Connecticut Insurance Department Adopts NAIC Model AI Bulletin – a Softer Stance on Data?

On February 26, the Connecticut Insurance Department (CID) issued Bulletin No. MC-25 on the "Use of Artificial Intelligence Systems by Insurers" (the Connecticut Bulletin). The Connecticut Bulletin replaces CID's April 20, 2022 Notice Concerning the Usage of Big Data and Avoidance of Discriminatory Practices and largely adopts the NAIC's recent Model Bulletin on Use of AI Systems by Insurers issued on December 4, 2023 (the NAIC Bulletin), with a few Connecticut twists. Notably, this Connecticut Bulletin marks a potential deviation from CID's April 20, 2022 notice, which focused on insurer use of data, a subject on which the final NAIC Bulletin was more restrained.

Consistent with the stated views of the NAIC, the Connecticut Bulletin emphasizes that Connecticut has the power to regulate insurer use of AI through existing statutes and regulations, including anti-discrimination laws and those that prohibit unfair practices by insurers in their adoption of new technologies. Thus, without passing any new laws or promulgating new regulations, the Connecticut Bulletin serves to put insurers on notice of how CID intends to apply and enforce the legal authorities already at its disposal.

The Connecticut Bulletin primarily deviates from the NAIC Bulletin with respect to CID's continued requirement for an annual certification. But CID's April 2022 notice's "Data Certification" has now been replaced with an "Artificial Intelligence Certification" in the Connecticut Bulletin, and the substantive difference in these certifications suggests the possibility of a change in focus. Pursuant to the Data Certification process under the April 2022 notice, insurers were required to certify that "all data used to build models or algorithms will be provided to the CID upon request." By contrast, the new Artificial Intelligence Certification requires insurers to certify either that (a) the insurer is not currently using any "AI Systems"; or (b) the insurer's use of AI is substantially consistent with the guidance, either because the insurer (i) has a written program (AIS Program) established, (ii) is currently establishing an AIS Program or (iii) is able to demonstrate compliance with the Connecticut Bulletin through alternative means. While the Artificial Intelligence Certification does include a certification that the insurer will make available all information and documentation requested consistent with Section 4 of the Connecticut Bulletin, the information sought by CID no longer explicitly includes the underlying data used to build AI and data models.

Apart from a few other stylistic, immaterial differences, and the insertion of the Connecticut-specific legal authority for the guidance, the Connecticut Bulletin "aligns Connecticut with the [NAIC Bulletin]," according to CID's press release. This means the Connecticut Bulletin carries over the extensive AIS Program Guidelines, guidelines on third-party AI systems and data, and regulatory oversight and examination considerations that were contemplated under the NAIC Bulletin.

The NAIC Bulletin leaves a lot of wiggle room for adopting states to enforce it as they see fit, and insurers would be wise to prepare for CID's approach to AI and big data to remain consistent with its previous approach under the April 2022 notice and Data Certification. But the glaring absence of the added focus on data in CID's adoption of the NAIC Bulletin in this Connecticut Bulletin leaves open the possibility that its approach will change.