Model Inventory and Classification for Insurers: Getting the Foundations Right

A precise model boundary, an attribute set that answers regulators' questions, and risk tiers that each trigger distinct controls.

Inventory, Boundaries and Risk Tiers

How insurers can define the model boundary, record the attributes regulators ask for, and keep risk tiers tied to controls.

Where Insurers Disagree

Model inventory and model classification form the base layer of any model risk management program. The inventory records which models and AI Systems exist, who owns them, what data feeds them and how each one is used. Classification assigns each entry a risk tier that sets how much scrutiny it receives.

Both become difficult because insurers disagree, often internally, on what counts as a model or Predictive Model rather than a business rule, which attributes the inventory must hold, and how finely to divide the risk scale. Regulators are answering each question in their own instruments, with different definitions and scope.

Case Study: An Insurer Finds Its Real Model Population

A multi-line property and casualty insurer reviewed its pricing, underwriting and claims analytics functions against its official model inventory.

1. Finding: Close to 150 spreadsheet rating factors, telematics scoring adjustments and claims triage rules had never been logged. Actuarial and underwriting staff had built them to bridge the filed rating plan and day-to-day pricing.

2. Impact: None of these recoreds had owners, validation records or documented assumptions. Many relied on third-party inputs: catastrophe model output, credit-based insurance scores and telematics feeds. Some were machine-learning triage models but were never flagged as AI Systems.

3. Root cause: The carrier had no single test for what counts as a model, so tools built outside the formal model development function were never assessed.

4. Takeaway: Consolidation raised the recorded model population by close to a third. The fix was a consistent definition applied to every function, including individual underwriters and actuaries.

Why Model Inventory and Classification Matter

No Single Insurance Model Risk Regulator in the U.S.

Insurance in the U.S. is regulated by the states, so no single supervisory standard anchors model risk practice as federal guidance does for banks. The NAIC's Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted December 4, 2023, fills part of the gap. It expects a written AIS Program and lists inventories of Predictive Models and AI Systems among the documents regulators may request in an investigation or market conduct action.

The NAIC's implementation map shows 25 adopting jurisdictions, while California, Colorado, New York and Texas use their own frameworks. Adopting states may also use their own definitions, so a national carrier reconciles rulebooks that do not match word for word.

Regulators are now turning guidance into examination practice. Twelve states piloted the NAIC's AI Systems Evaluation Tool in 2026, since renamed the AI Risk Evaluation Supplement. One exhibit asks insurers to quantify their AI use, and the high-risk exhibit relies on the insurer's own view of which systems are high-risk. Version 5.0 was exposed for comment through September 29, 2026, ahead of possible adoption at the Fall National Meeting.

Executive Order 14365, signed December 11, 2025, directs federal agencies to challenge state AI laws. Commentators note that an executive order is not an Act of Congress, so it does not by itself override state insurance regulation protected by the McCarran-Ferguson Act. Until Congress legislates specifically, state expectations remain the operative ones.

Canada, the UK and the EU: Different Instruments, Different Scopes

OSFI's Guideline E-23 applies to federally regulated life and P&C insurers as well as banks. Finalized September 11, 2025 and effective May 1, 2027, it treats as a model any application of theoretical, empirical or judgmental assumptions, or statistical techniques including AI and machine learning, that turns input data into results. It expects an evergreen inventory, and each model's risk rating drives review frequency, documentation, monitoring and approval authority.

The PRA's SS1/24, effective December 31, 2024, covers insurers that use or seek permission for a Solvency II internal model, setting expectations on data, validation, documentation and model change. Its scope is the capital model. SS1/23's model risk principles apply to banks, so no PRA statement is dedicated to insurers' pricing, underwriting and claims models.

EIOPA's Opinion on AI Governance and Risk Management, published August 6, 2025, tells national supervisors how Solvency II and the Insurance Distribution Directive apply to AI. It excludes systems that are high-risk or prohibited under the EU AI Act, which treats life and health risk assessment and pricing as high-risk. An EU insurer's inventory therefore needs to record which regime governs each AI System.

Other supervisors are converging on the same expectation. The Monetary Authority of Singapore's proposed Guidelines on AI Risk Management call for consistent identification of AI use, an up-to-date inventory and a materiality assessment across impact, complexity and reliance. The Central Bank of the UAE's February 2026 guidance note on responsible AI applies to all licensed financial institutions, including insurers.

Where the Model Boundary Gets Tested

The harder classification question is what belongs in the inventory at all, and insurance vocabulary makes it more contested than in banking. A generalized linear model used to set rating factors fits the NAIC bulletin's Predictive Model definition, which centers on mining historic data with algorithms or machine learning to predict outcomes. A static exclusion list applied at underwriting intake generally does not.

Manual rating overrides and an appointed actuary's top-side adjustments to loss reserves sit in between. The NAIC definition does not clearly reach them. E-23's does, because it counts judgmental assumptions as a modeling technique and expects deployment procedures to cover overlays. We recommend logging each override or adjustment against the model it changes, with its own owner, rationale and approval.

Materiality Without Excessive Questionnaires

In our experience, some carriers assess annual model materiality through internal forms running past a hundred questions. Underwriting and actuarial staff complete them mechanically each year, and the resulting ratings are hard to defend.

The NAIC bulletin offers a tighter basis. It scales controls to the insurer's own assessment of consumer risk across five factors: the nature of the decision, the type and degree of potential harm, human involvement in the final decision, transparency to the consumer, and reliance on third-party data and models. Clear criteria for each factor fit on a page. For reserving and capital models, E-23's quantitative factors, such as portfolio size and financial impact, fill the gap.

How Many Risk Tiers Actually Help

Expanding a red-amber-green scale into six or more colors rarely improves differentiation. A tier helps only if it triggers distinct validation, documentation, monitoring and approval requirements, which is how E-23 uses the risk rating. Three to four tiers generally cover rating, underwriting, claims and reserving models, consistent with EIOPA's risk-based, proportionate approach.

E-23 also permits a tracked negligible-risk category exempt from full lifecycle governance. An insurer can therefore log every spreadsheet tool it finds while reserving full validation for models with non-negligible risk.

What an Insurer's Inventory Should Record

E-23's Appendix 1 is a practical baseline. Every identified model gets an ID, name and use, risk rating, owner, developer and origin. Models with non-negligible risk add version, deployment date, reviewer, approver, dependencies, data sources, approved uses, limitations, review dates and monitoring status. Insurers should add fields that mirror how their own regulators ask questions:

1. Function and line: rating, underwriting, claims, reserving or capital, by line of business, mapped to rate filings and market conduct scope.

2. Classification: Predictive Model, AI System or end-user tool under the insurer's policy, noting where a state's definitions differ, plus the AI Act risk class for EU business.

3. Consumer impact: whether the model makes or supports a decision that could produce an adverse consumer outcome.

4. Human involvement: whether a person makes the final decision, which the NAIC bulletin treats as a risk factor.

5. Jurisdictions and filings: where the model is used and which rate filings depend on it.

6. Third-party dependency: vendor, product version, audit and regulatory-cooperation terms, and the date of the last due-diligence review.

External Data and AI Belong in the Attribute Set

Catastrophe models, credit-based insurance scores and telematics feeds are central to an insurer's model population, and each depends on a vendor. Florida requires expected hurricane losses in residential rate filings to come from models the Florida Commission on Hurricane Loss Projection Methodology has found acceptable. Acceptability is version-specific and expires, so the inventory should track vendor version and acceptance status.

The NAIC bulletin expects the AIS Program to cover AI Systems whether built in-house or by a vendor. It calls for due diligence on third parties and, where appropriate and available, contract terms that provide audit rights and require cooperation with regulatory inquiries. Outsourcing the model does not transfer the obligation.

The bulletin's AI System definition is broad: a machine-based system that generates predictions, recommendations, content or other outputs influencing decisions. Telematics pricing, claims fraud triage and generative drafting tools will generally fall inside it. Static rules engines are a closer call, which the insurer's documented policy should settle consistently.

In India, IRDAI constituted a seven-member AI working group on June 18, 2026, with three months to recommend a governance framework. Its mandate begins with mapping which AI systems insurers use and how they govern them, which is an inventory exercise. Carriers with Indian operations should expect that request early.

What to Prioritize Now

Settle the definitions of model, Predictive Model and AI System first, and test them against overrides, top-side adjustments and end-user spreadsheets. Assign each new model a provisional tier at design stage, as our post on model risk assessment before validation argues, using one short assessment built on the NAIC bulletin's five factors.

Then structure the inventory to answer the NAIC AI Risk Evaluation Supplement directly: AI System counts by function, the insurer's own high-risk list and the data behind each system, with dedicated attributes for vendor catastrophe, scoring and telematics models.

How Solytics Partners Can Help

Solytics Partners works with insurers' actuarial, underwriting, claims and governance teams to define model boundaries and build them into a working inventory.

1. Centralize the inventory: MRM Vault holds model and AI System records, ownership and an immutable audit trail as a single source of truth across rating, underwriting, claims and reserving.

2. Map tiering to your regulators: configurable tiering and regulatory mappings cover the NAIC AI Model Bulletin, OSFI E-23, EIOPA and IRDAI, so one inventory serves a multi-jurisdiction footprint.

3. Set the boundary first: our consultants define and test model, Predictive Model and AI System criteria with your actuarial and underwriting teams before configuration.

4. Prepare for examination: we structure inventory data to answer NAIC evaluation exhibits and OSFI inventory expectations directly.

Related Topics

• Governing Third-Party Catastrophe and Scoring Vendors Under the NAIC Bulletin

• State-by-State Adoption of the NAIC AI Model Bulletin and What It Means for Multi-State Carriers

• Where Generative AI Fits in an Insurer's Model Risk Framework

• Actuarial Model Governance Under Principle-Based Reserving

• Preparing for OSFI Guideline E-23 as a Federally Regulated Insurer

References

1. National Association of Insurance Commissioners (NAIC). Model Bulletin: Use of Artificial Intelligence Systems by Insurers. December 4, 2023. https://content.naic.org/sites/default/files/cmte-h-big-data-artificial-intelligence-wg-ai-model-bulletin.pdf.pdf

2. Office of the Superintendent of Financial Institutions (Canada). Guideline E-23, "Model Risk Management" (2027). Finalized September 11, 2025. https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/guideline-e-23-model-risk-management-2027

3. Bank of England and Prudential Regulation Authority. SS1/24, "Expectations for Meeting the PRA's Internal Model Requirements for Insurers under Solvency II." February 2024. https://www.bankofengland.co.uk/prudential-regulation/publication/2024/february/expectations-for-meeting-the-pra-internal-model-requirements-ss

4. European Insurance and Occupational Pensions Authority (EIOPA). Opinion on Artificial Intelligence Governance and Risk Management (EIOPA-BoS-25-360). August 6, 2025. https://www.eiopa.europa.eu/publications/opinion-artificial-intelligence-governance-and-risk-management_en

5. European Union. Regulation (EU) 2024/1689 (Artificial Intelligence Act). 2024. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

6. Central Bank of the UAE. Guidance Note on the Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning by Licensed Financial Institutions. 2026. https://rulebook.centralbank.ae/en/rulebook/guidance-note-consumer-protection-and-responsible-adoption-and-use-artificial-intelligence

7. Monetary Authority of Singapore. Consultation Paper on Guidelines on Artificial Intelligence Risk Management for Financial Institutions. 2025. https://www.mas.gov.sg/publications/consultations/2025/consultation-paper-on-guidelines-on-artificial-intelligence-risk-management