On July 11, 2024, the New York Department of Financial Services finalized Insurance Circular Letter No. 7, establishing the department’s expectations for all insurers authorized to write business in New York who use insurance AI systems or external consumer data in underwriting and pricing. The circular letter is not new legislation; it is DFS’s formal articulation of how existing New York insurance law applies to AI-driven decisions.
That framing matters. Circular Letter 2024-7 does not require a new law to take effect. DFS can examine and investigate insurer AI practices under existing market conduct authority today, and the letter signals precisely what examiners will be looking for.
What the New York DFS Circular Letter Covers
Circular Letter 2024-7 applies to all insurers licensed in New York (including P&C, life, health, HMOs, Article 43 corporations, fraternal benefit societies, and the New York State Insurance Fund) when those entities use AI systems (AIS) or external consumer data and information sources (ECDIS) in underwriting or pricing.¹
The scope is specifically defined: the guidance covers AI used to supplement traditional underwriting or pricing, as a proxy for traditional underwriting, or to identify ‘lifestyle indicators’ that contribute to an underwriting or pricing assessment. The circular letter does not address claims adjusting, marketing, fraud detection, or other insurance functions. Its focus is the underwriting and pricing decision specifically.²
Notably, DFS did not follow the NAIC Model Bulletin framework when drafting this guidance. New York developed its own approach, rooted in existing anti-discrimination statutes rather than the NAIC’s principles-based governance model.³
The Core Obligation: Demonstrate the System does not Proxy for Protected Classes
The fairness principle at the center of Circular Letter 2024-7 is direct: an insurer should not use ECDIS or AIS for underwriting or pricing unless the insurer can establish that the data source or model does not use and is not based in any way on any class protected under New York Insurance Law Article 26.⁴
Step 1: Adverse Effects Assessment: Carriers must evaluate whether the use of ECDIS or AIS produces disproportionate adverse effects in underwriting or pricing for similarly situated insureds. This assessment must be conducted for any protected class where membership can be determined from data available to the insurer or can be reasonably inferred using accepted statistical methodologies.⁵ If there is no prima facie showing of disproportionate adverse effects, the assessment may conclude.
Step 2: Business Necessity Analysis: If a disproportionate adverse effect is found, the carrier must assess whether there is a legitimate and lawful rationale for the differential outcome. If no legitimate rationale exists, the carrier must modify its use of the data source or model and repeat Step 1.
The implication of Step 2 is important: a disparate outcome is not automatically disqualifying. But the carrier must document the legitimate business necessity for the differential treatment and be prepared to produce that analysis to examiners.
The Proxy Assessment: Technical Requirements and Practical Implications
The proxy assessment requirement asks carriers to evaluate whether their ECDIS (the external data they use in underwriting) correlates with protected class status in ways that would constitute unfair or unlawful discrimination. DFS clarified in the final circular letter that this evaluation may use data available to the insurer or data that may be reasonably inferred using accepted statistical methodologies. The department explicitly rejected arguments from commenters that carriers cannot perform these assessments because they do not collect protected class data.⁶
This is a meaningful technical burden. It requires actuarial or data science resources capable of performing proxy discrimination analysis by examining whether variables like credit score, occupation, neighborhood, or consumer behavioral data serve as statistical proxies for race, national origin, gender, or other protected characteristics.
For third-party vendor data and model outputs, the obligation does not transfer to the vendor. Carriers retain full compliance responsibility for any ECDIS or AIS used in their underwriting, regardless of who developed or deployed it.⁷ The circular letter requires carriers to develop written standards, policies, and procedures for vendor oversight and importantly, contracts with vendors should include the right to audit the vendor or receive a qualified audit report, and require vendor cooperation with any regulatory inquiry.⁸
Governance, Documentation, and Examination Exposure
Beyond the proxy assessment, Circular Letter 2024-7 requires carriers to maintain a governance framework for AI oversight that includes: policies and procedures covering the entire model lifecycle, risk management and internal controls, and board-level or senior management reporting on whether AI use is operating within the insurer’s risk appetite.
Documentation expectations are significant. Carriers should be able to produce:
- Model validation reports and bias testing results
- Evidence that ECDIS is supported by generally accepted actuarial standards of practice
- Vendor oversight agreements including audit rights
- Adverse underwriting decision notices that identify the specific data upon which the adverse decision was based
- Internal governance policies and procedures
DFS can request this documentation through regular or targeted market conduct examinations, or through special reports under Insurance Law §308. There is no filing deadline or certification requirement, but the absence of documentation when an examination request arrives is itself an exposure.
Consumer Disclosure Requirements
When an adverse underwriting decision is made using ECDIS or AIS, the insurer must provide written notice to the applicant within 15 days. That notice must include details about all information upon which the insurer based any declination, limitation, rate differential, or other adverse underwriting decision, including the source of the specific data.⁹
If the adverse outcome was based on specific ECDIS data, the notice must also include a process for the applicant to review the accuracy of that data. This is a consumer-facing transparency requirement that has operational implications for how carriers structure their adverse action workflow.
Why New York Matters for P&C Carriers
New York is one of the largest insurance markets in the country, and DFS has historically been among the most active state insurance regulators on market conduct and consumer protection enforcement. Circular Letter 2024-7 does not set a future effective date. The expectations it articulates are grounded in existing law and applicable to insurers using these technologies today.
For carriers that have deployed AI or external data tools in New York underwriting without conducting formal proxy assessments, the path forward is clear: inventory the systems in use, assess each for disparate impact against protected classes, document the findings, and establish the vendor contracts and governance procedures the circular letter requires. The cost of building that program before an examination is substantially lower than the cost of producing it under regulatory scrutiny.
About WaterStreet
About WaterStreet Company: WaterStreet provides cloud-based policy administration software for small to mid-size P&C carriers. Our platform is designed to support the governance, documentation, and workflow requirements carriers increasingly need to meet regulatory expectations in an AI-driven environment.
Contact Us to see a demo or learn more!
Sources:
- NY DFS, Insurance Circular Letter No. 7 (2024): Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing (July 2024)
- Alston & Bird, NYDFS Issues Final Circular Letter Guidance on Use of AI in Insurance Underwriting and Pricing (July 2024)
- Troutman Pepper Locke, New York DFS Issues Circular Letter No. 7 (July 2024)
- NY DFS, Insurance Circular Letter No. 7 (July 2024), Fairness Principles Section
- Willkie Compliance Concourse, NYDFS Adopts Circular Letter on the Use of AI in Insurance (July 2024)
- Epstein Becker Green, Insurers in the Crosshairs, Part II (August 2024)
- Willkie Compliance Concourse, NYDFS Adopts Circular Letter on the Use of AI in Insurance (July 2024)
- Alston & Bird, NYDFS Issues Final Circular Letter Guidance (July 2024)
- Sullivan & Cromwell, NYDFS Final Guidance: AI Use in Insurance Underwriting and Pricing (July 2024)
