categories in use, new external sources, vendor changes).
- Vendor register changes: additions, removals, material change notices received, validation reports received.
- Subprocessor changes reported by vendors.
Section 5: Consumer outcomes and incidents (Control 5, checklist 3m)
- Complaints tagged to an AI system: count, system, disposition.
- Incidents: outputs outside validated behaviour, unauthorised changes, data exposure. Date, system, impact, remediation.
- Regulatory contact of any kind touching an AI system (Exhibit C ref 13).
Section 6: Attestation
- Named role attesting the report is complete for the period.
- Hash of the machine-readable file.
- Carrier receipt reference once returned.
Format
- Machine-readable: one JSON or CSV bundle per period, schema published and versioned alongside the register schema. The carrier ingests it; nobody re-keys it.
- Human summary: one page. Register count and changes, total decisions and override rate, drift events, incidents, open findings. Written for a program manager, not an engineer.
- Delivery: the same channel as premium bordereaux (SFTP, portal, API), the same day. Receipt is part of the record.
The machine-readable bundle is generated from the register, the decision log, the validation job output, and the vendor register. If those four exist (Controls 1, 4, 6, 9), the report is a query, not a task. If they don’t, the report is the forcing function that gets them built.
The carrier’s side
Carriers will increasingly ask for this whether or not the operator offers it, because Exhibit B Q4 asks the carrier to describe its oversight of AI used by service providers, MGAs named among them, and the carrier can only describe what it receives. The same logic runs for a TPA, a claims administrator, an embedded distributor, or any vendor whose output reaches the carrier’s book. The choice is whether to define the format or have it defined for you.
An operator that sends the bordereaux unprompted, in a stable schema, from the first month of a program, has done three things: answered Q4 on the carrier’s behalf, made itself the easiest program on the panel to oversee, and set the schema the carrier will then ask other programs to match. That last one is a competitive position, not a compliance cost.
For carriers reading this: one schema across the panel is worth more than a better questionnaire. Define it once, in the DAA, and require it monthly. Vendors v0.1 clause 14 is the flow-down that makes the MGA’s vendors feed it.
Leadership and board reporting
Exhibit B Q1b asks how AI governance reaches the board and how often. For a founder-led operator the honest answer is usually “it doesn’t, yet.” The quarterly summary is the same one-page human summary, aggregated across programs, plus: tier distribution of the estate, total governance effort spent, and the three open findings that matter. Minute it. The minute is the evidence.
What this is not
- Not a replacement for premium and claims bordereaux. It sits beside them.
- Not a regulatory filing. No state requires this format. It is the evidence base from which a filing or exam response is assembled.
- Not a vendor product. The schema is published so that anyone can generate it. What Nolte sells is building the four controls that make it a query.