Insurance
Insurance software built for the exam, not the demo
A rating engine that charges something other than what was filed is a violation, not a bug. That changes what good engineering means here.
What makes insurance different
4 things that decide this
- 01There is no national insurance regulator in the US. Each state adopts its own version of the rules, so jurisdiction and effective date belong in your schema from day one.
- 02New York says an insurer may not rely solely on a vendor's claim of non-discrimination, and may not hide behind a vendor's proprietary algorithm when explaining an adverse decision.
- 03Colorado does not accept 'we do not collect race' as an answer. Life insurers using external consumer data there must estimate it statistically and test their models every year.
- 04Premium audit is a post-policy reconciliation, not an underwriting decision. That places it outside the sharpest AI rules while still touching payroll and tax data.
Four buyers, four different products
Insurance buying splits by entity type, not company size. A large carrier and a small managing general agent both commission custom software, for opposite reasons. A carrier buys because its core system cannot be changed. The MGA buys because it has no core system at all.
Knowing which one you are changes the first release completely. Is your hard part a security review? A bordereau your capacity provider will accept? Or getting a program live before the season starts? We ask that first.
- 01Carriers buy defensibility. Audit trail, explainability and a human in the loop, evidenced for the next exam.
- 02MGAs buy a program that can launch this season, with rating logic they own and clean bordereaux.
- 03Brokers and agencies buy an end to re-keying between the carrier and their management system.
- 04Insurtechs buy senior engineers who have seen an ACORD form before.
Sector context
Rules your build has to answer to
Dec 2023
NAIC adopted its AI model bulletin, requiring a written AI systems program
24
States had adopted that bulletin as of March 2025 (Quarles), and the count keeps rising
Jul 2024
NY DFS Circular Letter 7 set the testing and disclosure bar for underwriting AI
44
States with unfair claims settlement statutes based on NAIC Model 900
The work we take in this sector
Sorted by how much of it we have shipped, not by how it sells.
Premium audit automation
Reading payroll registers, tax forms and general ledgers, then reconciling numbers across documents rather than trusting any one of them. Built for PremiumAudit.io on Claude, with the auditor still deciding.
Document intake that survives the real inbox
Submissions arrive by email, portal, SFTP and fax-to-email. We build the test corpus from your worst real week, because a pilot on curated PDFs tells you nothing about February.
Class code assistance, not class code decisions
The NCCI Scopes manual is prose, not a lookup table, and two experienced auditors disagree. We surface candidates with the governing text and flag drift against the prior term. A person picks.
Model governance and evidence
A model inventory, versioned prompts, logged inputs as well as outputs, and recorded human overrides. Regulators now ask what the system did in March. Most systems cannot answer.
Statutory clocks that hold up
Acknowledgment windows run 10 to 15 business days depending on the state. One global timer silently breaches the shorter ones, and an exam samples files and counts.
Sitting beside a core you keep
Guidewire, Duck Creek and the rest are co-existence work, never replacement. We design an adapter layer against the platform's own release train, so your delivery schedule does not depend on theirs.
- UnderwritingRegulated decision. Assist only
- PricingFiled rates. Deterministic
- ClaimsSummarise, never determine cover
- Premium auditReconciliation. Best fit
- EvidenceLogged for the exam
Every major AI rule targets underwriting, pricing and adverse consumer decisions. Premium audit is a reconciliation of exposure after the fact, which is why it is the lowest-friction place to start. The result still changes premium, so treat it as outside the AI decision rules rather than unregulated.
Explain the decision, not the model
Teams build explainability for data scientists. Feature importance charts, attribution scores, a dashboard nobody outside the team reads. Then a regulator asks why one applicant was declined, and none of it answers the question.
New York asks for details about all information the decision was based on, including the source of that specific information. It also says an insurer may not rely on a vendor's proprietary process to excuse vagueness. So buying a scoring API and storing only the score makes the duty impossible to meet. Log the request, the response, the vendor, the model version and the time. That is a schema decision, and it is very hard to retrofit.
- A prompt changed on a Tuesday is a model change with no version bump. Treat prompts as release artefacts.
- Test bias before production, on a cadence after it, and again on every material change.
- Calibrate confidence scores on real documents. A model that returns 0.9 for everything routes nothing to a human.
Document-heavy systems where a wrong number has consequences
“I am extremely happy with the results and would highly recommend Hashlogics to anyone.”
Daniel Khin · CEO, PremiumAudit.io
How the usual pitch differs from ours
| Criterion | A typical insurance AI pitch | How we scope it |
|---|---|---|
| Class codes | A classifier that outputs one code. | Retrieval plus ranked candidates plus the governing text. An auditor decides, because a wrong code is a re-rating event. |
| Accuracy claims | A headline percentage with no denominator. | Admitted rate, straight-through rate within admitted, and escape rate, reported together. |
| Prompts and models | Config, edited in place. | Versioned release artefacts with a regression suite of real documents. |
| Vendor model calls | Store the score. | Store the request, response, vendor, model version and timestamp. New York requires the specifics. |
| Fraud detection | AI catches fraud. | Prioritised SIU queue with reasons. A model producing adverse action inherits explainability duties. |
| Rating calculation | Another AI feature. | We say no. Rating stays deterministic, versioned and effective-dated so a historical quote can be reproduced. |
What this work runs on
Shipped in PremiumAudit.io
Where we usually build
Standards buyers raise
Questions carriers and MGAs ask
01Is using AI in premium audit regulated?
Premium audit sits outside the sharpest AI rules, because those target underwriting, pricing and adverse consumer decisions. A premium audit reconciles exposure after the policy has run, so it is not a rating decision. Treat it as lower friction rather than unregulated. An audit result still changes premium, and a disputed class code has a formal dispute process. Data security duties apply in full, since the work touches payroll records, tax filings and employer identification numbers.
02What does the NAIC AI bulletin actually require us to build?
A written AI systems program that a regulator can audit, which in engineering terms means four things. An inventory of every AI system in use, in development and retired. Versioning for models, prompts and reference data. Logged inputs and outputs per decision, plus recorded human overrides. And evidence that testing happened on a schedule rather than once at launch. Adopted in December 2023, it had reached 24 states by March 2025 and more since. It is guidance until your state adopts it, then it shows up in a market conduct exam.
03Our policy system cannot be replaced. Can you work around it?
Co-existence is the normal shape of insurance work and usually the right answer. Your platform team and its release train control access to a Guidewire or Duck Creek environment, so we design an adapter layer and a clear contract between the two systems. That keeps your build testable on its own schedule instead of blocking on someone else's.
04How do you stop the AI inventing a number on a payroll document?
Extract to typed fields and let deterministic code do the arithmetic, never the model. Every extracted value links back to the document, the page and the line it came from, so an auditor can check it in seconds. Anything below the confidence threshold routes to a person instead of flowing through. We also calibrate those thresholds against real documents rather than clean samples, because an uncalibrated score sends nothing to review and errors reach the bill.
05Why do our audits pile up for four months and then stop?
Premium audit is seasonal, and systems sized for the average fall over at the peak. Volume can triple in a season while your team stays the same. That is when overtime, temporary staff and data entry errors all arrive together. Plan capacity against the peak, not the mean. Your queue and routing also have to degrade gracefully. When a backlog builds, the work done first should be whatever is closest to breaching an audit window.
06What would you need to see before quoting an insurance build?
Scoping calls are free. Where the honest answer requires reading your existing codebase, we run a paid two-week diagnostic that ends in a fixed price. Three things drive the estimate. Which document types really arrive, taken from a real inbox week. Whether a gated vendor or core relationship sits on the critical path, since that is a procurement clock rather than an engineering one. And how much of your workflow has to be a deterministic rules engine. We will not put a number on it before that.
Go deeper
- Insurance industry overview →Audit trails, document work and where a system has to escalate to a person.
- PremiumAudit.io case study →AI automation for insurance premium audits, and how the workflow is shaped.
- Human in the loop →What the phrase has to mean before it counts as a control.
- AI insurance audit automation →An audit is only as fast as its slowest handoff.
- Insurance case studies →One pattern, three builds: read the document, prove the number.
